@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/managers/binary.js

@@ -6,7 +6,15 @@ import {
   statSync,
 } from "node:fs";
 import { platform as _platform, homedir } from "node:os";
-import { basename, dirname, extname, join, relative, resolve } from "node:path";
+import {
+  basename,
+  dirname,
+  extname,
+  isAbsolute,
+  join,
+  relative,
+  resolve,
+} from "node:path";
 import process from "node:process";
 
 import { build, Purl } from "@cdxgen/cdx-purl";
@@ -30,26 +38,62 @@ import {
   safeRmSync,
   safeSpawnSync,
 } from "../core/fs.js";
+import { thoughtLog } from "../core/logger.js";
 import { mapWithConcurrency } from "../core/parallel.js";
 import { isValidDriveRoot } from "../core/paths.js";
 import { isCycloneDxComponentTypeEnabled } from "../inventory/bomUtils.js";
+import {
+  attachBrotliDecoder,
+  createBrotliInventory,
+  finishBrotliInventory,
+  MAX_BROTLI_PROBE_BYTES,
+  MAX_BROTLI_PROBES,
+  readBrotliDecoder,
+} from "../inventory/brotliDecoder.js";
+import {
+  CertificateCollector,
+  classifyCryptoFile,
+} from "../inventory/certificates.js";
 import { createContainerRiskProperties } from "../inventory/containerRisk.js";
+import { collectDotnetRuntimes } from "../inventory/dotnetRuntime.js";
 import {
   attachIdentityTools,
   extractToolRefs,
 } from "../inventory/evidenceUtils.js";
+import {
+  PRE_1_18_VERSION,
+  readGoBuildVersion,
+} from "../inventory/goBuildInfo.js";
 import { createGtfoBinsProperties } from "../inventory/gtfobins.js";
+import {
+  attachNodeBuild,
+  createNodeRuntimeInventory,
+  isNodeBinaryName,
+  MAX_NODE_PROBES,
+  readNodeBuildVersion,
+} from "../inventory/nodeBuildInfo.js";
 import {
   canonicalDistroQualifier,
+  getDistroInfo,
   isCleanDistroQualifier,
   OS_DISTRO_ALIAS,
   OS_NAMESPACE_ALIAS,
   readOsRelease,
 } from "../inventory/osinfo.js";
+import { isRealArchitecture } from "../inventory/osPackagePurl.js";
 import {
   collectExecutables,
+  collectNativeExtensions,
   collectSharedLibs,
 } from "../inventory/osPackageResolver.js";
+import {
+  attachPhpBuild,
+  classifyPhpSapi,
+  createPhpRuntimeInventory,
+  MAX_PHP_PROBES,
+  packageStoreOf,
+  readPhpBuildVersion,
+} from "../inventory/phpBuildInfo.js";
 import {
   resolveCdxgenPlugins,
   resolvePluginBinary,
@@ -60,11 +104,22 @@ import {
   parsePurlLoose,
   tryBuildPurl,
 } from "../inventory/purl.js";
+import { collectRootfsCertificates } from "../inventory/rootfsCerts.js";
+import {
+  attachRubyBuild,
+  createRubyRuntimeInventory,
+  deriveOsPackagedRubyRuntimes,
+  isLibrubyName,
+  isRubyBinaryName,
+  MAX_RUBY_PROBES,
+  readRubyBuildVersion,
+} from "../inventory/rubyBuildInfo.js";
 import {
   adjustLicenseInformation,
   findLicenseId,
   isSpdxLicenseExpression,
 } from "../inventory/spdx.js";
+import { isValidIdnEmail } from "../parsers/email.js";
 import { getDirs } from "./containerutils.js";
 
 const isWin = _platform() === "win32";
@@ -510,6 +565,15 @@ const COMMON_RUNTIMES = [
   "openjdk25-jre",
 ];
 
+// Runtime packages whose name carries the series, such as Debian's ruby3.1
+// and libruby3.1, openSUSE's libruby3_4-3_4 and Wolfi's ruby-3.3.
+const VERSIONED_RUNTIME_PATTERNS = [
+  /^(lib)?ruby\d+\.\d+(t64)?$/,
+  /^ruby-\d+\.\d+$/,
+  /^ruby-libs$/,
+  /^libruby\d+_\d+-\d+_\d+$/,
+];
+
 /**
  * Run the `cargo-auditable` companion binary against the given source path and
  * return its stdout.
@@ -654,7 +718,35 @@ export function canonicaliseOsPackageNamespace(
   group,
   distroId,
 ) {
-  if (!purlObj || !OS_PURL_TYPES.includes(purlObj.type)) {
+  if (!purlObj) {
+    return group;
+  }
+  // trivy invents a `bottlerocket` purl type for Bottlerocket host packages
+  // (trivy pkg/purl/purl.go, packageurlTypeBottlerocket); the purl spec has
+  // no such type — @cdxgen/cdx-purl has no generated type class for it, and
+  // no vulnerability feed stores under it. Rewrite to the form cdxgen's own
+  // os-release path produces for a Bottlerocket host: type rpm, namespace
+  // bottlerocket (the os-release ID; OS_NAMESPACE_ALIAS needs no entry).
+  // The distro qualifier trivy stamps (bottlerocket-<os version>) survives
+  // unchanged. The caller's group is returned as for any other rpm distro
+  // without an alias, so getOSPackages still records the rpm type and the
+  // distro in allTypes (oci:image:componentTypes).
+  if (purlObj.type === "bottlerocket") {
+    purlObj.type = "rpm";
+    purlObj.namespace = "bottlerocket";
+    comp.group = "bottlerocket";
+    comp.purl = build({
+      type: purlObj.type,
+      namespace: purlObj.namespace,
+      name: name,
+      version: purlObj.version || null,
+      qualifiers: purlObj.qualifiers || null,
+      subpath: purlObj.subpath || null,
+    });
+    comp["bom-ref"] = decodeURIComponent(comp.purl);
+    return group;
+  }
+  if (!OS_PURL_TYPES.includes(purlObj.type)) {
     return group;
   }
   const os_ns = purlObj.namespace || group || "";
@@ -773,7 +865,7 @@ export function dropRedundantSourceComponents(pkgList) {
   const installedPurls = new Set();
   for (const comp of pkgList) {
     if (comp?.purl && !comp?.tags?.includes("source")) {
-      installedPurls.add(comp.purl);
+      installedPurls.add(withoutArch(comp.purl));
     }
   }
   if (!installedPurls.size) {
@@ -781,13 +873,33 @@ export function dropRedundantSourceComponents(pkgList) {
   }
   for (let i = pkgList.length - 1; i >= 0; i--) {
     const comp = pkgList[i];
-    if (comp?.tags?.includes("source") && installedPurls.has(comp.purl)) {
+    if (
+      comp?.tags?.includes("source") &&
+      installedPurls.has(withoutArch(comp.purl))
+    ) {
       pkgList.splice(i, 1);
     }
   }
   return pkgList;
 }
 
+// The arch qualifier deb and rpm purls give a source package.
+const SOURCE_PACKAGE_ARCH = { deb: "source", rpm: "src" };
+
+// A source shadow is named like an installed package of the same name and
+// version, whatever arch either names, so arch is left out of the comparison.
+function withoutArch(purl) {
+  const [base, query] = `${purl}`.split("?");
+  if (!query) {
+    return base;
+  }
+  const kept = query
+    .split("&")
+    .filter((pair) => !pair.startsWith("arch="))
+    .sort();
+  return kept.length ? `${base}?${kept.join("&")}` : base;
+}
+
 /**
  * Get the packages installed in the container image filesystem.
  *
@@ -923,80 +1035,20 @@ export async function getOSPackages(src, imageConfig, options = {}) {
       if (DEBUG_MODE) {
         console.log(osReleaseData);
       }
-      // distro_name must be a real release codename/token (bookworm, jammy,
-      // rhel-9, alpine-3.19), never a distro *display name*. VERSION_CODENAME is
-      // authoritative when present; otherwise the RHEL/CentOS product-name
-      // fallbacks are only accepted when they resolve through OS_DISTRO_ALIAS
-      // (e.g. "red hat enterprise linux 9" -> "rhel-9"). Display names such as
-      // "Rocky Linux" or "AlmaLinux" have no alias entry and are dropped so we
-      // never emit a bogus distro_name qualifier (RPM distros track packages
-      // flat, without a release segment, so folding a display name breaks
-      // downstream vuln-db matching).
-      let distro_codename = (
-        osReleaseData["VERSION_CODENAME"] || ""
-      ).toLowerCase();
-      if (!distro_codename) {
-        const distro_display_name = (
-          osReleaseData["CENTOS_MANTISBT_PROJECT"] ||
-          osReleaseData["REDHAT_BUGZILLA_PRODUCT"] ||
-          osReleaseData["REDHAT_SUPPORT_PRODUCT"] ||
-          ""
-        ).toLowerCase();
-        if (distro_display_name && OS_DISTRO_ALIAS[distro_display_name]) {
-          distro_codename = OS_DISTRO_ALIAS[distro_display_name];
-        }
-      }
-      let distro_id = osReleaseData["ID"] || "";
-      const distro_id_like = osReleaseData["ID_LIKE"] || "";
-      let purl_type = "rpm";
-      switch (distro_id) {
-        case "debian":
-        case "ubuntu":
-        case "pop":
-          purl_type = "deb";
-          break;
-        case "sles":
-        case "suse":
-        case "opensuse":
-          purl_type = "rpm";
-          break;
-        case "alpine":
-          purl_type = "apk";
-          if (osReleaseData.VERSION_ID) {
-            const versionParts = osReleaseData["VERSION_ID"].split(".");
-            if (versionParts.length >= 2) {
-              distro_codename = `alpine-${versionParts[0]}.${versionParts[1]}`;
-            }
-          }
-          break;
-        case "alpaquita":
-          purl_type = "apk";
-          break;
-        default:
-          if (distro_id_like.includes("debian")) {
-            purl_type = "deb";
-          } else if (distro_id_like.includes("alpine")) {
-            purl_type = "apk";
-          } else if (
-            distro_id_like.includes("rhel") ||
-            distro_id_like.includes("centos") ||
-            distro_id_like.includes("fedora")
-          ) {
-            purl_type = "rpm";
-          }
-          break;
-      }
-      if (osReleaseData["VERSION_ID"]) {
-        distro_id = `${distro_id}-${osReleaseData["VERSION_ID"]}`;
-        if (OS_DISTRO_ALIAS[distro_id]) {
-          distro_codename = OS_DISTRO_ALIAS[distro_id];
-        }
-      }
-      // Canonicalise the distro qualifier vendor (e.g. "mariner-2.0" ->
-      // "azure-linux-2.0") so every spelling of one release yields a single
-      // qualifier value. This runs before distro_id is used to overwrite
-      // trivy's own qualifier below.
-      distro_id = canonicalDistroQualifier(distro_id);
+      // The distro of the rootfs is decided in getDistroInfo, which an OBOM run
+      // on the same system reads too, so a package gets the same qualifiers
+      // from either scan. distro_name is a real release codename/token
+      // (bookworm, jammy, rhel, alpine-3.24), never a distro *display name*:
+      // "Rocky Linux" or "AlmaLinux" is dropped, since RPM distros track
+      // packages flat and a display name there breaks downstream vuln-db
+      // matching. distro is ID-VERSION_ID with the vendor canonicalised (e.g.
+      // "mariner-2.0" -> "azure-linux-2.0"), so every spelling of one release
+      // yields a single qualifier value; it overwrites trivy's own qualifier
+      // below.
+      const distroInfo = getDistroInfo(src);
+      let distro_codename = distroInfo.distroName;
+      const distro_id = distroInfo.distroId;
+      const purl_type = distroInfo.purlType;
       const tmpDependencies = {};
       tools = enrichToolComponents(
         (Array.isArray(tmpBom?.metadata?.tools)
@@ -1030,6 +1082,27 @@ export async function getOSPackages(src, imageConfig, options = {}) {
             try {
               purlObj = Purl.parse(comp.purl);
               purlObj.qualifiers = purlObj.qualifiers || {};
+              if (
+                OS_PURL_TYPES.includes(purlObj.type) &&
+                "arch" in purlObj.qualifiers &&
+                !isRealArchitecture(purlObj.qualifiers.arch)
+              ) {
+                // trivy writes arch=None for a package with no architecture,
+                // such as an rpm's gpg-pubkey; a package has the architecture
+                // it has, or none, as in an OBOM.
+                delete purlObj.qualifiers.arch;
+                comp.purl = build({
+                  type: purlObj.type,
+                  namespace: purlObj.namespace || null,
+                  name: name,
+                  version: purlObj.version || null,
+                  qualifiers: Object.keys(purlObj.qualifiers).length
+                    ? purlObj.qualifiers
+                    : null,
+                  subpath: purlObj.subpath || null,
+                });
+                comp["bom-ref"] = decodeURIComponent(comp.purl);
+              }
             } catch (_err) {
               // continue regardless of error
             }
@@ -1115,16 +1188,20 @@ export async function getOSPackages(src, imageConfig, options = {}) {
                 if (distro_codename !== "") {
                   allTypes.add(distro_codename);
                   allTypes.add(purlObj.namespace);
-                  comp.purl = build({
-                    type: purlObj.type,
-                    namespace: purlObj.namespace || null,
-                    name: name,
-                    version: purlObj.version || null,
-                    qualifiers: purlObj.qualifiers || null,
-                    subpath: purlObj.subpath || null,
-                  });
-                  comp["bom-ref"] = decodeURIComponent(comp.purl);
                 }
+                // Rebuilt whether or not the distro has a codename: the distro
+                // stamped above is ID-VERSION_ID for every distro, and a purl
+                // left as trivy wrote it keeps trivy's own spelling (a bare
+                // 20230201 for a Wolfi image).
+                comp.purl = build({
+                  type: purlObj.type,
+                  namespace: purlObj.namespace || null,
+                  name: name,
+                  version: purlObj.version || null,
+                  qualifiers: purlObj.qualifiers || null,
+                  subpath: purlObj.subpath || null,
+                });
+                comp["bom-ref"] = decodeURIComponent(comp.purl);
               } catch (_err) {
                 // continue regardless of error
               }
@@ -1325,6 +1402,14 @@ export async function getOSPackages(src, imageConfig, options = {}) {
                 if (epoch) {
                   newCompQualifiers.epoch = epoch;
                 }
+                // A source package is built for no architecture. The deb and
+                // rpm purl types name it `source` and `src`; copying the arch
+                // of whichever binary led here (`all` from a -doc package)
+                // misnames it.
+                const sourceArch = SOURCE_PACKAGE_ARCH[purlObj.type];
+                if (sourceArch && newCompQualifiers.arch) {
+                  newCompQualifiers.arch = sourceArch;
+                }
                 newComp.purl = build({
                   type: purlObj.type,
                   namespace: purlObj.namespace || null,
@@ -1360,6 +1445,7 @@ export async function getOSPackages(src, imageConfig, options = {}) {
     components: ownedFileComponents,
     dependenciesList: ownedFileDependencies,
     ownedFilePaths,
+    ownerByPath,
     services: ownedServices,
   } = await createOSPackageFileComponents(src, osPackageEntries);
   if (ownedFileComponents.length) {
@@ -1404,12 +1490,91 @@ export async function getOSPackages(src, imageConfig, options = {}) {
       "/etc/ld.so.conf",
       "/etc/ld.so.conf.d/*.conf",
       ownedFilePaths,
+      // Apache loads libphp*.so from a modules directory that is two levels
+      // below /usr, which the default one-level globs miss.
+      [
+        "**/usr/lib/apache2/modules/libphp*.so",
+        "**/usr/lib/httpd/modules/libphp*.so",
+        "**/usr/lib64/httpd/modules/libphp*.so",
+      ],
     ),
     "shared_library",
   );
+  // Go executables carry the toolchain they were built with in their
+  // buildinfo header. The stdlib is statically linked, so that version
+  // decides whether the binary applies Go's CVE-2026-111943 distrust list.
+  const goBuildInventory = collectGoBuildInfo(executables, src);
+  if (goBuildInventory.stdlibComponents.length) {
+    pkgList.push(...goBuildInventory.stdlibComponents);
+  }
+  if (goBuildInventory.dependencies.length) {
+    dependenciesList.push(...goBuildInventory.dependencies);
+  }
+  // Source-built PHP (the Docker Official image, FrankenPHP and custom
+  // /usr/local builds) is unpackaged, so its version is only visible in the
+  // binaries and the installed php_version.h.
+  const phpBuildInventory = collectPhpBuildInfo(executables, sharedLibs, src);
+  if (phpBuildInventory.runtimeComponents.length) {
+    pkgList.push(...phpBuildInventory.runtimeComponents);
+  }
+  if (phpBuildInventory.dependencies.length) {
+    dependenciesList.push(...phpBuildInventory.dependencies);
+  }
+  // Node.js from the Docker Official images, the release tarballs, nvm, fnm or
+  // volta is unpackaged, so its version is only visible in the binary.
+  const nodeBuildInventory = collectNodeBuildInfo(executables, sharedLibs, src);
+  if (nodeBuildInventory.runtimeComponents.length) {
+    pkgList.push(...nodeBuildInventory.runtimeComponents);
+  }
+  if (nodeBuildInventory.dependencies.length) {
+    dependenciesList.push(...nodeBuildInventory.dependencies);
+  }
+  // Ruby from the Docker Official images, ruby-build, rbenv, rvm, asdf, mise
+  // or chruby is unpackaged; its version is in rbconfig.rb and libruby.
+  const rubyBuildInventory = collectRubyBuildInfo(executables, sharedLibs, src);
+  if (rubyBuildInventory.runtimeComponents.length) {
+    pkgList.push(...rubyBuildInventory.runtimeComponents);
+  }
+  if (rubyBuildInventory.dependencies.length) {
+    dependenciesList.push(...rubyBuildInventory.dependencies);
+  }
+  // A Ruby an OS package installed is named by that package; it also gets
+  // its upstream identity, without a CPE, so a BOM names the interpreter both
+  // ways.
+  pkgList.push(...deriveOsPackagedRubyRuntimes(pkgList));
+  // The .NET images and dotnet-install.sh put the runtime under a dotnet root
+  // without a package manager; its deps.json names the runtime pack.
+  const dotnetRuntimes = collectDotnetRuntimes(src, ownedFilePaths);
+  if (dotnetRuntimes.length) {
+    pkgList.push(...dotnetRuntimes);
+    for (const runtime of dotnetRuntimes) {
+      dependenciesList.push({ ref: runtime["bom-ref"], dependsOn: [] });
+    }
+  }
+  // A Brotli decoder compiled into a native file that no package manager owns
+  // (Node.js, Python wheels, PHP and Ruby extensions, the .NET runtime, static
+  // binaries) is only visible by reading the file.
+  const brotliInventory = await collectBrotliDecoders(
+    executables,
+    sharedLibs,
+    src,
+    ownedFilePaths,
+  );
+
+  if (brotliInventory.components.length) {
+    pkgList.push(...brotliInventory.components);
+  }
+  if (brotliInventory.dependencies.length) {
+    dependenciesList.push(...brotliInventory.dependencies);
+  }
   return {
     osPackages: pkgList,
     osPackageFiles,
+    // Extension modules that carry a Brotli decoder. They are reported apart
+    // from sharedLibs so the unpackaged-library count still counts what the
+    // loader's directories hold.
+    nativeExtensionFiles: brotliInventory.extensionFiles,
+    ownerByPath,
     dependenciesList,
     allTypes: Array.from(allTypes).sort(),
     bundledSdks: Array.from(bundledSdks).sort(),
@@ -1545,17 +1710,24 @@ function mergeOrganizationalEntityField(component, fieldName, entityName) {
   return { applied: false, represented: false };
 }
 
-function parseOrganizationalContact(value) {
+/**
+ * Split a `Name <address>` maintainer string into an `organizationalContact`.
+ *
+ * @param {string} value Maintainer or supplier string
+ * @returns {{name: string, email?: string}|undefined} The contact, if any
+ */
+export function parseOrganizationalContact(value) {
   const normalizedValue = `${value || ""}`.trim();
   if (!normalizedValue) {
     return undefined;
   }
   const match = normalizedValue.match(/^([^<>]+?)\s*<([^<>\s]+@[^<>\s]+)>$/);
   if (match) {
-    return {
-      name: match[1].trim(),
-      email: match[2].trim(),
-    };
+    const name = match[1].trim();
+    const email = match[2].trim();
+    // `organizationalContact.email` is an `idn-email`; an address that is not
+    // one (say `a@b@c`) would fail schema validation, so keep only the name.
+    return isValidIdnEmail(email) ? { name, email } : { name };
   }
   return { name: normalizedValue };
 }
@@ -1644,13 +1816,34 @@ function promoteTrivyOsPackageIdentity(component, trivyMetadata) {
 async function collectRootfsRepositoryInventory(basePath, options = {}) {
   let trustedKeyComponents = [];
   let refsByPath = new Map();
+  let trustMaterialDependencies = [];
   if (isCycloneDxComponentTypeEnabled("cryptographic-asset", options)) {
     ({ components: trustedKeyComponents, refsByPath } =
       await collectTrustedKeyComponents(basePath));
-    trustedKeyComponents = applyTrustMaterialEnhancements(
+    ({
+      components: trustedKeyComponents,
+      dependencies: trustMaterialDependencies,
+    } = applyTrustMaterialEnhancements(
       trustedKeyComponents,
       collectTrustInspectorRootfsInventory(basePath),
-    );
+      basePath,
+    ));
+    if (!TRUSTINSPECTOR_BIN) {
+      // No plugin: walk the same locations in JavaScript. With the plugin
+      // present its rootfs report is the only producer, so nothing is
+      // counted twice.
+      const fallback = collectRootfsCertificates(basePath);
+      const knownRefs = new Set(trustedKeyComponents.map((c) => c["bom-ref"]));
+      for (const component of fallback.components) {
+        if (!knownRefs.has(component["bom-ref"])) {
+          knownRefs.add(component["bom-ref"]);
+          trustedKeyComponents.push(component);
+        }
+      }
+      trustMaterialDependencies = trustMaterialDependencies.concat(
+        fallback.dependencies,
+      );
+    }
   }
   refsByPath = new Map(
     trustedKeyComponents
@@ -1692,6 +1885,7 @@ async function collectRootfsRepositoryInventory(basePath, options = {}) {
       });
     }
   }
+  dependenciesList.push(...trustMaterialDependencies);
   return { components, dependenciesList };
 }
 
@@ -1877,7 +2071,9 @@ function executeTrustInspector(args, activity) {
   if (DEBUG_MODE) {
     console.log("Executing", TRUSTINSPECTOR_BIN, args.join(" "));
   }
-  const result = safeSpawnSync(TRUSTINSPECTOR_BIN, args);
+  const result = safeSpawnSync(TRUSTINSPECTOR_BIN, args, {
+    timeout: 10 * 60 * 1000,
+  });
   if (result?.status !== 0 || result?.error) {
     if (DEBUG_MODE && (result?.stdout || result?.stderr)) {
       console.error(result.stdout, result.stderr);
@@ -1991,91 +2187,54 @@ function createTrustMaterialComponent(material) {
       ? [{ name: "cdx:crypto:expiresAt", value: material.expiresAt }]
       : []),
   ]);
-  let component;
   if (material.kind === "certificate") {
-    component = {
-      "bom-ref": `crypto/certificate/${encodeURIComponent(material.name || normalizedPath)}@${material.sha256 ? `sha256:${material.sha256}` : material.serial || material.expiresAt || "unknown"}`,
-      name: material.name || basename(normalizedPath),
-      type: "cryptographic-asset",
-      version:
-        material.sha256 ||
-        material.serial ||
-        material.expiresAt ||
-        "configured",
-      hashes,
-      description: material.subject || normalizedPath,
-      cryptoProperties: {
-        assetType: "certificate",
-        algorithmProperties: {
-          executionEnvironment: "unknown",
-          implementationPlatform: "unknown",
-        },
-        certificateProperties: {
-          serialNumber: material.serial || undefined,
-          subjectName: material.subject || undefined,
-          issuerName: material.issuer || undefined,
-          notValidBefore: material.createdAt || undefined,
-          notValidAfter: material.expiresAt || undefined,
-          certificateFormat: material.format || "X.509",
-          certificateFileExtension: material.fileExtension || undefined,
-          fingerprint: material.fingerprint
-            ? { alg: "SHA-256", content: material.fingerprint }
-            : undefined,
-        },
+    // Certificates are built by the shared collector in
+    // applyTrustMaterialEnhancements; this legacy builder no longer produces
+    // them, so a certificate material reaching here is skipped.
+    return undefined;
+  }
+  const component = {
+    "bom-ref": `crypto/related-crypto-material/public-key/${encodeURIComponent(normalizedPath)}@${material.sha256 ? `sha256:${material.sha256}` : material.keyId || "unknown"}`,
+    name: material.name || basename(normalizedPath),
+    type: "cryptographic-asset",
+    version: material.sha256 || material.keyId || normalizedPath,
+    hashes,
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "public-key",
+        id:
+          material.keyId ||
+          material.fingerprint ||
+          material.sha256 ||
+          normalizedPath,
+        state: trustMaterialState(material),
       },
-      properties: uniqueProperties(
-        sharedProperties.concat(
-          material.trustDomain
-            ? [{ name: "cdx:crypto:trustDomain", value: material.trustDomain }]
-            : [],
-        ),
-      ),
-    };
-  } else {
-    component = {
-      "bom-ref": `crypto/related-crypto-material/public-key/${encodeURIComponent(normalizedPath)}@${material.sha256 ? `sha256:${material.sha256}` : material.keyId || "unknown"}`,
-      name: material.name || basename(normalizedPath),
-      type: "cryptographic-asset",
-      version: material.sha256 || material.keyId || normalizedPath,
-      hashes,
-      cryptoProperties: {
-        assetType: "related-crypto-material",
-        relatedCryptoMaterialProperties: {
-          type: "public-key",
-          id:
-            material.keyId ||
-            material.fingerprint ||
-            material.sha256 ||
-            normalizedPath,
-          state: trustMaterialState(material),
+    },
+    properties: uniqueProperties(
+      sharedProperties.concat([
+        {
+          name: "cdx:crypto:trustDomain",
+          value: material.trustDomain || deriveTrustedKeyDomain(normalizedPath),
         },
-      },
-      properties: uniqueProperties(
-        sharedProperties.concat([
-          {
-            name: "cdx:crypto:trustDomain",
-            value:
-              material.trustDomain || deriveTrustedKeyDomain(normalizedPath),
-          },
-          { name: "cdx:crypto:keyPath", value: normalizedPath },
-          {
-            name: "cdx:crypto:fileExtension",
-            value:
-              material.fileExtension ||
-              extname(normalizedPath).replace(/^\./, "") ||
-              "gpg",
-          },
-          ...(material?.keyId
-            ? [{ name: "cdx:crypto:keyId", value: material.keyId }]
-            : []),
-          ...(material?.userIds || []).map((value) => ({
-            name: "cdx:crypto:userId",
-            value,
-          })),
-        ]),
-      ),
-    };
-  }
+        { name: "cdx:crypto:keyPath", value: normalizedPath },
+        {
+          name: "cdx:crypto:fileExtension",
+          value:
+            material.fileExtension ||
+            extname(normalizedPath).replace(/^\./, "") ||
+            "gpg",
+        },
+        ...(material?.keyId
+          ? [{ name: "cdx:crypto:keyId", value: material.keyId }]
+          : []),
+        ...(material?.userIds || []).map((value) => ({
+          name: "cdx:crypto:userId",
+          value,
+        })),
+      ]),
+    ),
+  };
   attachIdentityTools(component, trustInspectorToolRefs());
   return component;
 }
@@ -2100,9 +2259,73 @@ function enhanceComponentFromTrustMaterial(component, material) {
   return component;
 }
 
-function applyTrustMaterialEnhancements(components, materials) {
+function createKeystoreComponent(material) {
+  const normalizedPath = normalizeContainerPath(material?.path);
+  if (!normalizedPath) {
+    return undefined;
+  }
+  const readable = (material?.properties || []).find(
+    (property) => property.name === "cdx:crypto:keystoreReadable",
+  )?.value;
+  const component = {
+    "bom-ref": `crypto/related-crypto-material/keystore/${encodeURIComponent(normalizedPath)}`,
+    name: basename(normalizedPath),
+    type: "cryptographic-asset",
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "other",
+        ...(material?.format ? { format: material.format } : {}),
+      },
+    },
+    evidence: { occurrences: [{ location: normalizedPath }] },
+    properties: [
+      { name: "internal:SrcFile", value: normalizedPath },
+      ...(material?.sourceType
+        ? [{ name: "cdx:crypto:sourceType", value: material.sourceType }]
+        : []),
+      ...(readable
+        ? [{ name: "cdx:crypto:keystoreReadable", value: readable }]
+        : []),
+    ],
+  };
+  attachIdentityTools(component, trustInspectorToolRefs());
+  return component;
+}
+
+// Private keys are classified from the PEM header line only and never
+// decoded (PLAN section 1.7): the format travels, no key material does.
+function createPrivateKeyComponent(material) {
+  const normalizedPath = normalizeContainerPath(material?.path);
+  if (!normalizedPath) {
+    return undefined;
+  }
+  const component = {
+    "bom-ref": `crypto/related-crypto-material/private-key/${encodeURIComponent(normalizedPath)}`,
+    name: basename(normalizedPath),
+    type: "cryptographic-asset",
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "private-key",
+        ...(material?.format ? { format: material.format } : {}),
+      },
+    },
+    evidence: { occurrences: [{ location: normalizedPath }] },
+    properties: [
+      { name: "internal:SrcFile", value: normalizedPath },
+      ...(material?.sourceType
+        ? [{ name: "cdx:crypto:sourceType", value: material.sourceType }]
+        : []),
+    ],
+  };
+  attachIdentityTools(component, trustInspectorToolRefs());
+  return component;
+}
+
+function applyTrustMaterialEnhancements(components, materials, basePath) {
   if (!materials?.length) {
-    return components || [];
+    return { components: components || [], dependencies: [] };
   }
   const componentList = [...(components || [])];
   const bySrcFile = new Map();
@@ -2119,6 +2342,8 @@ function applyTrustMaterialEnhancements(components, materials) {
     }
   }
   for (const material of materials) {
+    // GPG-style keyring materials (report-1 `kind: public-key`) enhance the
+    // components the native readers already produced.
     const srcFile = normalizeContainerPath(material?.path);
     const existing = bySrcFile.get(srcFile);
     if (
@@ -2129,17 +2354,95 @@ function applyTrustMaterialEnhancements(components, materials) {
       enhanceComponentFromTrustMaterial(existing, material);
       continue;
     }
-    const component = createTrustMaterialComponent(material);
+    if (material?.kind === "public-key") {
+      const component = createTrustMaterialComponent(material);
+      if (!component?.["bom-ref"] || seenRefs.has(component["bom-ref"])) {
+        continue;
+      }
+      seenRefs.add(component["bom-ref"]);
+      componentList.push(component);
+      if (srcFile) {
+        bySrcFile.set(srcFile, component);
+      }
+    }
+  }
+  // Certificates, their SPKI public keys, algorithm components and verified
+  // issuer edges come from the shared collector; keystores and private keys
+  // are their own components.
+  const collector = new CertificateCollector();
+  collector.addTrustInspectorMaterials(materials);
+  const { components: cryptoComponents, dependencies } = collector.build();
+  for (const material of materials) {
+    if (material?.kind === "keystore") {
+      cryptoComponents.push(createKeystoreComponent(material));
+    } else if (material?.kind === "private-key") {
+      cryptoComponents.push(createPrivateKeyComponent(material));
+    }
+  }
+  // A keystore the plugin could read is reported as the certificates it
+  // holds; give it the keystore component the unreadable ones get and link
+  // it to those certificates.
+  if (basePath) {
+    const certMaterialByPath = new Map();
+    for (const material of materials) {
+      if (material?.kind === "certificate" && material.path) {
+        certMaterialByPath.set(normalizeContainerPath(material.path), material);
+      }
+    }
+    for (const [path, material] of certMaterialByPath) {
+      let classification;
+      try {
+        const absolute = join(basePath, path.replace(/^\/+/, ""));
+        // The path comes from the plugin report: it must stay inside the
+        // scanned root, symlinks included.
+        const realRoot = realpathSync(basePath);
+        const realFile = realpathSync(absolute);
+        const inside = relative(realRoot, realFile);
+        if (inside.startsWith("..") || isAbsolute(inside)) {
+          continue;
+        }
+        const stats = lstatSync(absolute);
+        if (!stats.isFile() || stats.size > 16 * 1024 * 1024) {
+          continue;
+        }
+        classification = classifyCryptoFile(readFileSync(absolute));
+      } catch (_err) {
+        continue;
+      }
+      if (classification.kind !== "keystore") {
+        continue;
+      }
+      const keystore = createKeystoreComponent({
+        path,
+        format: classification.format,
+        sourceType: material.sourceType,
+      });
+      cryptoComponents.push(keystore);
+      const held = cryptoComponents
+        .filter(
+          (component) =>
+            component.cryptoProperties?.assetType === "certificate" &&
+            component.evidence?.occurrences?.some(
+              (occurrence) =>
+                normalizeContainerPath(occurrence.location) === path,
+            ),
+        )
+        .map((component) => component["bom-ref"])
+        .sort();
+      if (held.length) {
+        dependencies.push({ ref: keystore["bom-ref"], dependsOn: held });
+      }
+    }
+  }
+  for (const component of cryptoComponents) {
     if (!component?.["bom-ref"] || seenRefs.has(component["bom-ref"])) {
       continue;
     }
     seenRefs.add(component["bom-ref"]);
+    attachIdentityTools(component, trustInspectorToolRefs());
     componentList.push(component);
-    if (srcFile) {
-      bySrcFile.set(srcFile, component);
-    }
   }
-  return componentList;
+  return { components: componentList, dependencies };
 }
 
 function collectTrustInspectorRootfsInventory(basePath) {
@@ -2510,6 +2813,7 @@ async function createOSPackageFileComponents(basePath, osPackageEntries) {
   const components = [];
   const dependenciesList = [];
   const ownedFilePaths = new Set();
+  const ownerByPath = new Map();
   const services = [];
   const componentByPath = new Map();
   for (const packageEntry of osPackageEntries) {
@@ -2520,6 +2824,10 @@ async function createOSPackageFileComponents(basePath, osPackageEntries) {
         continue;
       }
       ownedFilePaths.add(filePath);
+      const ownerKey = filePath.replaceAll("\\", "/").replace(/^\/+/, "");
+      if (!ownerByPath.has(ownerKey)) {
+        ownerByPath.set(ownerKey, packageEntry.packageRef);
+      }
       let fileComponent = componentByPath.get(filePath);
       if (!fileComponent) {
         fileComponent = await createOSPackageFileComponent(
@@ -2558,6 +2866,7 @@ async function createOSPackageFileComponents(basePath, osPackageEntries) {
     components,
     dependenciesList,
     ownedFilePaths: Array.from(ownedFilePaths).sort(),
+    ownerByPath,
     services: dedupeServices(services),
   };
 }
@@ -3043,7 +3352,10 @@ function detectSdksRuntimes(comp, bundledSdks, bundledRuntimes) {
     bundledRuntimes.add(comp.name);
   }
   // TODO: Need to test this for a range of base images
-  if (COMMON_RUNTIMES.includes(comp.name)) {
+  if (
+    COMMON_RUNTIMES.includes(comp.name) ||
+    VERSIONED_RUNTIME_PATTERNS.some((pattern) => pattern.test(comp.name))
+  ) {
     bundledRuntimes.add(comp.name);
   }
 }
@@ -3299,10 +3611,37 @@ export function enrichOSComponentsWithTrustData(components = []) {
   if (hostComponents.length) {
     mergedComponents.push(...hostComponents);
   }
+  // report-2 host mode enumerates the platform trust stores as materials;
+  // they flow through the shared certificate model like any other producer.
+  const hostCollector = new CertificateCollector();
+  hostCollector.addTrustInspectorMaterials(hostData?.materials);
+  const { components: hostMaterialComponents } = hostCollector.build();
+  for (const material of hostData?.materials || []) {
+    if (material?.kind === "keystore") {
+      const component = createKeystoreComponent(material);
+      if (component) {
+        hostMaterialComponents.push(component);
+      }
+    } else if (material?.kind === "private-key") {
+      const component = createPrivateKeyComponent(material);
+      if (component) {
+        hostMaterialComponents.push(component);
+      }
+    }
+  }
+  for (const component of hostMaterialComponents) {
+    if (!component?.["bom-ref"]) {
+      continue;
+    }
+    attachIdentityTools(component, trustInspectorToolRefs());
+    mergedComponents.push(component);
+  }
   return {
     components: mergedComponents,
     tools:
-      pathInspectionCandidates.length || hostComponents.length
+      pathInspectionCandidates.length ||
+      hostComponents.length ||
+      hostMaterialComponents.length
         ? getPluginToolComponents(["trustinspector"])
         : [],
   };
@@ -3473,6 +3812,347 @@ export function getBinaryBom(src, binaryBomFile, deepMode) {
   return true;
 }
 
+// The Go standard library has no module path, so `pkg:golang/stdlib@v<x>` is
+// not a purl cdx-purl will build (the same reason trivy's stdlib purl is
+// dropped further up). The bom-ref below is the decoded form of that string,
+// exactly the ref trivy-produced stdlib components already carry, so both
+// paths land on one component. Trivy reports the stdlib version without the
+// `go` prefix (`v1.27.2`) while buildinfo keeps it (`go1.27.2`).
+function goStdlibRef(goVersion) {
+  // "go1.26.10 X:boringcrypto" names the toolchain go1.26.10.
+  return `pkg:golang/stdlib@v${goVersion.split(/\s/)[0].replace(/^go/, "")}`;
+}
+
+/**
+ * Read the Go buildinfo version of each executable file component and link it
+ * to (or create) the matching `pkg:golang/stdlib` component. Mutates the
+ * components in place by adding `cdx:go:buildVersion`.
+ *
+ * @param {Object[]} executables file components from `fileComponents(.., "executable")`
+ * @param {string} basePath extracted rootfs the paths are relative to
+ * @returns {{stdlibComponents: Object[], dependencies: Object[]}}
+ */
+function collectGoBuildInfo(executables, basePath) {
+  const stdlibComponents = [];
+  const dependencies = [];
+  if (!executables?.length) {
+    return { stdlibComponents, dependencies };
+  }
+  const stdlibRefs = new Set();
+  for (const component of executables) {
+    if (!component?.properties) {
+      continue;
+    }
+    const srcFile = component.properties.find(
+      (property) => property.name === "internal:SrcFile",
+    )?.value;
+    if (!srcFile) {
+      continue;
+    }
+    const goVersion = readGoBuildVersion(
+      join(basePath, srcFile.replace(/^\/+/, "")),
+    );
+    if (!goVersion) {
+      continue;
+    }
+    component.properties.push({
+      name: "cdx:go:buildVersion",
+      value: goVersion,
+    });
+    // A pre-1.18 toolchain has no version string to build a stdlib ref
+    // from; the buildVersion property alone records the fact.
+    if (goVersion === PRE_1_18_VERSION) {
+      continue;
+    }
+    const stdlibRef = goStdlibRef(goVersion);
+    if (!stdlibRefs.has(stdlibRef)) {
+      stdlibRefs.add(stdlibRef);
+      stdlibComponents.push({
+        "bom-ref": stdlibRef,
+        name: "stdlib",
+        type: "library",
+        version: stdlibRef.slice("pkg:golang/stdlib@".length),
+        group: "",
+      });
+      dependencies.push({ ref: stdlibRef, dependsOn: [] });
+    }
+    if (component["bom-ref"]) {
+      dependencies.push({
+        ref: component["bom-ref"],
+        dependsOn: [stdlibRef],
+      });
+    }
+  }
+  return { stdlibComponents, dependencies };
+}
+
+/**
+ * Read the PHP build version of each PHP-named executable and shared library,
+ * add the cdx:php:* properties, and link the components to one platform
+ * component per distinct version. Mutates the components in place, as the Go
+ * collector does.
+ *
+ * @param {Object[]} executables file components from `fileComponents(.., "executable")`
+ * @param {Object[]} sharedLibs file components from `fileComponents(.., "shared_library")`
+ * @param {string} basePath extracted rootfs the paths are relative to
+ * @returns {{runtimeComponents: Object[], dependencies: Object[]}}
+ */
+function collectPhpBuildInfo(executables, sharedLibs, basePath) {
+  const inventory = createPhpRuntimeInventory();
+  let probes = 0;
+  for (const component of [...(executables || []), ...(sharedLibs || [])]) {
+    if (probes >= MAX_PHP_PROBES) {
+      break;
+    }
+    if (!component?.properties) {
+      continue;
+    }
+    const srcFile = component.properties.find(
+      (property) => property.name === "internal:SrcFile",
+    )?.value;
+    if (!srcFile) {
+      continue;
+    }
+    const sapi = classifyPhpSapi(srcFile);
+    if (!sapi) {
+      continue;
+    }
+    const absolutePath = join(basePath, srcFile.replace(/^\/+/, ""));
+    let resolvedPath = srcFile;
+    try {
+      resolvedPath = relative(
+        realpathSync(basePath),
+        realpathSync(absolutePath),
+      );
+    } catch {
+      // readPhpBuildVersion decides what an unresolvable path yields.
+    }
+    // Trivy does not list Nix, Guix or Homebrew packages, so a PHP in their
+    // stores looks unpackaged here, but it is still theirs.
+    if (packageStoreOf(srcFile) || packageStoreOf(resolvedPath)) {
+      continue;
+    }
+    probes += 1;
+    const build = readPhpBuildVersion(absolutePath, basePath);
+    if (!build) {
+      continue;
+    }
+    attachPhpBuild(inventory, component, build, sapi);
+  }
+  return {
+    runtimeComponents: inventory.runtimeComponents,
+    dependencies: inventory.dependencies,
+  };
+}
+
+/**
+ * Read the Node.js build version of each node-named executable and libnode
+ * shared library, add the cdx:node:* properties, and link the components to
+ * one platform component per distinct version. Mutates the components in
+ * place, as the PHP collector does.
+ *
+ * @param {Object[]} executables file components from `fileComponents(.., "executable")`
+ * @param {Object[]} sharedLibs file components from `fileComponents(.., "shared_library")`
+ * @param {string} basePath extracted rootfs the paths are relative to
+ * @returns {{runtimeComponents: Object[], dependencies: Object[]}}
+ */
+function collectNodeBuildInfo(executables, sharedLibs, basePath) {
+  const inventory = createNodeRuntimeInventory();
+  let probes = 0;
+  for (const component of [...(executables || []), ...(sharedLibs || [])]) {
+    if (probes >= MAX_NODE_PROBES) {
+      break;
+    }
+    const srcFile = component?.properties?.find(
+      (property) => property.name === "internal:SrcFile",
+    )?.value;
+    if (!srcFile || !(isNodeBinaryName(srcFile) || isLibnode(srcFile))) {
+      continue;
+    }
+    if (packageStoreOf(srcFile)) {
+      continue;
+    }
+    probes += 1;
+    const build = readNodeBuildVersion(
+      join(basePath, srcFile.replace(/^\/+/, "")),
+      basePath,
+    );
+    if (build) {
+      attachNodeBuild(inventory, component, build);
+    }
+  }
+  return {
+    runtimeComponents: inventory.runtimeComponents,
+    dependencies: inventory.dependencies,
+  };
+}
+
+/**
+ * Read the Ruby build version of each unpackaged ruby executable and libruby
+ * shared library, add the cdx:ruby:* properties, and link the components to
+ * one platform component per distinct version. Mutates the components in
+ * place, as the PHP and Node.js collectors do.
+ *
+ * @param {Object[]} executables file components from `fileComponents(.., "executable")`
+ * @param {Object[]} sharedLibs file components from `fileComponents(.., "shared_library")`
+ * @param {string} basePath extracted rootfs the paths are relative to
+ * @returns {{runtimeComponents: Object[], dependencies: Object[]}}
+ */
+function collectRubyBuildInfo(executables, sharedLibs, basePath) {
+  const inventory = createRubyRuntimeInventory();
+  let probes = 0;
+  for (const component of [...(executables || []), ...(sharedLibs || [])]) {
+    if (probes >= MAX_RUBY_PROBES) {
+      break;
+    }
+    const srcFile = component?.properties?.find(
+      (property) => property.name === "internal:SrcFile",
+    )?.value;
+    if (!srcFile || !(isRubyBinaryName(srcFile) || isLibrubyName(srcFile))) {
+      continue;
+    }
+    if (packageStoreOf(srcFile)) {
+      continue;
+    }
+    probes += 1;
+    const build = readRubyBuildVersion(
+      join(basePath, srcFile.replace(/^\/+/, "")),
+      basePath,
+    );
+    if (build) {
+      attachRubyBuild(inventory, component, build);
+    }
+  }
+  return {
+    runtimeComponents: inventory.runtimeComponents,
+    dependencies: inventory.dependencies,
+  };
+}
+
+function isLibnode(srcFile) {
+  const name = basename(srcFile.replaceAll("\\", "/"));
+  return /^libnode\.so(\.\d+)*$/.test(name);
+}
+
+/**
+ * Probe unpackaged executables, shared libraries and native extension modules
+ * for a compiled-in Brotli decoder. Executables and libraries already have file
+ * components and are tagged in place; an extension module becomes a file
+ * component only when it carries a decoder, so the BOM does not grow by every
+ * extension in the image. Executables and libraries, and extension modules,
+ * each get MAX_BROTLI_PROBES files, and the scan reads at most
+ * MAX_BROTLI_PROBE_BYTES in all; what a cap leaves unread is logged and
+ * recorded as the binary.brotli-probe.capped degradation.
+ *
+ * @param {Object[]} executables file components from `fileComponents(.., "executable")`
+ * @param {Object[]} sharedLibs file components from `fileComponents(.., "shared_library")`
+ * @param {string} basePath extracted rootfs the paths are relative to
+ * @param {string[]} ownedFilePaths root-relative paths owned by OS packages
+ * @returns {Promise<{components: Object[], dependencies: Object[], extensionFiles: Object[]}>}
+ */
+async function collectBrotliDecoders(
+  executables,
+  sharedLibs,
+  basePath,
+  ownedFilePaths,
+) {
+  const inventory = createBrotliInventory();
+  let bytesRead = 0;
+  const unread = { files: 0, extensions: 0 };
+  const probe = (relativePath) => {
+    if (bytesRead >= MAX_BROTLI_PROBE_BYTES) {
+      return undefined;
+    }
+    const decoder = readBrotliDecoder(join(basePath, relativePath), basePath);
+    if (decoder && !decoder.skipped) {
+      bytesRead += decoder.size || 0;
+    }
+    return decoder;
+  };
+  let probes = 0;
+  const seenPaths = new Set();
+  for (const component of [...(executables || []), ...(sharedLibs || [])]) {
+    const srcFile = component?.properties?.find(
+      (property) => property.name === "internal:SrcFile",
+    )?.value;
+    if (!srcFile) {
+      continue;
+    }
+    const relativePath = srcFile.replaceAll("\\", "/").replace(/^\/+/, "");
+    seenPaths.add(relativePath);
+    if (packageStoreOf(relativePath)) {
+      continue;
+    }
+    if (probes >= MAX_BROTLI_PROBES || bytesRead >= MAX_BROTLI_PROBE_BYTES) {
+      unread.files += 1;
+      continue;
+    }
+    probes += 1;
+    const decoder = probe(relativePath);
+    if (decoder) {
+      attachBrotliDecoder(inventory, component, decoder);
+    }
+  }
+  const extensionHits = [];
+  let extensionProbes = 0;
+  for (const relativePath of collectNativeExtensions(basePath, [
+    ...(ownedFilePaths || []),
+    ...seenPaths,
+  ])) {
+    if (packageStoreOf(relativePath)) {
+      continue;
+    }
+    if (
+      extensionProbes >= MAX_BROTLI_PROBES ||
+      bytesRead >= MAX_BROTLI_PROBE_BYTES
+    ) {
+      unread.extensions += 1;
+      continue;
+    }
+    extensionProbes += 1;
+    const decoder = probe(relativePath);
+    if (decoder?.c || decoder?.go || decoder?.skipped) {
+      extensionHits.push({ relativePath, decoder });
+    }
+  }
+  if (unread.files || unread.extensions) {
+    const detail = `The Brotli decoder probe left ${unread.files} executable(s) or librar(ies) and ${unread.extensions} extension module(s) unread after reaching its file or byte cap, so an embedded decoder in them is not reported.`;
+    thoughtLog(detail);
+    recordDegradation("binary.brotli-probe.capped", {
+      ecosystem: "generic",
+      tool: "brotli-probe",
+      impact: "components",
+      path: basePath,
+      detail,
+    });
+  }
+  const extensionFiles = [];
+  if (extensionHits.length) {
+    const components = await fileComponents(
+      basePath,
+      extensionHits.map((hit) => hit.relativePath),
+      "shared_library",
+    );
+    for (let index = 0; index < components.length; index++) {
+      const component = components[index];
+      // Extension modules often share a basename (brotli.so is both a PHP and
+      // a Ruby extension), so the path keeps each one a component of its own.
+      const purl = tryBuildPurl({
+        type: "generic",
+        name: component.name,
+        subpath: extensionHits[index].relativePath,
+      });
+      if (purl) {
+        component.purl = purl;
+        component["bom-ref"] = purl;
+      }
+      attachBrotliDecoder(inventory, component, extensionHits[index].decoder);
+      extensionFiles.push(component);
+    }
+  }
+  return { ...finishBrotliInventory(inventory), extensionFiles };
+}
+
 async function fileComponents(basePath, fileList, fileType) {
   const hashResults = await mapWithConcurrency(fileList, (f) =>
     multiChecksumFile(["md5", "sha1"], join(basePath, f))