@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/inventory/communityAiConfigParser.js

@@ -5,6 +5,7 @@ import { parse as loadYaml } from "yaml";
 
 import { safeExistsSync } from "../core/fs.js";
 import { sanitizeBomPropertyValue } from "../core/propertySanitizer.js";
+import { isAgentSkillSpecValid } from "./agentSkillSpec.js";
 import { parseJsonLike } from "./jsonLike.js";
 import {
   credentialIndicatorsForText,
@@ -279,18 +280,12 @@ function parseSkillFile(filePath, raw) {
     );
   }
   // Record whether the frontmatter satisfies the open Agent Skills constraints
-  // (name: 1-64 lowercase-alnum-hyphen; description: 1-1024 chars) as a single
-  // reviewer-friendly boolean rather than copying the raw values twice.
-  const specValid =
-    typeof metadata?.name === "string" &&
-    /^[a-z0-9-]{1,64}$/u.test(metadata.name) &&
-    typeof metadata?.description === "string" &&
-    metadata.description.length >= 1 &&
-    metadata.description.length <= 1024;
+  // as a single reviewer-friendly boolean rather than copying the raw values
+  // twice.
   addUniqueProperty(
     component.properties,
     "cdx:skill:specValid",
-    specValid ? "true" : "false",
+    isAgentSkillSpecValid(metadata) ? "true" : "false",
   );
   const skillDir = dirname(filePath);
   for (const [subdir, property] of [

package/lib/inventory/deps.js

@@ -1,5 +1,5 @@
 import { lstatSync, readFileSync, statSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
+import { homedir } from "node:os";
 import { delimiter as _delimiter, basename, dirname, join } from "node:path";
 
 import { build, Purl } from "@cdxgen/cdx-purl";
@@ -10,6 +10,7 @@ import { commandOutputText } from "../core/buildLedger.js";
 import { parseMavenArgs } from "../core/env.js";
 import {
   getAllFiles,
+  getTmpDir,
   multiChecksumFile,
   safeExistsSync,
   safeMkdtempSync,
@@ -24,6 +25,10 @@ import {
   mavenLocalRepositories,
   splitArtifactFileName,
 } from "./jvmLocalRepos.js";
+import {
+  mavenMirrorSettingsArgs,
+  mavenWrapperMirrorEnv,
+} from "./mavenCentralMirror.js";
 import { pypiBomRef } from "./purl.js";
 import { findLicenseId, spdxLicenses } from "./spdx.js";
 
@@ -99,7 +104,8 @@ function jarPurl(group, name, version, classifier = undefined) {
  * Collect maven dependencies
  *
  * @param {string} mavenCmd Maven command to use
- * @param {string} basePath Path to the maven project
+ * @param {string} basePath Path to the maven project. Without it Maven is not
+ *   run, and only the local repository is read when includeCacheDir is set.
  * @param {boolean} cleanup Remove temporary directories
  * @param {boolean} includeCacheDir Include maven and gradle cache directories
  */
@@ -118,7 +124,7 @@ export async function collectMvnDependencies(
       safeExistsSync(repo),
     ) ||
     join(homedir(), ".m2", "repository");
-  const tempDir = safeMkdtempSync(join(tmpdir(), "mvn-deps-"));
+  const tempDir = safeMkdtempSync(join(getTmpDir(), "mvn-deps-"));
   // No -U: forcing update checks re-requests every maven-metadata.xml and
   // every artifact Maven already knows is missing, once per module.
   let copyArgs = [
@@ -134,11 +140,13 @@ export async function collectMvnDependencies(
     const addArgs = parseMavenArgs(readEnvironmentVariable("MVN_ARGS"));
     copyArgs = copyArgs.concat(addArgs);
   }
+  copyArgs = copyArgs.concat(mavenMirrorSettingsArgs());
   if (basePath && basePath !== MAVEN_CACHE_DIR) {
     console.log(`Executing '${mavenCmd} in ${basePath}`);
     const result = safeSpawnSync(mavenCmd, copyArgs, {
       cwd: basePath,
       shell: isWin,
+      env: { ...process.env, ...mavenWrapperMirrorEnv() },
     });
     const rateLimited = noteBuildToolRateLimit(
       "maven",
@@ -178,7 +186,7 @@ export async function collectMvnDependencies(
   }
 
   // Clean up
-  if (cleanup && tempDir?.startsWith(tmpdir())) {
+  if (cleanup && tempDir?.startsWith(getTmpDir())) {
     safeRmSync(tempDir, { recursive: true, force: true });
   }
   return jarNSMapping;
@@ -334,6 +342,35 @@ export async function collectJarNS(jarPath, pomPathMap = {}) {
   return jarNSMapping;
 }
 
+/**
+ * The jar namespace map entries of components a jar scan produced, in the
+ * shape {@link collectJarNS} writes (`{ namespaces: string[] }`), from their
+ * `internal:Namespaces` properties. The scan reads each jar from a temporary
+ * copy, so no `jarFile` is recorded. Purls `existing` already maps keep the
+ * entry they have, which names the jar it was read from.
+ *
+ * @param {Object[]} components Components with `internal:Namespaces` properties
+ * @param {Object} [existing] Jar namespace map already collected
+ * @returns {Object} New entries keyed by purl
+ */
+export function namespaceMappingOfComponents(components, existing = {}) {
+  const mapping = {};
+  for (const component of components || []) {
+    if (!component?.purl || existing[component.purl]) {
+      continue;
+    }
+    const namespaces = (component.properties || [])
+      .filter((property) => property.name === "internal:Namespaces")
+      .flatMap((property) => String(property.value || "").split("\n"))
+      .map((namespace) => namespace.trim())
+      .filter(Boolean);
+    if (namespaces.length) {
+      mapping[component.purl] = { namespaces: [...new Set(namespaces)] };
+    }
+  }
+  return mapping;
+}
+
 /**
  * Convert a JAR namespace mapping (produced by {@link collectJarNS}) into an array
  * of CycloneDX package component objects.

package/lib/inventory/display.js

@@ -14,6 +14,7 @@ import { readReachablesSlices } from "./atomUtils.js";
 import { formatOccurrenceEvidence } from "./evidenceUtils.js";
 import {
   formatHbomHardwareClassSummary,
+  getHbomPrivilegeGuidance,
   getHbomSummary,
   isHbomLikeBom,
 } from "./hbomAnalysis.js";
@@ -475,7 +476,9 @@ export const buildTableSummaryLines = (
       );
       if (hbomSummary.requiresPrivilegedEnrichment) {
         summaryLines.push(
-          "Permission-sensitive enrichments were skipped or blocked. Re-run with --privileged where policy allows.",
+          hbomSummary.platform === "windows"
+            ? getHbomPrivilegeGuidance(hbomSummary.platform)
+            : "Permission-sensitive enrichments were skipped or blocked. Re-run with --privileged where policy allows.",
         );
       }
     }
@@ -526,6 +529,7 @@ const HBOM_COLUMN_PRIORITY = Object.freeze([
   ["cdx:hbom:securityMode", "securityMode"],
   ["cdx:hbom:health", "health"],
   ["cdx:hbom:smartStatus", "smartStatus"],
+  ["cdx:hbom:healthStatus", "healthStatus"],
   ["cdx:hbom:powerSource", "powerSource"],
   ["cdx:hbom:maximumCapacity", "maximumCapacity"],
   ["cdx:hbom:chargePercent", "chargePercent"],
@@ -546,6 +550,7 @@ const HBOM_COLUMN_PRIORITY = Object.freeze([
   ["cdx:hostview:kernel_modules:count", "kernelMods"],
   ["cdx:hostview:mount_hardening:count", "runtimeMounts"],
   ["cdx:hostview:runtime-storage:count", "runtimeStorage"],
+  ["cdx:hostview:logical_drives:count", "runtimeDrives"],
   ["cdx:hostview:linkedRuntimeCategoryCount", "runtimeLinks"],
 ]);
 
@@ -616,6 +621,7 @@ const HBOM_CLASS_PROPERTY_PRIORITY = Object.freeze({
   storage: Object.freeze([
     ["cdx:hbom:capacity", "capacity"],
     ["cdx:hbom:smartStatus", "smart"],
+    ["cdx:hbom:healthStatus", "healthStatus"],
     ["cdx:hbom:wearPercentageUsed", "wearUsed"],
     ["cdx:hbom:transport", "transport"],
     ["cdx:hbom:firmwareVersion", "firmware"],
@@ -630,6 +636,7 @@ const HBOM_CLASS_PROPERTY_PRIORITY = Object.freeze({
     ["cdx:hbom:isRemovable", "removable"],
     ["cdx:hostview:mount_hardening:count", "runtimeMounts"],
     ["cdx:hostview:runtime-storage:count", "runtimeStorage"],
+    ["cdx:hostview:logical_drives:count", "runtimeDrives"],
   ]),
   sensor: Object.freeze([
     ["cdx:hbom:temperatureCelsius", "tempC"],
@@ -870,8 +877,13 @@ export function printTable(
   }
   if (
     bomJson.metadata?.component &&
-    ["operating-system", "platform"].includes(bomJson.metadata.component.type)
+    ["operating-system", "platform"].includes(
+      bomJson.metadata.component.type,
+    ) &&
+    !filterTypes?.includes("cryptographic-asset")
   ) {
+    // A filtered crypto view stays a crypto view even on an OS BOM; only the
+    // unfiltered component listing falls through to the OS table.
     return printOSTable(bomJson);
   }
   if (isHbomLikeBom(bomJson) && !filterTypes?.includes("cryptographic-asset")) {
@@ -1037,7 +1049,13 @@ const locationComparator = (a, b) => {
     const tmpB = b.split("#");
     if (tmpA.length === 2 && tmpB.length === 2) {
       if (tmpA[0] === tmpB[0]) {
-        return tmpA[1] - tmpB[1];
+        // Line numbers sort numerically; other fragments (a secret key such
+        // as data.tls.crt) by text, never NaN.
+        const lineA = Number(tmpA[1]);
+        const lineB = Number(tmpB[1]);
+        return Number.isNaN(lineA) || Number.isNaN(lineB)
+          ? tmpA[1].localeCompare(tmpB[1])
+          : lineA - lineB;
       }
     }
   }
@@ -2125,3 +2143,182 @@ export function displaySelfThreatModel(
     process.exit(1);
   }
 }
+
+function certificateComponents(bomJson) {
+  return (bomJson?.components || []).filter(
+    (component) => component?.cryptoProperties?.assetType === "certificate",
+  );
+}
+
+function auditedBomRefs(bomJson) {
+  // Audit findings land as document annotations whose location names the
+  // component; a certificate listed there is flagged in the table. The
+  // annotation text is rendered as a markdown property table, so the rows
+  // are parsed back out of it (the same way the REPL's audit view does).
+  const refs = new Set();
+  for (const annotation of bomJson?.annotations || []) {
+    const text = typeof annotation?.text === "string" ? annotation.text : "";
+    for (const line of text.split(/\r?\n/)) {
+      if (!line.includes("cdx:audit:location:bomRef")) {
+        continue;
+      }
+      const cells = line.split("|").map((cell) => cell.trim());
+      if (
+        cells.length >= 2 &&
+        cells[1] === "cdx:audit:location:bomRef" &&
+        cells[2]
+      ) {
+        refs.add(cells[2]);
+      }
+    }
+  }
+  return refs;
+}
+
+/**
+ * Print a table of the BOM's certificate components: role, name, issuer,
+ * expiry, the SPKI prefix and how many locations each certificate appears
+ * in, with a marker when the audit flagged it.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @returns {void}
+ */
+export function printCertificatesTable(bomJson) {
+  const certificates = certificateComponents(bomJson);
+  if (!certificates.length) {
+    console.log(
+      "No certificate components found. Generate a CBOM with --include-crypto to use this view.",
+    );
+    return;
+  }
+  const flagged = auditedBomRefs(bomJson);
+  const stream = createStream({
+    columnDefault: { width: 24 },
+    columnCount: 6,
+    columns: [
+      { width: 13 },
+      { width: 30 },
+      { width: 30 },
+      { width: 21 },
+      { width: 18 },
+      { width: 5, alignment: "center" },
+    ],
+  });
+  stream.write([
+    "Role",
+    "Name",
+    "Issuer CN",
+    "Not valid after",
+    "SPKI (first 16)",
+    "Locs",
+  ]);
+  for (const certificate of certificates) {
+    const issuerCn = commonNameFromIssuer(certificate);
+    stream.write([
+      getPropertyValue(certificate, "cdx:crypto:certRole") || "?",
+      certificate.name || "",
+      issuerCn ||
+        certificate.cryptoProperties?.certificateProperties?.issuerName ||
+        "",
+      certificate.cryptoProperties?.certificateProperties?.notValidAfter || "",
+      (getPropertyValue(certificate, "cdx:crypto:spkiSha256") || "").slice(
+        0,
+        16,
+      ),
+      `${certificate.evidence?.occurrences?.length || 0}${flagged.has(certificate["bom-ref"]) ? " ⚠" : ""}`,
+    ]);
+  }
+  stream.end();
+  console.log();
+  console.log(`Found ${certificates.length} certificate component(s).`);
+}
+
+function commonNameFromIssuer(certificate) {
+  const issuer =
+    certificate.cryptoProperties?.certificateProperties?.issuerName || "";
+  const parts = issuer.split(",").map((part) => part.trim());
+  const cn = parts.find((part) => part.startsWith("CN="));
+  return cn ? cn.slice(3) : parts[0];
+}
+
+/**
+ * Print the issuer chain above a certificate and the certificates issued
+ * under it, walking the verified `dependsOn` edges.
+ *
+ * @param {Object} bomJson CycloneDX BOM JSON object
+ * @param {string} selector bom-ref, SPKI hex prefix or certificate ref prefix
+ * @returns {void}
+ */
+export function printCertificateChain(bomJson, selector) {
+  const query = String(selector || "").trim();
+  if (!query) {
+    console.log("Usage: .certchain <bom-ref|spki-prefix|cert-prefix>");
+    return;
+  }
+  const certificates = certificateComponents(bomJson);
+  const byRef = new Map(certificates.map((c) => [c["bom-ref"], c]));
+  const edges = new Map(
+    (bomJson?.dependencies || []).map((dep) => [
+      dep.ref,
+      (dep.dependsOn || []).filter((ref) => byRef.has(ref)),
+    ]),
+  );
+  const issuersOf = new Map();
+  for (const [ref, issuerRefs] of edges) {
+    for (const issuerRef of issuerRefs) {
+      if (!issuersOf.has(issuerRef)) {
+        issuersOf.set(issuerRef, []);
+      }
+      issuersOf.get(issuerRef).push(ref);
+    }
+  }
+  let target;
+  if (byRef.has(query)) {
+    target = byRef.get(query);
+  } else {
+    target = certificates.find(
+      (certificate) =>
+        certificate["bom-ref"].includes(query) ||
+        (
+          getPropertyValue(certificate, "cdx:crypto:spkiSha256") || ""
+        ).startsWith(query.toLowerCase()),
+    );
+  }
+  if (!target) {
+    console.log(`No certificate matches '${query}'.`);
+    return;
+  }
+  const describe = (certificate) =>
+    `${getPropertyValue(certificate, "cdx:crypto:certRole") || "?"} ${certificate.name} (${(getPropertyValue(certificate, "cdx:crypto:spkiSha256") || "").slice(0, 16)}…)`;
+  const chain = [];
+  let cursor = target["bom-ref"];
+  const seen = new Set([cursor]);
+  while (edges.has(cursor)) {
+    const next = (edges.get(cursor) || []).filter((ref) => !seen.has(ref));
+    if (!next.length) {
+      break;
+    }
+    cursor = next[0];
+    seen.add(cursor);
+    chain.push(byRef.get(cursor));
+  }
+  console.log(`Chain above ${describe(target)}:`);
+  if (chain.length) {
+    chain.forEach((certificate, index) => {
+      console.log(`${"  ".repeat(index + 1)}← ${describe(certificate)}`);
+    });
+  } else {
+    console.log("  (no verified issuer in this BOM)");
+  }
+  const issued = (issuersOf.get(target["bom-ref"]) || []).filter((ref) =>
+    byRef.has(ref),
+  );
+  console.log(`Issued under ${describe(target)}:`);
+  if (issued.length) {
+    for (const ref of issued) {
+      console.log(`  → ${describe(byRef.get(ref))}`);
+    }
+  } else {
+    console.log("  (none in this BOM)");
+  }
+}