@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/inventory/source.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
-import { URL } from "node:url";
+import { fileURLToPath, URL } from "node:url";
 
 import { Purl } from "@cdxgen/cdx-purl";
 import { coerce, diff, prerelease } from "semver";
@@ -30,6 +30,7 @@ import {
   prefetchedResponse,
   prefetchJson,
 } from "./fetchBatch.js";
+import { mavenCentralFetchUrl } from "./mavenCentralMirror.js";
 import { canonicalPurlFromLooseString } from "./purl.js";
 
 /** Raised when a caller omits a registry helper that the purl type requires. */
@@ -111,6 +112,9 @@ function inferGitOperation(args = []) {
  * @param {string[]} args git arguments
  * @param {Object} options command options
  * @param {string|undefined} options.cwd working directory
+ * @param {boolean|undefined} options.noRepository run outside any repository,
+ *   so the config of a repository in the working directory, such as url.*.insteadOf
+ *   or core.sshCommand, cannot change where a remote command connects
  * @returns {Object} spawn result
  */
 export function hardenedGitCommand(args, options = {}) {
@@ -122,8 +126,14 @@ export function hardenedGitCommand(args, options = {}) {
     GIT_CONFIG_VALUE_0: "false",
     GIT_CONFIG_KEY_1: "safe.bareRepository",
     GIT_CONFIG_VALUE_1: "explicit",
+    GIT_NO_LAZY_FETCH: "1",
     GIT_TERMINAL_PROMPT: "0",
   };
+  if (options.noRepository) {
+    // ls-remote works without a repository. Pointing GIT_DIR at a path that
+    // does not exist stops git from discovering one in the working directory.
+    envConfigs.GIT_DIR = path.join(getTmpDir(), "cdxgen-no-repository.invalid");
+  }
   const env = isSecureMode
     ? {
         ...process.env,
@@ -275,10 +285,14 @@ export function buildReleaseNotesFromGit(repoPath, options = {}) {
     typeof remoteUrl === "string"
       ? validateAndRejectGitSource(remoteUrl)
       : null;
+  // remote.origin.url comes from the scanned repository. Only a remote that
+  // validateAndRejectGitSource recognises and checks may reach ls-remote; git
+  // also treats forms such as host:path as remotes, which skip that check.
   const canDiscoverRemoteTags =
     (!currentTag || !previousTag) &&
     typeof remoteUrl === "string" &&
     !remoteUrl.startsWith("-") &&
+    maybeRemotePath(remoteUrl) &&
     !remoteUrlValidationError &&
     /github\.com[:/]/i.test(remoteUrl);
   if (canDiscoverRemoteTags) {
@@ -298,7 +312,7 @@ export function buildReleaseNotesFromGit(repoPath, options = {}) {
         "--",
         remoteUrl,
       ],
-      {},
+      { noRepository: true },
     );
     const remoteTags = parseLsRemoteTags(remoteTagsResult.stdout);
     if (!currentTag && remoteTags.length) {
@@ -508,6 +522,59 @@ export function isAllowedPath(p) {
   });
 }
 
+/**
+ * Resolve symlinks in a path. When the path does not exist yet, the nearest
+ * existing parent is resolved and the remaining segments are appended, so
+ * /tmp/new on macOS still becomes /private/tmp/new.
+ *
+ * @param {string} p Path string
+ * @returns {string} real path
+ */
+function realPathOrResolved(p) {
+  let current = path.resolve(p);
+  const missing = [];
+  while (true) {
+    try {
+      return path.join(fs.realpathSync(current), ...missing);
+    } catch (_err) {
+      const parent = path.dirname(current);
+      if (parent === current) {
+        return path.resolve(p);
+      }
+      missing.unshift(path.basename(current));
+      current = parent;
+    }
+  }
+}
+
+/**
+ * Checks where the given path really points, after following symlinks, against
+ * where the allowed paths really point. Both sides are resolved, so an allowed
+ * directory that is itself reached through a link (such as /tmp on macOS) still
+ * matches, while a link inside an allowed directory that leads outside it does
+ * not.
+ *
+ * @param {string} p Path string to check
+ * @returns {boolean} true if the real path is inside a real allowed path
+ */
+export function isAllowedRealPath(p) {
+  if (typeof p !== "string" || hasDangerousUnicode(p)) {
+    return false;
+  }
+  const allowedPaths = getAllowedPaths();
+  if (!allowedPaths.length) {
+    return true;
+  }
+  const realP = realPathOrResolved(p);
+  return allowedPaths.some((ap) => {
+    const relativePath = path.relative(realPathOrResolved(ap), realP);
+    return (
+      relativePath === "" ||
+      (!relativePath.startsWith("..") && !path.isAbsolute(relativePath))
+    );
+  });
+}
+
 /**
  * Determine if the path could be a package URL.
  *
@@ -586,6 +653,49 @@ export function validateAndRejectGitSource(filePath) {
       };
     }
 
+    if (hasAmbiguousRemoteCharacters(filePath)) {
+      return {
+        status: 400,
+        error: "Invalid URL Format",
+        details:
+          "The provided Git URL contains backslashes, whitespace or control characters.",
+      };
+    }
+
+    // git reads file:// URLs from the local disk, so they get the path
+    // allowlist rather than the host allowlist.
+    if (gitUrlObj.protocol === "file:") {
+      let localPath;
+      try {
+        localPath = fileURLToPath(gitUrlObj);
+      } catch (_err) {
+        localPath = undefined;
+      }
+      if (
+        gitUrlObj.hostname ||
+        !localPath ||
+        !isAllowedPath(localPath) ||
+        (isWin && !isAllowedWinPath(localPath))
+      ) {
+        return {
+          status: 403,
+          error: "Path Not Allowed",
+          details: "Path is not allowed as per the allowlist.",
+        };
+      }
+      return null;
+    }
+
+    // git, libcurl and OpenSSH must connect to the host that was checked.
+    const gitRemoteHost = getGitRemoteHost(filePath);
+    if (!gitRemoteHost || gitUrlObj.hostname.toLowerCase() !== gitRemoteHost) {
+      return {
+        status: 400,
+        error: "Invalid URL Format",
+        details: "The host of the provided Git URL is ambiguous.",
+      };
+    }
+
     if (!isAllowedHost(gitUrlObj.hostname)) {
       return {
         status: 403,
@@ -598,6 +708,136 @@ export function validateAndRejectGitSource(filePath) {
   return null;
 }
 
+/**
+ * Detect characters that git, libcurl or OpenSSH read differently from the
+ * WHATWG URL parser. A backslash ends the host for new URL() but is part of
+ * the user name for git, and new URL() silently drops tabs and newlines.
+ *
+ * @param {string} remote Git URL or SCP-like address
+ * @returns {boolean} true if the remote contains such characters
+ */
+function hasAmbiguousRemoteCharacters(remote) {
+  if (hasDangerousUnicode(remote)) {
+    return true;
+  }
+  for (const ch of remote) {
+    const code = ch.codePointAt(0);
+    if (ch === "\\" || code <= 0x20 || (code >= 0x7f && code <= 0x9f)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Return the host a git client connects to for a remote, read the way git,
+ * libcurl and OpenSSH read it rather than the way new URL() does. git ends the
+ * authority of ssh:// and git:// URLs only at the first slash, percent-decodes
+ * it before splitting off the host, and reads a leading "[...]" as the host.
+ * OpenSSH takes the host after the last "@". So a "?" or "#" before the first
+ * slash, a second "@", brackets in the user name, or a percent sign in an
+ * ssh:// or git:// authority make the host ambiguous.
+ *
+ * @param {string} remote Git URL or SCP-like address
+ * @returns {string|undefined} lower-cased host, or undefined when it is ambiguous
+ */
+export function getGitRemoteHost(remote) {
+  if (typeof remote !== "string") {
+    return undefined;
+  }
+  let authority;
+  const schemeEnd = remote.indexOf("://");
+  if (schemeEnd > -1) {
+    const scheme = remote.slice(0, schemeEnd).toLowerCase();
+    const rest = remote.slice(schemeEnd + 3);
+    const slash = rest.indexOf("/");
+    authority = slash > -1 ? rest.slice(0, slash) : rest;
+    // libcurl reads the http(s) authority as written. git decodes the others.
+    if (!["http", "https"].includes(scheme) && authority.includes("%")) {
+      return undefined;
+    }
+  } else {
+    // git reads user@host:path as SCP-like only when the colon comes before
+    // any slash. Otherwise it is a local path.
+    const colon = remote.indexOf(":");
+    const slash = remote.indexOf("/");
+    if (colon < 0 || (slash > -1 && slash < colon)) {
+      return undefined;
+    }
+    authority = remote.slice(0, colon);
+  }
+  if (authority.includes("?") || authority.includes("#")) {
+    return undefined;
+  }
+  const at = authority.indexOf("@");
+  if (at !== authority.lastIndexOf("@")) {
+    return undefined;
+  }
+  const userInfo = at > -1 ? authority.slice(0, at) : "";
+  if (userInfo.includes("[") || userInfo.includes("]")) {
+    return undefined;
+  }
+  let host = authority.slice(at + 1);
+  if (host.startsWith("[")) {
+    const close = host.indexOf("]");
+    if (close < 0) {
+      return undefined;
+    }
+    host = host.slice(0, close + 1);
+  } else {
+    const portSep = host.indexOf(":");
+    if (portSep > -1) {
+      host = host.slice(0, portSep);
+    }
+  }
+  if (!host || host.startsWith("-")) {
+    return undefined;
+  }
+  return host.toLowerCase();
+}
+
+/**
+ * Remove credentials from git output before it is logged. Every URL in the
+ * text loses its user name and password, which git copies into its error
+ * messages from the remote it was given.
+ *
+ * @param {string|undefined} text Output of a git command
+ * @param {string|undefined} repoUrl Remote the command was given
+ * @returns {string|undefined} Output with credentials replaced by ***
+ */
+export function redactGitOutput(text, repoUrl) {
+  if (!text || typeof text !== "string") {
+    return text;
+  }
+  let redacted = text;
+  if (repoUrl && typeof repoUrl === "string") {
+    redacted = redacted.split(repoUrl).join(sanitizeRemoteUrlForLogs(repoUrl));
+  }
+  let from = 0;
+  while (from < redacted.length) {
+    const schemeEnd = redacted.indexOf("://", from);
+    if (schemeEnd === -1) {
+      break;
+    }
+    const authorityStart = schemeEnd + 3;
+    let authorityEnd = authorityStart;
+    while (
+      authorityEnd < redacted.length &&
+      !"/?#'\"<> \t\r\n".includes(redacted[authorityEnd])
+    ) {
+      authorityEnd++;
+    }
+    const at = redacted.lastIndexOf("@", authorityEnd - 1);
+    if (at >= authorityStart) {
+      redacted = `${redacted.slice(0, authorityStart)}***:***${redacted.slice(at)}`;
+      from = authorityStart + "***:***".length;
+    } else {
+      from = authorityEnd;
+    }
+  }
+  return redacted;
+}
+
 /**
  * Clone a git repository into a temporary directory.
  *
@@ -606,6 +846,11 @@ export function validateAndRejectGitSource(filePath) {
  * @returns {string} cloned directory path
  */
 export function gitClone(repoUrl, branch = null) {
+  // Callers validate first, but git must never see a remote that fails it.
+  const validationError = validateAndRejectGitSource(repoUrl);
+  if (validationError) {
+    throw new Error(`${validationError.error}: ${validationError.details}`);
+  }
   let baseDirName = path.basename(repoUrl);
   if (!/^[a-zA-Z0-9_-]+$/.test(baseDirName)) {
     baseDirName = "repo-";
@@ -635,6 +880,8 @@ export function gitClone(repoUrl, branch = null) {
     "safe.bareRepository=explicit",
     "-c",
     "core.hooksPath=/dev/null",
+    "-c",
+    "core.symlinks=false",
     "clone",
     "--template=",
     repoUrl,
@@ -655,8 +902,11 @@ export function gitClone(repoUrl, branch = null) {
     `Cloning Repo${branch ? ` with branch ${branch}` : ""} to ${tempDir}`,
   );
   const result = hardenedGitCommand(gitArgs);
-  if (result.status !== 0) {
-    console.error(result.stderr);
+  if (result.status !== 0 || result.error) {
+    console.error(redactGitOutput(result.stderr, repoUrl));
+    // The directory was created by this call, so it is always safe to remove.
+    safeRmSync(tempDir, { recursive: true, force: true });
+    throw new Error("Git clone failed.");
   }
 
   return tempDir;
@@ -735,7 +985,7 @@ export function findGitRefForPurlVersion(repoUrl, purlResolution) {
       "--",
       repoUrl,
     ],
-    {},
+    { noRepository: true },
   );
   if (result.status !== 0 || !result.stdout) {
     return undefined;
@@ -1384,6 +1634,7 @@ export async function resolveGitUrlFromPurl(purlString, helpers = {}) {
           break;
         }
         const mavenCentralUrl =
+          mavenCentralFetchUrl() ||
           readEnvironmentVariable("MAVEN_CENTRAL_URL") ||
           "https://repo1.maven.org/maven2/";
         registry = mavenCentralUrl.endsWith("/")

package/lib/inventory/spdx.js

@@ -440,6 +440,150 @@ export function licenseIdFromText(content) {
   return undefined;
 }
 
+// The GNU licenses by the title line their text opens with, and their SPDX
+// ids by version.
+const GNU_LICENSE_TITLES = {
+  "GNU AFFERO GENERAL PUBLIC LICENSE": { 3: "AGPL-3.0-only" },
+  "GNU LESSER GENERAL PUBLIC LICENSE": {
+    3: "LGPL-3.0-only",
+    2.1: "LGPL-2.1-only",
+    2: "LGPL-2.0-only",
+  },
+  "GNU LIBRARY GENERAL PUBLIC LICENSE": {
+    2.1: "LGPL-2.1-only",
+    2: "LGPL-2.0-only",
+  },
+  "GNU GENERAL PUBLIC LICENSE": {
+    3: "GPL-3.0-only",
+    2: "GPL-2.0-only",
+    1: "GPL-1.0-only",
+  },
+};
+
+// Phrases that only the grant of one license carries, so finding one anywhere
+// in a notice means that license is granted, not merely mentioned.
+const LICENSE_GRANT_PHRASES = [
+  ["PERMISSION IS HEREBY GRANTED, FREE OF CHARGE", "MIT"],
+  [
+    "PERMISSION TO USE, COPY, MODIFY, AND/OR DISTRIBUTE THIS SOFTWARE FOR ANY PURPOSE WITH OR WITHOUT FEE IS HEREBY GRANTED",
+    "ISC",
+  ],
+  [
+    "PERMISSION IS GRANTED TO ANYONE TO USE THIS SOFTWARE FOR ANY PURPOSE",
+    "Zlib",
+  ],
+  [
+    "THIS IS FREE AND UNENCUMBERED SOFTWARE RELEASED INTO THE PUBLIC DOMAIN",
+    "Unlicense",
+  ],
+  ["BOOST SOFTWARE LICENSE - VERSION 1.0", "BSL-1.0"],
+  ["MOZILLA PUBLIC LICENSE VERSION 2.0", "MPL-2.0"],
+  ["MOZILLA PUBLIC LICENSE, VERSION 2.0", "MPL-2.0"],
+  ["MOZILLA PUBLIC LICENSE, V. 2.0", "MPL-2.0"],
+  [
+    "CREATIVE COMMONS ATTRIBUTION 4.0 INTERNATIONAL PUBLIC LICENSE",
+    "CC-BY-4.0",
+  ],
+  [
+    "CREATIVE COMMONS ATTRIBUTION-SHAREALIKE 4.0 INTERNATIONAL PUBLIC LICENSE",
+    "CC-BY-SA-4.0",
+  ],
+  ["CC0 1.0 UNIVERSAL", "CC0-1.0"],
+];
+
+/**
+ * Identify every license a notice grants, in the order the notice grants
+ * them. A notice can grant several: one LICENSE file holding an MIT grant and
+ * an Apache-2.0 grant (gopkg.in/yaml.v3), or a choice of licenses followed by
+ * each full text (github.com/spdx/tools-golang). A license text quotes others
+ * (the GNU GPL names the GNU Lesser GPL, the MPL names the GNU licenses), so
+ * only phrases that a grant carries count: a GNU license is found by its title
+ * standing on a line of its own, the others by a sentence of their grant.
+ * A notice none of these phrases match falls back to {@link guessLicenseId}.
+ *
+ * @param {string} content License file contents
+ * @returns {string[]} SPDX license ids or expressions; empty when none is
+ *   recognized
+ */
+export function guessLicenseIds(content) {
+  if (typeof content !== "string" || !content.trim()) {
+    return [];
+  }
+  const text = content.replace(/\s+/g, " ").toUpperCase();
+  const found = [];
+  const add = (at, id) => {
+    if (at >= 0 && id) {
+      found.push({ at, id });
+    }
+  };
+  // Walk the lines alongside `text`, so a title line is placed in it.
+  let offset = 0;
+  for (const line of content.split("\n")) {
+    const normalized = line.replace(/\s+/g, " ").trim().toUpperCase();
+    const at = normalized ? text.indexOf(normalized, offset) : -1;
+    if (at < 0) {
+      continue;
+    }
+    offset = at + normalized.length;
+    const ids = GNU_LICENSE_TITLES[normalized];
+    if (ids) {
+      const version = text
+        .slice(offset, offset + 60)
+        .match(/VERSION (\d(?:\.\d)?)/)?.[1];
+      add(at, ids[version]);
+    }
+  }
+  for (const marker of [
+    "APACHE LICENSE VERSION 2.0",
+    "APACHE LICENSE, VERSION 2.0",
+    "APACHE LICENSE 2.0",
+  ]) {
+    add(
+      text.indexOf(marker),
+      text.includes("LLVM EXCEPTION")
+        ? "Apache-2.0 WITH LLVM-exception"
+        : "Apache-2.0",
+    );
+  }
+  for (const [phrase, id] of LICENSE_GRANT_PHRASES) {
+    add(text.indexOf(phrase), id);
+  }
+  // A notice can hold several BSD texts (one per copyright holder), each read
+  // up to where the next one starts.
+  const bsdPhrase = "REDISTRIBUTION AND USE IN SOURCE AND BINARY FORMS";
+  for (
+    let bsdAt = text.indexOf(bsdPhrase);
+    bsdAt >= 0;
+    bsdAt = text.indexOf(bsdPhrase, bsdAt + bsdPhrase.length)
+  ) {
+    const nextAt = text.indexOf(bsdPhrase, bsdAt + bsdPhrase.length);
+    const clauses = text.slice(
+      bsdAt,
+      Math.min(bsdAt + 2000, nextAt < 0 ? text.length : nextAt),
+    );
+    add(
+      bsdAt,
+      clauses.includes("ALL ADVERTISING MATERIALS MENTIONING")
+        ? "BSD-4-Clause"
+        : clauses.includes("NEITHER THE NAME") ||
+            clauses.includes("THE NAME OF THE AUTHOR MAY NOT BE USED")
+          ? "BSD-3-Clause"
+          : "BSD-2-Clause",
+    );
+  }
+  const ids = [];
+  for (const { id } of found.sort((a, b) => a.at - b.at)) {
+    if (!ids.includes(id)) {
+      ids.push(id);
+    }
+  }
+  if (ids.length) {
+    return ids;
+  }
+  const guessed = guessLicenseId(content);
+  return guessed ? [guessed] : [];
+}
+
 /**
  * Method to guess the spdx license id from license contents
  *

package/lib/inventory/traceRunner.js

@@ -195,7 +195,7 @@ export function resolveSaferExecBinary() {
  * @param {boolean} [options.denyPersistenceWrites] - Deny writes to auto-execution and persistence locations
  * @param {boolean} [options.privateTmp] - Private tmpfs /tmp and /var/tmp (Linux)
  * @param {string} [options.protectHome] - Home isolation: read-only, tmpfs, or off (Linux)
- * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, proxy egress decisions, and the dry-run summary
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], cryptoEntries?: Object[], cryptoComponents?: Object[], cryptoResult?: Object, egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, crypto observations, proxy egress decisions, and the dry-run summary
  * @throws {Error} When the @cdxgen/safer-exec tracing runtime is not installed
  *   (for example after pruning it from a standalone payload), since the traced
  *   command could never run and the BOM would silently be empty
@@ -531,6 +531,9 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
         httpAccessEntries: [...collectedUrls, ...urls],
         cryptoEntries: [...collectedCrypto, ...cryptoLogs],
         cryptoComponents,
+        // The CRYPTO result from the report channel: the cipher entries carry
+        // the certificate chains servers presented (safer-exec ≥ 1.2.0).
+        cryptoResult: result?.crypto,
         egressEntries: parseEgressEntries(result.auditLog),
         dryRunSummary,
       };
@@ -541,6 +544,7 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
       httpAccessEntries: collectedUrls,
       cryptoEntries: collectedCrypto,
       cryptoComponents,
+      cryptoResult: result?.crypto,
       egressEntries: [],
       dryRunSummary,
     };

package/lib/inventory/tracedCrypto.js

@@ -3,6 +3,11 @@ import { join } from "node:path";
 
 import { thoughtLog } from "../core/logger.js";
 import { dirNameStr } from "../core/paths.js";
+import {
+  CertificateCollector,
+  certRecordFromObservedChainEntry,
+  toWellFormedText,
+} from "./certificates.js";
 import { applyAlgorithmProperties } from "./cryptoAlgorithmFamily.js";
 
 const cryptoOids = JSON.parse(
@@ -270,6 +275,130 @@ export function normalizeTracedCryptoComponents(cbomComponents) {
   return Array.from(byRef.values());
 }
 
+// safer-exec walks at most this many certificates of one server's chain
+// (tlsobserve maxChainCerts); a longer array did not come from it, so only the
+// first entries are read.
+const MAX_CHAIN_CERTS = 10;
+
+/**
+ * The bom-ref normalizeTracedCryptoComponents gives the protocol component of
+ * a negotiated TLS version: safer-exec's CBOM names it "TLSv1.2" with the
+ * version the prefix leaves ("1.2").
+ *
+ * @param {string} protocol negotiated protocol name from the crypto result
+ * @returns {string} protocol component bom-ref
+ */
+function tracedProtocolBomRef(protocol) {
+  const name = String(protocol || "");
+  const version = name.startsWith("TLSv") ? name.slice("TLSv".length) : name;
+  return `crypto/protocol/${encodeURIComponent(name)}@${encodeURIComponent(version || "unknown")}`;
+}
+
+/**
+ * Builds the shared certificate model for the chains servers presented in TLS
+ * ≤ 1.2 handshakes, from the `chain` arrays of safer-exec's crypto result
+ * (report channel, safer-exec ≥ 1.2.0; earlier releases and TLS 1.3 entries
+ * carry no chain and yield nothing). The records go through the shared
+ * certificate collector, so bom-refs, properties and dedup match certificates
+ * found on disk. A presented chain is untrusted server input: no issuer edges
+ * are inferred from it, and the certificate and public-key components link
+ * through the collector as every producer's do. Each TLS protocol component
+ * provides the certificates and keys presented under it — the edge safer-
+ * exec's own CBOM records — which answers which servers presented a key.
+ *
+ * @param {Object} cryptoResult safer-exec CRYPTO result (`result.crypto`)
+ * @param {Set<string>} protocolRefs bom-refs of the protocol components in the BOM;
+ *   a provides edge is only emitted for a protocol that is actually present
+ * @returns {{components: Object[], dependencies: Object[]}} certificate,
+ *   public-key and algorithm components, and the protocol provides edges
+ */
+export function observedChainComponents(
+  cryptoResult,
+  protocolRefs = new Set(),
+) {
+  const collector = new CertificateCollector();
+  // Protocol name -> {certSha256, spkiSha256} pairs in presentation order,
+  // leaf first; sorted to refs at the end so the output never depends on the
+  // connection order the engine happened to report.
+  const chainEntriesByProtocol = new Map();
+  // The collector keeps the first record's fields for a certSha256, so two
+  // servers presenting one hash with conflicting text would otherwise make
+  // the name (and bom-ref) depend on connection order; sort first.
+  const ciphers = (
+    Array.isArray(cryptoResult?.ciphers) ? cryptoResult.ciphers : []
+  )
+    .map((cipher) => [JSON.stringify(cipher) ?? "", cipher])
+    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+    .map(([, cipher]) => cipher);
+  for (const cipher of ciphers) {
+    const chain = cipher?.chain;
+    if (!Array.isArray(chain) || chain.length === 0) {
+      // safer-exec ≤ 1.1.2, or a TLS 1.3 handshake (encrypted Certificate
+      // message): no chain was observed.
+      continue;
+    }
+    const host = typeof cipher.host === "string" ? cipher.host : "";
+    for (const entry of chain.slice(0, MAX_CHAIN_CERTS)) {
+      const record = certRecordFromObservedChainEntry(entry, { host });
+      if (record) {
+        collector.addRecord(record);
+      }
+    }
+    // A protocol name is free text from the report channel; it only reaches a
+    // bom-ref through encodeURIComponent, so it must be well-formed.
+    const protocol = toWellFormedText(cipher.protocol);
+    if (protocol) {
+      let entries = chainEntriesByProtocol.get(protocol);
+      if (!entries) {
+        entries = [];
+        chainEntriesByProtocol.set(protocol, entries);
+      }
+      for (const entry of chain.slice(0, MAX_CHAIN_CERTS)) {
+        const certSha256 = String(entry?.certSha256 || "").toLowerCase();
+        const spkiSha256 = String(entry?.spkiSha256 || "").toLowerCase();
+        if (certSha256.length === 64) {
+          entries.push({ certSha256, spkiSha256 });
+        }
+      }
+    }
+  }
+  const { components, dependencies } = collector.build();
+  // The collector's components identify their asset by the hash in `version`
+  // (certSha256 for certificates, spkiSha256 for public keys).
+  const certRefBySha = new Map();
+  const keyRefBySpki = new Map();
+  for (const component of components) {
+    const assetType = component.cryptoProperties?.assetType;
+    if (assetType === "certificate") {
+      certRefBySha.set(component.version, component["bom-ref"]);
+    } else if (assetType === "related-crypto-material") {
+      keyRefBySpki.set(component.version, component["bom-ref"]);
+    }
+  }
+  const outputDependencies = [...dependencies];
+  for (const [protocol, entries] of chainEntriesByProtocol) {
+    const protocolRef = tracedProtocolBomRef(protocol);
+    if (!protocolRefs.has(protocolRef)) {
+      continue;
+    }
+    const provides = [
+      ...new Set(
+        entries.flatMap(({ certSha256, spkiSha256 }) => [
+          certRefBySha.get(certSha256),
+          keyRefBySpki.get(spkiSha256),
+        ]),
+      ),
+    ]
+      .filter((ref) => ref)
+      .sort();
+    if (provides.length) {
+      outputDependencies.push({ ref: protocolRef, provides });
+    }
+  }
+  outputDependencies.sort((left, right) => left.ref.localeCompare(right.ref));
+  return { components, dependencies: outputDependencies };
+}
+
 /**
  * Maps the crypto libraries safer-exec reported to the paths they were loaded
  * from.