@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/stages/postgen/ruleEngine.js

@@ -165,7 +165,18 @@ function hasProperty(obj, propName, expectedValue) {
   if (expectedValue === undefined) {
     return value !== null;
   }
-  return value === String(expectedValue);
+  // A repeatable property (cdx:crypto:sourceType on a certificate found by
+  // several producers) matches when any of its values does.
+  return extractPropertyValues(obj, propName).includes(String(expectedValue));
+}
+
+function extractPropertyValues(obj, propName) {
+  if (!Array.isArray(obj?.properties)) {
+    return [];
+  }
+  return obj.properties
+    .filter((p) => p?.name === propName && p.value !== undefined)
+    .map((p) => String(p.value));
 }
 
 /**
@@ -315,6 +326,9 @@ function registerCdxHelpers(expression, helpers = {}) {
   expression.registerFunction("prop", (obj, propName) =>
     extractProperty(obj, propName),
   );
+  expression.registerFunction("propValues", (obj, propName) =>
+    extractPropertyValues(obj, propName),
+  );
   expression.registerFunction("nullSafeProp", (obj, propName) => {
     const value = extractProperty(obj, propName);
     return value === null ? "" : value;
@@ -385,6 +399,13 @@ function registerCdxHelpers(expression, helpers = {}) {
   expression.registerFunction("safeStr", (val) => {
     return val === null || val === undefined ? "" : String(val).trim();
   });
+  // End of validity in epoch milliseconds. A date-only value (2026-01-31)
+  // is valid through the end of that day in UTC; a full RFC 3339 timestamp
+  // is taken as is; anything else, or an impossible date, gives no value so
+  // the rule skips the component.
+  expression.registerFunction("certEndMillis", (val) =>
+    parseCertificateEndMillis(val),
+  );
   expression.registerFunction("parseSizeBytes", (val) => {
     if (val === null || val === undefined || val === "") {
       return null;
@@ -519,6 +540,42 @@ function registerCdxHelpers(expression, helpers = {}) {
  * @param {string} rulesDir - Path to directory containing .yaml rule files
  * @returns {Promise<Array>} Array of parsed rule objects
  */
+const FULL_TIMESTAMP_RE =
+  /^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])T([01]\d|2[0-3]):[0-5]\d:[0-5]\d(\.\d+)?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)$/;
+const DATE_ONLY_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
+
+/**
+ * Parse a certificate notValidAfter value.
+ *
+ * @param {*} value timestamp or date-only string
+ * @returns {number|undefined} epoch milliseconds, or undefined when the value
+ *   does not parse
+ */
+export function parseCertificateEndMillis(value) {
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const text = value.trim();
+  const dateOnly = DATE_ONLY_RE.exec(text);
+  if (dateOnly) {
+    const [year, month, day] = dateOnly.slice(1).map(Number);
+    const start = new Date(Date.UTC(year, month - 1, day));
+    if (
+      start.getUTCFullYear() !== year ||
+      start.getUTCMonth() !== month - 1 ||
+      start.getUTCDate() !== day
+    ) {
+      return undefined;
+    }
+    return start.getTime() + 24 * 60 * 60 * 1000 - 1;
+  }
+  if (!FULL_TIMESTAMP_RE.test(text)) {
+    return undefined;
+  }
+  const millis = Date.parse(text);
+  return Number.isNaN(millis) ? undefined : millis;
+}
+
 export async function loadRules(rulesDir) {
   const rules = [];
   if (!safeExistsSync(rulesDir)) {
@@ -615,16 +672,21 @@ async function interpolateTemplate(template, context, options = {}) {
     return template;
   }
   const templateRegex = /\{\{\s*([^}]+)\s*}}/g;
-  let result = template;
-  const matches = [...template.matchAll(templateRegex)];
-  for (const match of matches) {
+  // The template is rebuilt from its own slices in one pass, so a value taken
+  // from the BOM is never scanned for {{ }} again and never read as a
+  // String.replace pattern such as `$&`.
+  let result = "";
+  let cursor = 0;
+  for (const match of template.matchAll(templateRegex)) {
     const [fullMatch, expr] = match;
+    let replacement = fullMatch;
     try {
       const expression = jsonata(expr.trim());
       registerCdxHelpers(expression, options);
       const value = await safeEvaluate(expression, context);
-      const replacement = value !== undefined ? String(value) : fullMatch;
-      result = result.replace(fullMatch, replacement);
+      if (value !== undefined) {
+        replacement = String(value);
+      }
     } catch (err) {
       if (DEBUG_MODE) {
         console.warn(
@@ -633,7 +695,10 @@ async function interpolateTemplate(template, context, options = {}) {
         );
       }
     }
+    result += template.slice(cursor, match.index) + replacement;
+    cursor = match.index + fullMatch.length;
   }
+  result += template.slice(cursor);
   return result;
 }
 

package/lib/stages/postgen/specVersionCompat.js

@@ -604,9 +604,39 @@ function downgradeSubjectForSpecVersion(subject, specVersion, parentKey) {
       certificateProperties.certificateExtension =
         certificateProperties.certificateFileExtension;
     }
+    // `relatedCryptographicAssets` and `certificateExtensions` are 1.7-only;
+    // the deprecated `subjectPublicKeyRef`/`signatureAlgorithmRef` (valid in
+    // 1.6, see data/bom-1.6.schema.json) carry the same links, and the
+    // extension facts survive as `cdx:crypto:` properties.
+    const relatedAssets = certificateProperties.relatedCryptographicAssets;
+    if (Array.isArray(relatedAssets)) {
+      for (const asset of relatedAssets) {
+        if (
+          asset?.type === "publicKey" &&
+          !certificateProperties.subjectPublicKeyRef
+        ) {
+          certificateProperties.subjectPublicKeyRef = asset.ref;
+        } else if (
+          asset?.type === "algorithm" &&
+          !certificateProperties.signatureAlgorithmRef
+        ) {
+          certificateProperties.signatureAlgorithmRef = asset.ref;
+        }
+      }
+      delete certificateProperties.relatedCryptographicAssets;
+    }
+    delete certificateProperties.certificateExtensions;
     delete certificateProperties.serialNumber;
     delete certificateProperties.certificateFileExtension;
     delete certificateProperties.fingerprint;
+  } else if (
+    specVersion < 1.7 &&
+    subject.cryptoProperties?.assetType === "related-crypto-material" &&
+    subject.cryptoProperties.relatedCryptoMaterialProperties
+  ) {
+    // The public-key `fingerprint` object is 1.7-only; the SPKI digest stays
+    // available as the `cdx:crypto:spkiSha256` property.
+    delete subject.cryptoProperties.relatedCryptoMaterialProperties.fingerprint;
   }
   if (specVersion < 1.7 && subject.cryptoProperties?.algorithmProperties) {
     // `algorithmFamily` and `ellipticCurve` are CycloneDX 1.7 additions to

package/lib/stages/pregen/envAudit.js

@@ -110,6 +110,7 @@ const JVM_PROJECT_TYPES = new Set([
   "java24",
   "java25",
   "java26",
+  "java27",
   "jvm",
   "kt",
   "kotlin",

package/lib/stages/pregen/pregen.js

@@ -28,6 +28,15 @@ import {
   TIMEOUT_MS,
 } from "../../core/fs.js";
 import { isMac, isWin } from "../../core/paths.js";
+import { isProjectToolingAllowed } from "../../core/projectTooling.js";
+import { recordToolVersion } from "../../core/toolRegistry.js";
+import { collectProjectRubyDeclarations } from "../../ecosystems/rubyutils.js";
+import {
+  dosaiDotnetRequirement,
+  dosaiDotnetRequirementAdvice,
+  dosaiDotnetRequirementDetail,
+  markDosaiLaunchFailureReported,
+} from "../../inventory/dosai.js";
 import {
   bundleInstallWithDocker,
   collectJavaInfo,
@@ -38,6 +47,7 @@ import {
   installSdkmanTool,
   isNvmAvailable,
   isRbenvAvailable,
+  isRubyVersionActive,
   isSdkmanAvailable,
   isSdkmanToolAvailable,
   performBundleInstall,
@@ -58,8 +68,10 @@ import {
   readSbtBuildPropertiesVersion,
   readToolVersionEnvHint,
   readToolVersionOverride,
+  resolveGradleVersionForJava,
   resolvePartialVersion,
 } from "../../inventory/jvmToolEnv.js";
+import { resolvePluginBinary } from "../../inventory/plugins.js";
 import {
   classifyProbeResult,
   describeSpawnRestriction,
@@ -74,12 +86,20 @@ import {
  * @param {Object} options CLI options
  */
 export function prepareEnv(filePath, options) {
-  if (!options.projectType || isSecureMode) {
+  if (isSecureMode) {
     return;
   }
   if (filePath) {
     filePath = resolve(filePath);
   }
+  // Runs before the project type check: a .NET tree is also found when cdxgen
+  // detects the project types itself.
+  if (!isDryRun) {
+    prepareDotnetEnv(filePath, options);
+  }
+  if (!options.projectType) {
+    return;
+  }
   // The JVM preparation provisions the JDK ahead of the build tools, so an
   // alias it already installed must not be installed a second time here.
   // It runs under dry-run too, where it reports the toolchain it would set up
@@ -104,6 +124,91 @@ export function prepareEnv(filePath, options) {
   prepareRubyEnv(filePath, options);
 }
 
+/**
+ * Check that dosai, which deep runs use for .NET evidence, can start. The
+ * dosai bundled with cdxgen-plugins-bin is framework-dependent, so it needs a
+ * .NET runtime at least as new as the one it targets (.NET 11 from dosai
+ * 5.0.0). Running it lets the .NET host apply its own version rules. Skipped
+ * in the container images, which ship a dosai that works with their SDK, and
+ * when DOSAI_CMD names another build, such as the self-contained -full one.
+ *
+ * @param {String} filePath Project path
+ * @param {Object} options CLI options
+ */
+export function prepareDotnetEnv(filePath, options) {
+  if (
+    !options.deep ||
+    !filePath ||
+    readEnvironmentVariable("CDXGEN_IN_CONTAINER") === "true" ||
+    readEnvironmentVariable("DOSAI_CMD") ||
+    !isDotnetInScope(filePath, options)
+  ) {
+    return;
+  }
+  const dosaiBin = resolvePluginBinary("dosai");
+  if (!dosaiBin) {
+    // A missing plugin is reported where dosai runs
+    return;
+  }
+  const result = safeSpawnSync(dosaiBin, ["--version"], {
+    encoding: "utf-8",
+    timeout: TIMEOUT_MS,
+  });
+  if (result?.status === 0 && !result.error) {
+    return;
+  }
+  const output = commandOutputText(result) || "";
+  const requirement = dosaiDotnetRequirement(output);
+  const detail = requirement
+    ? dosaiDotnetRequirementDetail(requirement)
+    : "dosai could not start";
+  console.log(
+    `WARNING: ${detail}, so this deep run has no dosai evidence for .NET (call graph, reachability, crypto). ${dosaiDotnetRequirementAdvice(requirement)}`,
+  );
+  if (requirement) {
+    markDosaiLaunchFailureReported(dosaiBin);
+  }
+  recordLedgerEvent(LEDGER_EVENT_KINDS.EVIDENCE_DEGRADED, {
+    ecosystem: "csharp",
+    tool: "dosai",
+    detail: `${detail}; .NET evidence from dosai is unavailable.`,
+    impact: LEDGER_EVENT_IMPACTS.COMPONENTS,
+  });
+  deferFailOnError(options, {
+    ecosystem: "csharp",
+    tool: "dosai",
+    detail,
+    exitCode: typeof result?.status === "number" ? result.status : undefined,
+    command: `${dosaiBin} --version`,
+    outputExcerpt: output.trim() || undefined,
+  });
+}
+
+/**
+ * Whether the run covers .NET: a .NET project type, or, when cdxgen detects
+ * the types itself, a .NET project or solution file in the tree.
+ *
+ * @param {String} filePath Project path
+ * @param {Object} options CLI options
+ *
+ * @returns {Boolean}
+ */
+function isDotnetInScope(filePath, options) {
+  if (options.projectType?.length) {
+    return hasAnyProjectType(["csharp"], options, false);
+  }
+  if (!hasAnyProjectType(["csharp"], options, true)) {
+    return false;
+  }
+  return (
+    getAllFiles(
+      filePath,
+      `${options.multiProject ? "**/" : ""}*.{csproj,vbproj,fsproj,sln,slnx}`,
+      options,
+    ).length > 0
+  );
+}
+
 /**
  * Record the tool requirements the project declares through its well-known
  * tool pin files (`.tool-versions`, `.nvmrc`, `package.json`, `go.mod`, …),
@@ -215,6 +320,27 @@ const JVM_TOOL_DEFAULT_PREFIXES = {
   maven: "3.9",
 };
 
+/**
+ * JDK major a versioned java project type names, such as 27 for `java27`.
+ *
+ * @param {string} projectType Project type
+ * @returns {number|undefined} The major, or undefined for any other type
+ */
+export function javaMajorFromProjectType(projectType) {
+  if (typeof projectType !== "string" || !projectType.startsWith("java")) {
+    return undefined;
+  }
+  const major = Number.parseInt(projectType.slice(4), 10);
+  return Number.isInteger(major) && `java${major}` === projectType
+    ? major
+    : undefined;
+}
+
+/** Command each provisioned sdkman candidate is invoked as. */
+const JVM_TOOL_COMMANDS = {
+  maven: "mvn",
+};
+
 /** sdkman candidates cdxgen can provision for JVM builds. */
 const JVM_BUILD_TOOLS = ["maven", "gradle", "sbt", "scala"];
 
@@ -299,10 +425,26 @@ export function prepareJvmBuildEnv(filePath, options) {
     return;
   }
   // Resolve partial versions (e.g. maven3.9 -> 3.9.16) before touching the JDK
-  // so the compatibility matrix sees the real versions.
+  // so the compatibility matrix sees the real versions. The Gradle default
+  // install is constrained by the JDK the project declared or asked for, so a
+  // Java 27 project never gets a Gradle that cannot run on it.
+  // A versioned java type counts even without an sdkman alias: java27 has
+  // none until the broker serves a Java 27 build, but the project still asked
+  // for that JDK.
+  const explicitJavaMajor = Math.max(
+    0,
+    ...(options.projectType || []).map((pt) =>
+      SDKMAN_JAVA_TOOL_ALIASES[pt]
+        ? extractJavaMajor(SDKMAN_JAVA_TOOL_ALIASES[pt]) || 0
+        : javaMajorFromProjectType(pt) || 0,
+    ),
+  );
+  const gradleJavaMajor =
+    Math.max(detected.javaVersionHint || 0, explicitJavaMajor || 0) ||
+    undefined;
   const resolvedPins = [];
   for (const pin of installPins) {
-    const resolved = resolveJvmToolPinVersion(pin);
+    const resolved = resolveJvmToolPinVersion(pin, gradleJavaMajor);
     if (resolved) {
       resolvedPins.push(resolved);
     }
@@ -321,6 +463,11 @@ export function prepareJvmBuildEnv(filePath, options) {
     const installed = provisionJvmTool(pin, options);
     if (installed) {
       setJvmToolCommandEnv(pin);
+      if (pin.version) {
+        // The resolved version is already known, so metadata.tools can carry
+        // it without spawning another probe, once the tool runs (issue #598).
+        recordToolVersion(JVM_TOOL_COMMANDS[pin.tool] || pin.tool, pin.version);
+      }
       if (pin.source === "cli") {
         pinnedToolSelected = true;
       }
@@ -630,11 +777,14 @@ function recordDetectedJvmPins(installPins, wrapperVersions) {
  * and to pick defaults.
  *
  * @param {Object} pin `{ tool, version?, source }`
+ * @param {Number|undefined} javaMajor JDK major the project declared or
+ *   configured, when known. Constrains the default Gradle install so a
+ *   project on a new JDK never resolves a Gradle that cannot run on it.
  *
  * @returns {Object|undefined} Pin with an exact version, or undefined when no
  *   version could be determined.
  */
-export function resolveJvmToolPinVersion(pin) {
+export function resolveJvmToolPinVersion(pin, javaMajor) {
   if (pin.version && isSdkmanToolAvailable(pin.tool, pin.version)) {
     recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_RESOLVED, {
       ecosystem: "java",
@@ -665,20 +815,30 @@ export function resolveJvmToolPinVersion(pin) {
     return undefined;
   }
   const prefix = pin.version || JVM_TOOL_DEFAULT_PREFIXES[pin.tool] || "";
-  const resolved = resolvePartialVersion(versionList, prefix);
+  const resolved =
+    pin.tool === "gradle" && !pin.version
+      ? resolveGradleVersionForJava(versionList, javaMajor)
+      : resolvePartialVersion(versionList, prefix);
   if (!resolved) {
     if (pin.version) {
       return pin;
     }
+    const gradleMinimum =
+      pin.tool === "gradle"
+        ? minimumGradleVersionForJava(javaMajor)
+        : undefined;
+    const missingDetail = gradleMinimum
+      ? `No stable gradle version at or above ${gradleMinimum}, the first that runs on Java ${javaMajor}, is listed by sdkman.`
+      : `No stable ${pin.tool} version matched the default prefix '${prefix}'.`;
     recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_MISSING, {
       ecosystem: "java",
       tool: pin.tool,
-      wanted: prefix,
+      wanted: gradleMinimum ? `>=${gradleMinimum}` : prefix,
       source: "sdkman",
-      detail: `No stable ${pin.tool} version matched the default prefix '${prefix}'.`,
+      detail: missingDetail,
     });
     console.log(
-      `No stable ${pin.tool} version matched the default prefix '${prefix}'. Pass an exact version identifier via -t ${pin.tool}<version>.`,
+      `${missingDetail} Pass an exact version identifier via -t ${pin.tool}<version>.`,
     );
     return undefined;
   }
@@ -1205,7 +1365,7 @@ export function prepareNodeEnv(filePath, options) {
             }
           }
           if (nvmNodePath) {
-            doNpmInstall(filePath, nvmNodePath);
+            doNpmInstall(filePath, nvmNodePath, options);
             npmInstallAttempted = true;
           } else {
             console.log(
@@ -1228,7 +1388,7 @@ export function prepareNodeEnv(filePath, options) {
         );
         continue;
       }
-      doNpmInstall(filePath, nvmNodePath);
+      doNpmInstall(filePath, nvmNodePath, options);
       npmInstallAttempted = true;
     }
   }
@@ -1302,12 +1462,18 @@ export function tryLoadNvmAndInstallTool(nodeVersion) {
  *
  * @param {String} filePath Path
  * @param {String} nvmNodePath Path to node version in nvm
+ * @param {Object} [options] CLI options
  */
-export function doNpmInstall(filePath, nvmNodePath) {
+export function doNpmInstall(filePath, nvmNodePath, options = {}) {
   // we do not install if INSTALL_ARGS set false
   if (["0", "false"].includes(readEnvironmentVariable("NODE_INSTALL_ARGS"))) {
     return;
   }
+  // npm install runs the project's own lifecycle scripts, such as preinstall,
+  // even with --package-lock-only.
+  if (options.installDeps === false) {
+    return;
+  }
   const newPath = `${nvmNodePath}${delimiter}${readEnvironmentVariable("PATH")}`;
   let installArgs =
     readEnvironmentVariable("NPM_INSTALL_ARGS") || "--package-lock-only";
@@ -1386,7 +1552,12 @@ export function prepareSwiftEnv(filePath, options) {
       "INFO: Swift for Linux has known issues on non x64 machines. Run the cdxgen container image with --platform=linux/amd64 for best experience.",
     );
   }
-  if (options.deep || options?.lifecycle?.includes("post-build")) {
+  // `swift package resolve` runs the project's Package.swift, so it waits for
+  // the same permission as the scan's other project tooling.
+  if (
+    (options.deep || options?.lifecycle?.includes("post-build")) &&
+    isProjectToolingAllowed(options)
+  ) {
     const swiftFiles = getAllFiles(
       filePath,
       `${options.multiProject ? "**/" : ""}Package*.swift`,
@@ -1470,6 +1641,17 @@ export function prepareSwiftEnv(filePath, options) {
  * @param {String} filePath Path
  * @param {Object} options CLI Options
  */
+// The order pregen reads the Ruby to install in.
+const PREGEN_RUBY_SOURCE_ORDER = [
+  ".ruby-version",
+  ".tool-versions",
+  "mise.toml",
+  ".mise.toml",
+  ".config/mise.toml",
+  "Gemfile.lock",
+  "Gemfile",
+];
+
 export function prepareRubyEnv(filePath, options) {
   // Skip preparation early
   if (
@@ -1515,53 +1697,39 @@ export function prepareRubyEnv(filePath, options) {
     readEnvironmentVariable("GEM_HOME") ||
     safeMkdtempSync(join(getTmpDir(), "cdxgen-gem-home-"));
   process.env.CDXGEN_GEM_HOME = cdxgenGemHome;
-  // Is there a .ruby-version file in the project?
-  if (safeExistsSync(join(filePath, ".ruby-version"))) {
-    rubyVersionNeeded = readFileSync(join(filePath, ".ruby-version"), {
-      encoding: "utf-8",
-    })
-      .trim()
-      .replace("ruby-", "");
-    if (rubyVersionNeeded) {
-      recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_EXPECTED, {
-        ecosystem: "ruby",
-        tool: "ruby",
-        wanted: rubyVersionNeeded,
-        source: ".ruby-version",
-        path: join(filePath, ".ruby-version"),
-      });
-    }
-  } else if (safeExistsSync(join(filePath, "Gemfile.lock"))) {
-    // Is there a lock file that can be used to identify the needed Ruby version?
+  // The Ruby to install is the one developers select: .ruby-version, then the
+  // asdf and mise pins, then the Ruby the lockfile was resolved with, then the
+  // Gemfile directive. Only an exact MRI version can be installed with rbenv.
+  const declarations = collectProjectRubyDeclarations(filePath);
+  for (const declaration of declarations) {
+    recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_EXPECTED, {
+      ecosystem: "ruby",
+      tool: declaration.engine === "ruby" ? "ruby" : declaration.engine,
+      wanted: declaration.version || declaration.requirement,
+      source: declaration.source,
+      path: declaration.path,
+    });
+  }
+  const installable = PREGEN_RUBY_SOURCE_ORDER.map((source) =>
+    declarations.find(
+      (declaration) => declaration.source === source && declaration.version,
+    ),
+  ).find(Boolean);
+  if (installable && installable.engine !== "ruby") {
+    console.log(
+      `This project selects ${installable.engine} ${installable.version} (${installable.source}). cdxgen installs only MRI Ruby with rbenv; build the project with ${installable.engine} first and then invoke cdxgen with the arguments "--lifecycle pre-build".`,
+    );
+  } else if (installable?.prerelease) {
+    console.log(
+      `This project was locked with a pre-release of Ruby ${installable.version}, whose tag the lockfile does not record. Install it before invoking cdxgen.`,
+    );
+  } else if (installable) {
+    rubyVersionNeeded = installable.version;
+  }
+  if (safeExistsSync(join(filePath, "Gemfile.lock"))) {
     const gemlockData = readFileSync(join(filePath, "Gemfile.lock"), {
       encoding: "utf-8",
     });
-    let rubyVersionMarker = false;
-    for (let l of gemlockData.split("\n")) {
-      l = l.replaceAll("\r", "").trim();
-      if (l.includes("RUBY VERSION")) {
-        rubyVersionMarker = true;
-      }
-      if (rubyVersionMarker && l.includes("ruby ")) {
-        const possibleVersion = l
-          .split("ruby ")
-          .pop()
-          .split("p")[0]
-          .split("d")[0];
-        if (/^\d+/.test(possibleVersion)) {
-          rubyVersionNeeded = possibleVersion;
-          break;
-        }
-      }
-    }
-    if (rubyVersionNeeded) {
-      recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_EXPECTED, {
-        ecosystem: "ruby",
-        tool: "ruby",
-        wanted: rubyVersionNeeded,
-        source: "Gemfile.lock",
-      });
-    }
     const bundlerVersion = parseGemfileLockBundlerVersion(gemlockData);
     if (bundlerVersion) {
       recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_EXPECTED, {
@@ -1571,7 +1739,8 @@ export function prepareRubyEnv(filePath, options) {
         source: "Gemfile.lock",
       });
     }
-  } else {
+  }
+  if (!installable) {
     // Is the user invoking with a ruby with custom version type. Eg: -t ruby2.5.4
     let projectTypes = options.projectType;
     if (
@@ -1604,13 +1773,13 @@ export function prepareRubyEnv(filePath, options) {
   const existingRuby = collectRubyInfo(filePath);
   if (
     rubyVersionNeeded &&
-    existingRuby?.version?.startsWith(`ruby ${rubyVersionNeeded} `)
+    isRubyVersionActive(existingRuby, rubyVersionNeeded)
   ) {
     recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_RESOLVED, {
       ecosystem: "ruby",
       tool: "ruby",
       wanted: rubyVersionNeeded,
-      found: existingRuby.version,
+      found: existingRuby.description || existingRuby.version,
       source: "env",
       detail: `The active interpreter is the required Ruby ${rubyVersionNeeded}.`,
     });
@@ -1642,15 +1811,15 @@ export function prepareRubyEnv(filePath, options) {
     });
   } else if (
     rubyVersionNeeded &&
-    !existingRuby.version.startsWith(`ruby ${rubyVersionNeeded} `)
+    !isRubyVersionActive(existingRuby, rubyVersionNeeded)
   ) {
     recordLedgerEvent(LEDGER_EVENT_KINDS.TOOL_MISMATCH, {
       ecosystem: "ruby",
       tool: "ruby",
       wanted: rubyVersionNeeded,
-      found: existingRuby.version,
+      found: existingRuby.description || existingRuby.version,
       source: "env",
-      detail: `Ruby ${rubyVersionNeeded} is required and the active interpreter reports ${existingRuby.version}.`,
+      detail: `Ruby ${rubyVersionNeeded} is required and the active interpreter reports ${existingRuby.description || existingRuby.version}.`,
     });
   }
   if (rubyVersionNeeded && !rbenvPresent) {