@cdxgen/cdxgen 13.4.0 → 13.6.0

package/data/rules/cbom-security.yaml

@@ -141,21 +141,22 @@
     }
 
 - id: CBC-001
-  name: "Expired or Expiring Certificate"
-  description: "Certificates that have expired or are close to their expiration date will cause service disruptions or trust validation failures."
+  name: "Expired Certificate"
+  description: "A certificate whose validity ended before the audit ran will fail trust validation and cause service disruptions."
   severity: high
   category: cbom-compliance
   dry-run-support: full
   condition: |
     components[
       cryptoProperties.assetType = 'certificate'
-      and $hasProp($, 'cdx:cert:isExpired', 'true')
+      and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) != null
+      and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) < $toMillis($now())
     ]
   location: |
     {
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
-  message: "Certificate for Subject '{{ cryptoProperties.certificateProperties.subjectName }}' has expired or is invalid"
+  message: "Certificate for Subject '{{ cryptoProperties.certificateProperties.subjectName }}' expired on {{ cryptoProperties.certificateProperties.notValidAfter }}"
   mitigation: "Renew the certificate and update the deployment trust stores."
   evidence: |
     {
@@ -163,3 +164,233 @@
       "issuer": cryptoProperties.certificateProperties.issuerName,
       "notValidAfter": cryptoProperties.certificateProperties.notValidAfter
     }
+
+- id: CBC-002
+  name: "Certificate expiring within 30 days"
+  description: "A certificate that is still valid but expires within 30 days will soon cause trust validation failures."
+  severity: medium
+  category: cbom-compliance
+  dry-run-support: full
+  condition: |
+    components[
+      cryptoProperties.assetType = 'certificate'
+      and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) != null
+      and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) >= $toMillis($now())
+      and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) < ($toMillis($now()) + 2592000000)
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Certificate for Subject '{{ cryptoProperties.certificateProperties.subjectName }}' expires on {{ cryptoProperties.certificateProperties.notValidAfter }}"
+  mitigation: "Plan the certificate renewal and update the deployment trust stores before it expires."
+  evidence: |
+    {
+      "subject": cryptoProperties.certificateProperties.subjectName,
+      "issuer": cryptoProperties.certificateProperties.issuerName,
+      "notValidAfter": cryptoProperties.certificateProperties.notValidAfter
+    }
+
+# The eight SPKI SHA-256 hashes Go 1.27.3 and 1.26.10 hard-code into
+# crypto/x509 (CVE-2026-111943).
+# https://github.com/golang/go/commit/90617fb7ceb59cf08bee7826bb51b8c8fb8c11de
+- id: CBC-003
+  name: "Certificate or key distrusted by Go (CVE-2026-111943)"
+  description: "Go 1.27.3 and 1.26.10 reject every chain containing one of eight intermediate CA keys, matched by the SHA-256 of the certificate's SubjectPublicKeyInfo. The hash matches re-issued and cross-signed copies of the same key as well."
+  severity: high
+  category: cbom-security
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "SC-13 Cryptographic Protection"
+  condition: |
+    (
+      $deny := [
+        "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
+        "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f",
+        "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41",
+        "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0",
+        "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b",
+        "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8",
+        "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6",
+        "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30"
+      ];
+      components[
+        (
+          cryptoProperties.assetType = 'certificate'
+          or cryptoProperties.assetType = 'related-crypto-material'
+        )
+        and $exists(properties[name = 'cdx:crypto:spkiSha256'].value[$lowercase($) in $deny])
+      ]
+    )
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Certificate or key '{{ name }}' carries a public key Go 1.27.3/1.26.10 distrust (CVE-2026-111943)"
+  mitigation: "Replace the certificate chain and remove the key from every trust store, bundle and pin. https://github.com/golang/go/commit/90617fb7ceb59cf08bee7826bb51b8c8fb8c11de"
+  evidence: |
+    {
+      "spkiSha256": $prop($, 'cdx:crypto:spkiSha256'),
+      "subject": cryptoProperties.certificateProperties.subjectName,
+      "locations": $count(evidence.occurrences)
+    }
+
+- id: CBC-004
+  name: "Certificate issued under a Go-distrusted key (CVE-2026-111943)"
+  description: "The certificate was issued by one of the eight intermediate CA keys Go 1.27.3 and 1.26.10 distrust, so Go clients rebuilt with those releases will refuse the chain even while the operating system still accepts it."
+  severity: high
+  category: cbom-security
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "SC-13 Cryptographic Protection"
+  condition: |
+    (
+      $deny := [
+        "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
+        "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f",
+        "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41",
+        "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0",
+        "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b",
+        "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8",
+        "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6",
+        "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30"
+      ];
+      $badSkis := components[
+        cryptoProperties.assetType = 'certificate'
+        and $exists(properties[name = 'cdx:crypto:spkiSha256'].value[$lowercase($) in $deny])
+      ].properties[name = 'cdx:crypto:subjectKeyId'].value[$ != null].$lowercase($);
+      components[
+        cryptoProperties.assetType = 'certificate'
+        and $not($exists(properties[name = 'cdx:crypto:spkiSha256'].value[$lowercase($) in $deny]))
+        and (
+          $count(properties[name = 'cdx:crypto:issuerSpkiSha256' or name = 'cdx:crypto:unverifiedIssuerSpkiSha256'].value[$lowercase($) in $deny]) > 0
+          or (
+            $prop($, 'cdx:crypto:authorityKeyId') != null
+            and $lowercase($nullSafeProp($, 'cdx:crypto:authorityKeyId')) in $badSkis
+          )
+        )
+      ]
+    )
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Certificate '{{ name }}' was issued under a public key Go 1.27.3/1.26.10 distrust (CVE-2026-111943)"
+  mitigation: "Re-issue the certificate under a trusted CA and update the server chain. https://github.com/golang/go/commit/90617fb7ceb59cf08bee7826bb51b8c8fb8c11de"
+  evidence: |
+    {
+      "authorityKeyId": $prop($, 'cdx:crypto:authorityKeyId'),
+      "issuerSpkiSha256": properties[name = 'cdx:crypto:issuerSpkiSha256'].value,
+      "subject": cryptoProperties.certificateProperties.subjectName
+    }
+
+# Post-quantum OIDs (ML-DSA RFC 9881, SLH-DSA RFC 9909, ML-KEM RFC 9935) and
+# the classical-only cutoff. NIST IR 8547 (initial public draft) proposes
+# classical algorithms be disallowed after 2035.
+- id: CBC-005
+  name: "Classical-only CA certificate valid past the post-quantum transition"
+  description: "A CA certificate whose key and signature algorithms are both classical stays valid beyond 2035-01-01, past the date NIST IR 8547 (initial public draft) proposes to disallow classical algorithms."
+  severity: low
+  category: cbom-security
+  dry-run-support: full
+  condition: |
+    (
+      $pq := [
+        "2.16.840.1.101.3.4.3.17", "2.16.840.1.101.3.4.3.18", "2.16.840.1.101.3.4.3.19",
+        "2.16.840.1.101.3.4.3.20", "2.16.840.1.101.3.4.3.21", "2.16.840.1.101.3.4.3.22",
+        "2.16.840.1.101.3.4.3.23", "2.16.840.1.101.3.4.3.24", "2.16.840.1.101.3.4.3.25",
+        "2.16.840.1.101.3.4.3.26", "2.16.840.1.101.3.4.3.27", "2.16.840.1.101.3.4.3.28",
+        "2.16.840.1.101.3.4.3.29", "2.16.840.1.101.3.4.3.30", "2.16.840.1.101.3.4.3.31",
+        "2.16.840.1.101.3.4.4.1", "2.16.840.1.101.3.4.4.2", "2.16.840.1.101.3.4.4.3"
+      ];
+      $cutoff := '2035-01-01T00:00:00Z';
+      components[
+        cryptoProperties.assetType = 'certificate'
+        and $prop($, 'cdx:crypto:certRole') in ['root', 'intermediate']
+        and $prop($, 'cdx:crypto:publicKeyAlgorithmOid') != null
+        and $prop($, 'cdx:crypto:signatureAlgorithmOid') != null
+        and $not($prop($, 'cdx:crypto:publicKeyAlgorithmOid') in $pq)
+        and $not($prop($, 'cdx:crypto:signatureAlgorithmOid') in $pq)
+        and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) != null
+        and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) > $toMillis($cutoff)
+      ]
+    )
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "CA certificate '{{ name }}' uses only classical algorithms but is valid past the 2035-01-01 cutoff"
+  mitigation: "Plan a migration to post-quantum algorithms before the classical-only validity window ends."
+  evidence: |
+    {
+      "keyAlgorithmOid": $prop($, 'cdx:crypto:publicKeyAlgorithmOid'),
+      "signatureAlgorithmOid": $prop($, 'cdx:crypto:signatureAlgorithmOid'),
+      "notValidAfter": cryptoProperties.certificateProperties.notValidAfter
+    }
+
+- id: CBC-006
+  name: "Post-quantum key certified with a classical signature"
+  description: "The certificate's public key is post-quantum but its signature algorithm is classical, so the authentication of that key is only as strong as the classical signature."
+  severity: medium
+  category: cbom-security
+  dry-run-support: full
+  condition: |
+    (
+      $pq := [
+        "2.16.840.1.101.3.4.3.17", "2.16.840.1.101.3.4.3.18", "2.16.840.1.101.3.4.3.19",
+        "2.16.840.1.101.3.4.3.20", "2.16.840.1.101.3.4.3.21", "2.16.840.1.101.3.4.3.22",
+        "2.16.840.1.101.3.4.3.23", "2.16.840.1.101.3.4.3.24", "2.16.840.1.101.3.4.3.25",
+        "2.16.840.1.101.3.4.3.26", "2.16.840.1.101.3.4.3.27", "2.16.840.1.101.3.4.3.28",
+        "2.16.840.1.101.3.4.3.29", "2.16.840.1.101.3.4.3.30", "2.16.840.1.101.3.4.3.31",
+        "2.16.840.1.101.3.4.4.1", "2.16.840.1.101.3.4.4.2", "2.16.840.1.101.3.4.4.3"
+      ];
+      components[
+        cryptoProperties.assetType = 'certificate'
+        and $prop($, 'cdx:crypto:publicKeyAlgorithmOid') in $pq
+        and $prop($, 'cdx:crypto:signatureAlgorithmOid') != null
+        and $not($prop($, 'cdx:crypto:signatureAlgorithmOid') in $pq)
+      ]
+    )
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Certificate '{{ name }}' binds a post-quantum key with the classical signature '{{ $prop($, 'cdx:crypto:signatureAlgorithm') }}'"
+  mitigation: "Re-issue the certificate under a post-quantum or composite signature scheme once one is standardised for your chain."
+  evidence: |
+    {
+      "keyAlgorithmOid": $prop($, 'cdx:crypto:publicKeyAlgorithmOid'),
+      "signatureAlgorithmOid": $prop($, 'cdx:crypto:signatureAlgorithmOid')
+    }
+
+- id: CBC-007
+  name: "Unrecognised certificate algorithm"
+  description: "The key or signature algorithm is named only by its dotted OID, which means a composite, pre-standard or otherwise unregistered algorithm the inventory cannot classify. PLAN assigns this rule info severity; the rule engine's lowest level is low."
+  severity: low
+  category: cbom-security
+  dry-run-support: full
+  condition: |
+    components[
+      (
+        cryptoProperties.assetType = 'certificate'
+        and $match($safeStr($prop($, 'cdx:crypto:signatureAlgorithm')), /^[0-9]+(\.[0-9]+)+$/)
+      )
+      or (
+        cryptoProperties.assetType = 'related-crypto-material'
+        and $match(name, /^[0-9]+(\.[0-9]+)+$/)
+      )
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Certificate '{{ name }}' uses an algorithm named only by its OID '{{ $firstNonEmpty($prop($, 'cdx:crypto:signatureAlgorithm'), name) }}'"
+  mitigation: "Identify the algorithm behind the OID and confirm it is an approved one for this use."
+  evidence: |
+    {
+      "signatureAlgorithm": $prop($, 'cdx:crypto:signatureAlgorithm'),
+      "signatureAlgorithmOid": $prop($, 'cdx:crypto:signatureAlgorithmOid'),
+      "name": name
+    }

package/data/rules/go-binaries.yaml

@@ -0,0 +1,46 @@
+# Go binary toolchain rules
+# Category: go-security
+# Evaluates the cdx:go:buildVersion property recorded for executable file
+# components during container/rootfs scans.
+
+- id: GO-TLS-001
+  name: "Go binary built with a toolchain that lacks the CVE-2026-111943 distrust list"
+  description: "Go links its standard library statically, so a binary keeps the trust behaviour of the toolchain it was built with. Releases before go1.26.10, and go1.27.0 through go1.27.2, lack the eight SPKI hashes Go uses to distrust the CVE-2026-111943 intermediate CA keys, and older release lines (1.25 and earlier) will never receive them. Release candidates of newer lines (go1.28rc1) already carry the fix."
+  severity: high
+  category: go-security
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'file'
+      and $hasProp($, 'cdx:go:buildVersion')
+      and (
+        $prop($, 'cdx:go:buildVersion') = 'unknown-pre-1.18'
+        or (
+          $m := $match($prop($, 'cdx:go:buildVersion'), /^go(\d+)\.(\d+)(?:\.(\d+))?/);
+          $m != null
+          and $number($m.groups[0]) = 1
+          and (
+            $number($m.groups[1]) < 26
+            or (
+              $number($m.groups[1]) = 26
+              and ($m.groups[2] != null ? $number($m.groups[2]) : 0) < 10
+            )
+            or (
+              $number($m.groups[1]) = 27
+              and ($m.groups[2] != null ? $number($m.groups[2]) : 0) < 3
+            )
+          )
+        )
+      )
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Go binary '{{ name }}' was built with {{ $prop($, 'cdx:go:buildVersion') }}, which lacks the CVE-2026-111943 distrust list"
+  mitigation: "Rebuild the binary with go1.26.10, go1.27.3 or newer so its crypto/x509 rejects the distrusted intermediate CA keys."
+  evidence: |
+    {
+      "buildVersion": $prop($, 'cdx:go:buildVersion'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }

package/data/rules/golem-go.yaml

@@ -227,3 +227,83 @@
       "goModExcludeCount": $prop($, 'cdx:golem:goModExcludeCount'),
       "excludeModule": $prop($, 'cdx:golem:excludeModule')
     }
+
+- id: GOLEM-SEC-008
+  name: "Go component configures a custom TLS root pool"
+  description: "Golem reported a tls.Config RootCAs or x509.VerifyOptions Roots override, so the module validates certificates against a pool it supplies instead of the system roots"
+  severity: low
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      'GOLEM-CRYPTO-TLS-CUSTOM-ROOTS' in properties[name = 'cdx:golem:cryptoFinding'].value
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' sets a custom TLS root CA pool"
+  mitigation: "Review where the custom pool comes from and refresh it from a trusted source; a stale pool keeps trusting revoked or distrusted intermediates"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity')
+    }
+
+- id: GOLEM-SEC-009
+  name: "Go component replaces certificate verification"
+  description: "Golem reported a VerifyPeerCertificate or VerifyConnection callback, so the module performs its own certificate validation instead of (part of) the standard chain verification"
+  severity: medium
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      'GOLEM-CRYPTO-TLS-CUSTOM-VERIFY' in properties[name = 'cdx:golem:cryptoFinding'].value
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' installs a custom certificate verification callback"
+  mitigation: "Check that the callback still calls Certificate.Verify, or that its custom checks are at least as strict; hand-rolled verification can miss revoked or distrusted intermediates"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity')
+    }
+
+- id: GOLEM-SEC-010
+  name: "Go component disables TLS verification while customising it"
+  description: "Golem reported an InsecureSkipVerify setting on a tls.Config that also customises verification, the pattern where Go's own distrust list no longer applies"
+  severity: high
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      'GOLEM-CRYPTO-TLS-VERIFY-REPLACED' in properties[name = 'cdx:golem:cryptoFinding'].value
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' sets InsecureSkipVerify together with custom verification"
+  mitigation: "Remove InsecureSkipVerify and implement the required checks inside VerifyPeerCertificate on top of the standard chain verification"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity')
+    }
+
+- id: GOLEM-SEC-011
+  name: "Go component embeds a certificate pool"
+  description: "Golem reported a package-level //go:embed variable fed to x509.CertPool.AppendCertsFromPEM, so a private trust anchor travels inside the binary"
+  severity: low
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      'GOLEM-CRYPTO-X509-EMBEDDED-POOL' in properties[name = 'cdx:golem:cryptoFinding'].value
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' appends an embedded PEM bundle to an x509 pool"
+  mitigation: "Track the embedded bundle like any other trust store: refresh it when CAs change and confirm it contains none of the distrusted keys"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity')
+    }

package/data/rules/hbom-compliance.yaml

@@ -16,26 +16,38 @@
       - "1.1 Establish and Maintain Detailed Enterprise Asset Inventory"
   condition: |
     metadata.component[
-      $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
-      and $count(
-        $$.components[
-          $prop($, 'cdx:hbom:hardwareClass') = 'board'
-          and (
-            $hasProp($, 'cdx:hbom:boardVendor')
-            or $hasProp($, 'cdx:hbom:boardName')
-            or $hasProp($, 'cdx:hbom:biosVendor')
-            or $hasProp($, 'cdx:hbom:biosVersion')
-            or $hasProp($, 'cdx:hbom:firmwareDate')
-          )
-        ]
-      ) = 0
+      (
+        $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
+        and $count(
+          $$.components[
+            $prop($, 'cdx:hbom:hardwareClass') = 'board'
+            and (
+              $hasProp($, 'cdx:hbom:boardVendor')
+              or $hasProp($, 'cdx:hbom:boardName')
+              or $hasProp($, 'cdx:hbom:biosVendor')
+              or $hasProp($, 'cdx:hbom:biosVersion')
+              or $hasProp($, 'cdx:hbom:firmwareDate')
+            )
+          ]
+        ) = 0
+      )
+      or (
+        $safeStr($prop($, 'cdx:hbom:platform')) = 'windows'
+        and $not(
+          $hasProp($, 'cdx:hbom:boardVendor')
+          or $hasProp($, 'cdx:hbom:boardName')
+          or $hasProp($, 'cdx:hbom:biosVendor')
+          or $hasProp($, 'cdx:hbom:biosVersion')
+          or $hasProp($, 'cdx:hbom:firmwareDate')
+        )
+      )
     ]
   location: |
     {
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
   message: "HBOM for '{{ name }}' lacks board or firmware provenance fields needed for governance review"
-  mitigation: "Enable richer firmware/board collection on supported Linux hosts, validate SMBIOS access, and ensure the inventory captures board vendor, board name, BIOS vendor, BIOS version, and firmware date where available."
+  mitigation: "Enable richer firmware/board collection on supported Linux hosts, validate SMBIOS access, and ensure the inventory captures board vendor, board name, BIOS vendor, BIOS version, and firmware date where available. On Windows these come from the windows-cim-platform batch, which a network logon (SSH, WinRM) as a non-administrator cannot run: collect from a local session or an elevated one."
   evidence: |
     {
       "platform": $prop($, 'cdx:hbom:platform'),
@@ -142,7 +154,7 @@
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
   message: "HBOM for '{{ name }}' includes storage volumes but no explicit encryption posture evidence"
-  mitigation: "Enable volume-level enrichment on supported platforms or pair the HBOM with equivalent host controls evidence so encryption compliance can be verified."
+  mitigation: "Enable volume-level enrichment on supported platforms or pair the HBOM with equivalent host controls evidence so encryption compliance can be verified. On Windows, BitLocker status comes from the --privileged batch, so rerun from an elevated (Run as administrator) prompt with --privileged."
   evidence: |
     {
       "storageVolumeCount": $count($$.components[$prop($, 'cdx:hbom:hardwareClass') = 'storage-volume']),
@@ -219,8 +231,8 @@
     {
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
-  message: "HBOM for '{{ name }}' hit permission-denied enrichments that likely require a rerun with --privileged"
-  mitigation: "Where policy allows, rerun HBOM collection with --privileged so cdx-hbom can use the documented non-interactive sudo path for permission-sensitive Linux enrichments."
+  message: "HBOM for '{{ name }}' hit permission-denied enrichments that likely require {{ $safeStr($prop($, 'cdx:hbom:platform')) = 'windows' ? 'a rerun from a local or elevated session' : 'a rerun with --privileged' }}"
+  mitigation: "Where policy allows, rerun HBOM collection with --privileged. On Linux, cdx-hbom then uses the documented non-interactive sudo path for permission-sensitive enrichments. On Windows it never elevates or prompts: run it from a local session (a non-administrator over SSH or WinRM is denied every WMI query) and, for the TPM, BitLocker and storage-reliability batch, from an elevated (Run as administrator) prompt."
   evidence: |
     {
       "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),
@@ -260,7 +272,7 @@
 
 - id: HBC-009
   name: "HBOM board and BIOS provenance was blocked by permissions"
-  description: "When dmidecode-backed firmware and board enrichment is blocked, the HBOM may miss board-vendor, board-name, BIOS-version, and related governance evidence."
+  description: "When dmidecode-backed firmware and board enrichment is blocked on Linux, or Windows denies WMI to the whole session (a network logon), the HBOM may miss board-vendor, board-name, BIOS-version, and related governance evidence."
   severity: medium
   category: hbom-compliance
   dry-run-support: full
@@ -270,15 +282,21 @@
       - "SI-7 Software, Firmware, and Information Integrity"
   condition: |
     metadata.component[
-      $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
-      and $listContains($propList($$, 'cdx:hbom:analysis:permissionDeniedIds'), 'dmidecode-firmware-board')
+      (
+        $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
+        and $listContains($propList($$, 'cdx:hbom:analysis:permissionDeniedIds'), 'dmidecode-firmware-board')
+      )
+      or (
+        $safeStr($prop($, 'cdx:hbom:platform')) = 'windows'
+        and $listContains($propList($$, 'cdx:hbom:analysis:permissionDeniedIds'), 'windows-cim-platform:network-logon')
+      )
     ]
   location: |
     {
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
-  message: "HBOM for '{{ name }}' could not capture full board and BIOS provenance because dmidecode enrichment was blocked"
-  mitigation: "Where policy allows, rerun with --privileged or equivalent access so the collector can gather firmware vendor, BIOS version, board vendor, and board name data."
+  message: "HBOM for '{{ name }}' could not capture full board and BIOS provenance because {{ $safeStr($prop($, 'cdx:hbom:platform')) = 'windows' ? 'WMI was denied to this network logon' : 'dmidecode enrichment was blocked' }}"
+  mitigation: "Where policy allows, rerun with --privileged or equivalent access so the collector can gather firmware vendor, BIOS version, board vendor, and board name data. On Windows, run HBOM from a local session or an elevated one instead of over SSH or WinRM as a non-administrator."
   evidence: |
     {
       "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),

package/data/rules/hbom-performance.yaml

@@ -32,7 +32,7 @@
 
 - id: HBP-002
   name: "Storage health is degraded or wear is near exhaustion"
-  description: "Degraded SMART state or high wear percentage is a strong leading indicator of latency, failure, or replacement pressure."
+  description: "Degraded SMART state, a Warning or Unhealthy Windows storage health status, or high wear percentage is a strong leading indicator of latency, failure, or replacement pressure."
   severity: high
   category: hbom-performance
   dry-run-support: full
@@ -50,6 +50,10 @@
           and $lowercase($safeStr($prop($, 'cdx:hbom:smartStatus'))) != 'ok'
           and $lowercase($safeStr($prop($, 'cdx:hbom:smartStatus'))) != 'passed'
         )
+        or (
+          $lowercase($safeStr($prop($, 'cdx:hbom:healthStatus'))) = 'warning'
+          or $lowercase($safeStr($prop($, 'cdx:hbom:healthStatus'))) = 'unhealthy'
+        )
         or (
           $hasProp($, 'cdx:hbom:wearPercentageUsed')
           and $number($prop($, 'cdx:hbom:wearPercentageUsed')) >= 80
@@ -65,6 +69,8 @@
   evidence: |
     {
       "smartStatus": $prop($, 'cdx:hbom:smartStatus'),
+      "healthStatus": $prop($, 'cdx:hbom:healthStatus'),
+      "operationalStatus": $prop($, 'cdx:hbom:operationalStatus'),
       "wearPercentageUsed": $prop($, 'cdx:hbom:wearPercentageUsed'),
       "revision": $prop($, 'cdx:hbom:revision'),
       "deviceSerial": $prop($, 'cdx:hbom:deviceSerial')

package/data/rules/host-topology.yaml

@@ -90,7 +90,7 @@
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
   message: "Merged host inventory for '{{ name }}' contains no strict HBOM-to-OBOM topology links"
-  mitigation: "Review collector coverage, ensure runtime categories such as interface_addresses or kernel_modules are available, and prefer exact identifier-bearing probes over heuristic joins."
+  mitigation: "Review collector coverage, ensure runtime categories such as interface_addresses or kernel_modules (logical_drives on Windows) are available, and prefer exact identifier-bearing probes over heuristic joins."
   evidence: |
     {
       "hostViewMode": $prop($, 'cdx:hostview:mode'),

package/data/rules/obom-runtime.yaml

@@ -111,8 +111,9 @@
       "deviceId": name,
       "driveLetter": version,
       "protectionStatus": $prop($, 'protection_status'),
-      "encryptionMethod": $prop($, 'encryption_method'),
-      "percentageEncrypted": $prop($, 'percentage_encrypted')
+      "encryptionMethod": description,
+      "percentageEncrypted": $prop($, 'percentage_encrypted'),
+      "protectorTypes": $prop($, 'protector_types')
     }
 
 - id: OBOM-WIN-002
@@ -1774,3 +1775,31 @@
       "comment": description,
       "uid": $prop($, 'uid')
     }
+
+- id: OBOM-LNX-023
+  name: "Linux snap installed in devmode confinement"
+  description: "A snap installed with --devmode runs without its sandbox being enforced: policy violations are only logged. Devmode is meant for snap development, not for software a host relies on."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'snap_packages'
+      and $lowercase($safeStr($prop($, 'cdx:snap:confinement'))) = 'devmode'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Snap '{{ name }}' {{ version }} (revision {{ $prop($, 'cdx:snap:revision') }}) is installed in devmode confinement, so its sandbox is not enforced"
+  mitigation: "Reinstall the snap from a stable channel with strict confinement, or remove it. If devmode is required for development, keep it off production and shared hosts."
+  evidence: |
+    {
+      "snap": name,
+      "version": version,
+      "revision": $prop($, 'cdx:snap:revision'),
+      "channel": $prop($, 'cdx:snap:channel'),
+      "confinement": $prop($, 'cdx:snap:confinement'),
+      "grade": $prop($, 'grade')
+    }