@cdxgen/cdxgen 13.5.0 → 13.6.0

package/lib/inventory/dotnetRuntime.js

@@ -0,0 +1,217 @@
+// Bounded reader for the .NET shared frameworks installed in a root file
+// system.
+//
+// The .NET Docker images, dotnet-install.sh and the tarballs put the runtime
+// under <dotnet root>/shared/<framework>/<version>/ without a package manager,
+// so a BOM sees only its files. Each framework directory carries a
+// <framework>.deps.json whose runtime target names the runtime pack it was
+// built from, e.g. `Microsoft.NETCore.App.Runtime.linux-arm64/8.0.32`. That pack
+// is a NuGet package, and it is the identity .NET security advisories list, so
+// it becomes the component's purl.
+// https://learn.microsoft.com/dotnet/core/dependency-loading/default-probing#how-are-the-properties-populated
+
+import { closeSync, readSync } from "node:fs";
+import { join } from "node:path";
+
+import { globSync } from "glob";
+
+import { openRegularFile } from "../core/boundedFile.js";
+import { applyPurl, tryBuildPurl } from "./purl.js";
+
+const MAX_DEPS_JSON_BYTES = 8 * 1024 * 1024;
+const MAX_FRAMEWORKS = 64;
+const FRAMEWORKS = new Set([
+  "Microsoft.NETCore.App",
+  "Microsoft.AspNetCore.App",
+  "Microsoft.WindowsDesktop.App",
+]);
+// Where the .NET images, dotnet-install.sh, the tarballs and the distro
+// packages put the dotnet root.
+const DOTNET_ROOTS = [
+  "usr/share/dotnet",
+  "usr/lib/dotnet",
+  "usr/lib64/dotnet",
+  "usr/local/share/dotnet",
+  "opt/dotnet",
+  "root/.dotnet",
+  "home/*/.dotnet",
+];
+const RUNTIME_PACK_RE =
+  /^(Microsoft\.[A-Za-z]+(?:\.[A-Za-z]+)*\.App\.Runtime\.[A-Za-z0-9.-]+)\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/;
+
+function readJsonBounded(absPath, rootDir) {
+  const opened = openRegularFile(absPath, rootDir);
+  if (!opened) {
+    return undefined;
+  }
+  try {
+    if (opened.size <= 0 || opened.size > MAX_DEPS_JSON_BYTES) {
+      return undefined;
+    }
+    const buffer = Buffer.allocUnsafe(opened.size);
+    const read = readSync(opened.fd, buffer, 0, opened.size, 0);
+    return JSON.parse(buffer.toString("utf8", 0, read));
+  } catch {
+    return undefined;
+  } finally {
+    try {
+      closeSync(opened.fd);
+    } catch {
+      // already closed
+    }
+  }
+}
+
+/**
+ * Read the runtime pack a shared framework's deps.json was built from.
+ *
+ * @param {Object} depsJson parsed <framework>.deps.json
+ * @param {string} framework framework directory name
+ * @returns {{pack: string, version: string, rid: string}|undefined}
+ */
+export function runtimePackFromDepsJson(depsJson, framework) {
+  const targetName = depsJson?.runtimeTarget?.name;
+  if (typeof targetName !== "string") {
+    return undefined;
+  }
+  const target = depsJson?.targets?.[targetName];
+  if (!target || typeof target !== "object") {
+    return undefined;
+  }
+  for (const key of Object.keys(target)) {
+    const match = RUNTIME_PACK_RE.exec(key);
+    if (!match?.[1].startsWith(`${framework}.Runtime.`)) {
+      continue;
+    }
+    return {
+      pack: match[1],
+      version: match[2],
+      rid: match[1].slice(`${framework}.Runtime.`.length),
+    };
+  }
+  return undefined;
+}
+
+/**
+ * The CPE NVD uses for a shared framework version: `.net` from 5.0 on,
+ * `.net_core` before it, and `asp.net_core` for ASP.NET Core.
+ *
+ * @param {string} framework framework directory name
+ * @param {string} version runtime version
+ * @returns {string|undefined} CPE 2.3 string
+ */
+export function dotnetCpe(framework, version) {
+  const base = /^(\d+)\.\d+\.\d+/.exec(version || "");
+  if (!base) {
+    return undefined;
+  }
+  const plain = base[0];
+  if (framework === "Microsoft.AspNetCore.App") {
+    return `cpe:2.3:a:microsoft:asp.net_core:${plain}:*:*:*:*:*:*:*`;
+  }
+  if (framework === "Microsoft.NETCore.App") {
+    const product = Number(base[1]) >= 5 ? ".net" : ".net_core";
+    return `cpe:2.3:a:microsoft:${product}:${plain}:*:*:*:*:*:*:*`;
+  }
+  return undefined;
+}
+
+/**
+ * Create the platform component for one installed shared framework.
+ *
+ * @param {string} framework framework directory name
+ * @param {{pack: string, version: string, rid: string}} runtime runtime pack
+ * @param {string} location root-relative path of the deps.json
+ * @returns {Object|undefined} component, or undefined when no purl can be built
+ */
+export function createDotnetRuntimeComponent(framework, runtime, location) {
+  const component = {
+    type: "platform",
+    name: runtime.pack,
+    version: runtime.version,
+    properties: [
+      { name: "cdx:dotnet:sharedFramework", value: framework },
+      { name: "cdx:dotnet:runtimeIdentifier", value: runtime.rid },
+    ],
+    evidence: {
+      occurrences: [{ location: `/${location.replace(/^\/+/, "")}` }],
+    },
+  };
+  const cpe = dotnetCpe(framework, runtime.version);
+  if (cpe) {
+    component.cpe = cpe;
+  }
+  const purl = tryBuildPurl({
+    type: "nuget",
+    name: runtime.pack,
+    version: runtime.version,
+  });
+  if (!purl) {
+    return undefined;
+  }
+  return applyPurl(component, purl);
+}
+
+/**
+ * Find the .NET shared frameworks installed under a root that no package
+ * manager owns, and return one platform component per runtime pack.
+ *
+ * @param {string} rootDir extracted root file system
+ * @param {string[]} [ownedPaths] root-relative paths a package database owns
+ * @returns {Object[]} platform components
+ */
+export function collectDotnetRuntimes(rootDir, ownedPaths = []) {
+  if (!rootDir) {
+    return [];
+  }
+  const owned = new Set(
+    (ownedPaths || []).map((p) => p.replace(/^\/+/, "").replaceAll("\\", "/")),
+  );
+  let depsFiles = [];
+  try {
+    depsFiles = globSync(
+      DOTNET_ROOTS.map((root) => `${root}/shared/*/*/*.deps.json`),
+      {
+        cwd: rootDir,
+        absolute: false,
+        nodir: true,
+        dot: true,
+        follow: false,
+      },
+    )
+      .map((file) => file.replaceAll("\\", "/"))
+      .sort();
+  } catch {
+    return [];
+  }
+  const components = [];
+  const seen = new Set();
+  for (const file of depsFiles.slice(0, MAX_FRAMEWORKS)) {
+    if (owned.has(file)) {
+      continue;
+    }
+    const parts = file.split("/");
+    const framework = parts[parts.length - 3];
+    if (
+      !FRAMEWORKS.has(framework) ||
+      parts.at(-1) !== `${framework}.deps.json`
+    ) {
+      continue;
+    }
+    const runtime = runtimePackFromDepsJson(
+      readJsonBounded(join(rootDir, file), rootDir),
+      framework,
+    );
+    // The directory a runtime lives in is named after its version.
+    if (!runtime || runtime.version !== parts[parts.length - 2]) {
+      continue;
+    }
+    const component = createDotnetRuntimeComponent(framework, runtime, file);
+    if (!component || seen.has(component["bom-ref"])) {
+      continue;
+    }
+    seen.add(component["bom-ref"]);
+    components.push(component);
+  }
+  return components;
+}

package/lib/inventory/envcontext.js

@@ -1,6 +1,6 @@
-import { readFileSync } from "node:fs";
+import { readFileSync, realpathSync, statSync } from "node:fs";
 import { arch, homedir } from "node:os";
-import { basename, delimiter, dirname, join } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join } from "node:path";
 import process from "node:process";
 
 import { compareLoose } from "semver";
@@ -19,10 +19,12 @@ import {
   recordLedgerEvent,
 } from "../core/buildLedger.js";
 import {
+  BUNDLE_CMD,
   CARGO_CMD,
   COMPOSER_CMD,
   DOTNET_CMD,
   GCC_CMD,
+  GEM_CMD,
   GO_CMD,
   getJavaCommand,
   getPythonCommand,
@@ -44,12 +46,19 @@ import {
 import { diagnosticStream } from "../core/logger.js";
 import { dirNameStr, isMac, isWin } from "../core/paths.js";
 import { isProjectToolingAllowed } from "../core/projectTooling.js";
+import { brotliDecoderProperties, readBrotliDecoder } from "./brotliDecoder.js";
 import { isValidSdkmanVersion } from "./jvmToolEnv.js";
+import { createNodeRuntimeComponent } from "./nodeBuildInfo.js";
 import {
   createPhpRuntimeComponent,
+  packageStoreOf,
   parsePhpReportedVersion,
 } from "./phpBuildInfo.js";
 import { applyPurl, tryBuildPurl } from "./purl.js";
+import {
+  createRubyRuntimeComponent,
+  parseRubyDescription,
+} from "./rubyBuildInfo.js";
 import {
   classifySpawnRestriction,
   describeSpawnRestriction,
@@ -137,6 +146,11 @@ export const SDKMAN_JAVA_TOOL_ALIASES = {
   java24: readEnvironmentVariable("JAVA24_TOOL") || "24.0.2-tem",
   java25: readEnvironmentVariable("JAVA25_TOOL") || "25.0.4-tem",
   java26: readEnvironmentVariable("JAVA26_TOOL") || "26.0.2-tem",
+  // The broker serves no Java 27 build yet (every vendor id 404s), so java27
+  // has an alias only when JAVA27_TOOL names one that is downloadable.
+  ...(readEnvironmentVariable("JAVA27_TOOL")
+    ? { java27: readEnvironmentVariable("JAVA27_TOOL") }
+    : {}),
 };
 
 /**
@@ -486,6 +500,16 @@ export function collectNodeInfo(dir) {
     version: runtimeInfo.version,
     components: runtimeInfo.components,
   };
+  if (runtimeInfo.runtime === "Node.js" && runtimeInfo.version) {
+    // The same identity a scanned image's Node.js gets, without a bom-ref, as
+    // for the other toolchains.
+    const runtime = formulationToolchain(
+      createNodeRuntimeComponent(runtimeInfo.version),
+    );
+    nodeInfo.purl = runtime.purl;
+    nodeInfo.cpe = runtime.cpe;
+    annotateNodeBrotli(nodeInfo.components);
+  }
   const moduleDesc = getCommandOutput(NPM_CMD, dir, ["--version"]);
   if (moduleDesc) {
     nodeInfo.description = `npm: ${moduleDesc}`;
@@ -496,6 +520,36 @@ export function collectNodeInfo(dir) {
   return nodeInfo;
 }
 
+/**
+ * Record whether the Brotli decoder the running Node.js uses carries the
+ * CVE-2026-111497 fix. process.versions.brotli cannot say: Node.js backports
+ * the fix without changing it. The decoder is read where it lives, in the node
+ * binary or in the shared libbrotlidec a `--shared-brotli` build loads.
+ *
+ * @param {Object[]|undefined} components bundled components of the runtime
+ */
+function annotateNodeBrotli(components) {
+  const brotli = (components || []).find(
+    (component) => component.name === "brotli",
+  );
+  if (!brotli) {
+    return;
+  }
+  let decoderFile = globalThis.process?.execPath;
+  if (nodeComponentLinkage("brotli") === "shared") {
+    decoderFile = (
+      globalThis.process?.report?.getReport?.()?.sharedObjects || []
+    ).find((path) => basename(path).startsWith("libbrotlidec"));
+  }
+  const decoder = decoderFile ? readBrotliDecoder(decoderFile) : undefined;
+  if (decoder) {
+    brotli.properties = [
+      ...(brotli.properties || []),
+      ...brotliDecoderProperties(decoder),
+    ];
+  }
+}
+
 /**
  * Collect gcc version
  *
@@ -585,23 +639,215 @@ export function collectSwiftInfo(dir) {
 }
 
 /**
- * Collect Ruby version
+ * The real path of the executable a command name runs, looked up on PATH as
+ * the shell would, or undefined when it cannot be found.
+ *
+ * @param {string} command command name or path
+ * @returns {string|undefined}
+ */
+function resolveExecutable(command) {
+  const name = `${command || ""}`.trim().split(" ")[0];
+  if (!name) {
+    return undefined;
+  }
+  const extensions = isWin
+    ? ["", ...`${process.env.PATHEXT || ".EXE;.CMD;.BAT"}`.split(";")]
+    : [""];
+  const directories = isAbsolute(name)
+    ? [dirname(name)]
+    : `${process.env.PATH || ""}`.split(delimiter).filter(Boolean);
+  const base = isAbsolute(name) ? basename(name) : name;
+  for (const directory of directories) {
+    for (const extension of extensions) {
+      const candidate = join(directory, `${base}${extension}`);
+      try {
+        if (statSync(candidate).isFile()) {
+          return realpathSync(candidate);
+        }
+      } catch {
+        // not here
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Whether a Ruby executable is one the operating system or a package manager
+ * that patches it owns. Distros backport fixes under the old upstream version,
+ * so its version must not be matched against upstream advisories by CPE.
+ *
+ * @param {string|undefined} realPath real path of the executable
+ * @returns {boolean}
+ */
+export function isPackagedRubyPath(realPath) {
+  if (!realPath || isWin) {
+    return false;
+  }
+  // Homebrew builds the upstream release, so it keeps the CPE, as it does in
+  // an OBOM; Nix and Guix patch theirs.
+  const store = packageStoreOf(realPath);
+  if (store) {
+    return store !== "homebrew";
+  }
+  return ["/usr/bin/", "/bin/", "/usr/lib/", "/usr/libexec/", "/System/"].some(
+    (prefix) => realPath.startsWith(prefix),
+  );
+}
+
+// The shims of rbenv, asdf and mise run whichever Ruby is selected, which can
+// be the distro's (`rbenv global system`).
+function isVersionManagerShim(realPath) {
+  return `${realPath}`.split(/[\\/]/).includes("shims");
+}
+
+// Whether the Ruby `ruby --version` described may carry its release's CPE.
+// A shim is followed to the interpreter it runs; one that cannot be followed
+// keeps no CPE, since it may be the distro's.
+function rubyKeepsCpe(dir) {
+  let executable = resolveExecutable(RUBY_CMD);
+  if (executable && isVersionManagerShim(executable)) {
+    const target = isWin
+      ? ""
+      : firstOutputLine(
+          getCommandOutput(RUBY_CMD, dir, ["-e", "print RbConfig.ruby"]),
+        );
+    if (!isAbsolute(target)) {
+      return false;
+    }
+    try {
+      executable = realpathSync(target);
+    } catch {
+      executable = target;
+    }
+  }
+  return !isPackagedRubyPath(executable);
+}
+
+/**
+ * Collect the Ruby on the PATH.
+ *
+ * `ruby --version` prints the interpreter's description, such as
+ * `ruby 3.3.6 (2024-11-05 revision 75015d4c1f) [x86_64-linux]`, which is kept
+ * as the component description. The identity is `pkg:generic/ruby@3.3.6`
+ * (or jruby, truffleruby), with the CPE of the release unless a package
+ * manager owns the executable: a distro backports fixes under the old upstream
+ * version.
  *
  * @param {string} dir Working directory
  * @returns Object containing Ruby details
  */
 export function collectRubyInfo(dir) {
   const versionDesc = getCommandOutput(RUBY_CMD, dir, ["--version"]);
-  if (versionDesc) {
-    const info = {
-      type: "platform",
-      name: "ruby",
-      version: versionDesc.trim(),
-    };
-    recordToolProbeResolved("ruby", "ruby", info.version);
+  const banner = firstOutputLine(versionDesc);
+  const parsed = parseRubyDescription(banner);
+  if (parsed) {
+    const info = formulationToolchain(
+      createRubyRuntimeComponent(parsed.version, {
+        engine: parsed.engine,
+        withCpe: rubyKeepsCpe(dir),
+      }),
+    );
+    info.description = banner;
+    const properties = [];
+    if (parsed.patchlevel !== undefined) {
+      properties.push({
+        name: "cdx:ruby:patchlevel",
+        value: parsed.patchlevel,
+      });
+    }
+    if (parsed.rubyVersion) {
+      properties.push({
+        name: "cdx:ruby:languageVersion",
+        value: parsed.rubyVersion,
+      });
+    }
+    if (parsed.platform) {
+      properties.push({ name: "cdx:ruby:platform", value: parsed.platform });
+    }
+    if (properties.length) {
+      info.properties = properties;
+    }
+    recordToolProbeResolved("ruby", "ruby", banner);
     return info;
   }
-  recordToolProbeFailure("ruby", "ruby", RUBY_CMD);
+  recordToolProbeFailure(
+    "ruby",
+    "ruby",
+    RUBY_CMD,
+    versionDesc
+      ? "The ruby version probe did not print a Ruby version banner."
+      : undefined,
+  );
+  return undefined;
+}
+
+/**
+ * Whether the Ruby collectRubyInfo found is the MRI release a project needs.
+ *
+ * @param {Object|undefined} info result of collectRubyInfo
+ * @param {string} version wanted MRI version
+ * @returns {boolean}
+ */
+export function isRubyVersionActive(info, version) {
+  return Boolean(info && info.name === "ruby" && info.version === version);
+}
+
+/**
+ * Collect the RubyGems version. `gem --version` prints the bare version.
+ *
+ * @param {string} dir Working directory
+ * @returns {Object|undefined} the RubyGems component
+ */
+export function collectRubyGemsInfo(dir) {
+  const token = firstOutputLine(getCommandOutput(GEM_CMD, dir, ["--version"]));
+  if (/^\d+\.\d+\.\d+$/.test(token)) {
+    recordToolProbeResolved("gem", "ruby", token);
+    return formulationToolchain(
+      applyPurl(
+        {
+          type: "platform",
+          name: "rubygems",
+          version: token,
+          cpe: `cpe:2.3:a:rubygems:rubygems:${token}:*:*:*:*:*:*:*`,
+        },
+        tryBuildPurl({ type: "generic", name: "rubygems", version: token }),
+      ),
+    );
+  }
+  recordToolProbeFailure("gem", "ruby", GEM_CMD);
+  return undefined;
+}
+
+/**
+ * Collect the Bundler version. `bundle --version` prints `Bundler version
+ * 2.5.22`, or the bare version from Bundler 2.6 on.
+ *
+ * @param {string} dir Working directory
+ * @returns {Object|undefined} the Bundler component
+ */
+export function collectBundlerInfo(dir) {
+  const line = firstOutputLine(
+    getCommandOutput(BUNDLE_CMD, dir, ["--version"]),
+  );
+  const token = line.startsWith("Bundler version ")
+    ? line.slice("Bundler version ".length).trim()
+    : line;
+  if (/^\d+\.\d+\.\d+$/.test(token)) {
+    recordToolProbeResolved("bundler", "ruby", token);
+    return formulationToolchain(
+      applyPurl(
+        {
+          type: "platform",
+          name: "bundler",
+          version: token,
+          cpe: `cpe:2.3:a:bundler:bundler:${token}:*:*:*:*:*:*:*`,
+        },
+        tryBuildPurl({ type: "gem", name: "bundler", version: token }),
+      ),
+    );
+  }
+  recordToolProbeFailure("bundler", "ruby", BUNDLE_CMD);
   return undefined;
 }
 
@@ -787,6 +1033,14 @@ export function collectEnvInfo(dir, options = undefined) {
   cmp = collectRubyInfo(dir);
   if (cmp) {
     infoComponents.push(cmp);
+    cmp = collectRubyGemsInfo(dir);
+    if (cmp) {
+      infoComponents.push(cmp);
+    }
+    cmp = collectBundlerInfo(dir);
+    if (cmp) {
+      infoComponents.push(cmp);
+    }
   }
   cmp = collectPhpInfo(dir);
   if (cmp) {
@@ -1218,7 +1472,7 @@ export function installRubyVersion(rubyVersion, filePath) {
     return { fullToolBinDir: undefined, status: false };
   }
   const existingRuby = collectRubyInfo(filePath);
-  if (existingRuby?.version?.startsWith(`ruby ${rubyVersion} `)) {
+  if (isRubyVersionActive(existingRuby, rubyVersion)) {
     return { fullToolBinDir: undefined, status: true };
   }
   const fullToolBinDir = rubyVersionDir(rubyVersion);
@@ -1984,6 +2238,36 @@ export function gitRevertsAndHotfixes(dir, maxCount = 20) {
   return entries;
 }
 
+// process.versions keys whose configure flag is named differently.
+const NODE_SHARED_FLAG_NAMES = {
+  ares: "cares",
+  libffi: "ffi",
+  llhttp: "http_parser",
+  uv: "libuv",
+};
+
+/**
+ * Whether the running Node.js links a bundled dependency as a shared library,
+ * from the `node_shared_<name>` configure variables it reports.
+ *
+ * @param {string} name key of process.versions
+ * @param {Object} [variables] configure variables, process.config.variables
+ *   by default
+ * @returns {string|undefined} `shared`, `bundled`, or undefined when the build
+ *   does not say
+ */
+export function nodeComponentLinkage(
+  name,
+  variables = globalThis.process?.config?.variables,
+) {
+  const flag = `node_shared_${NODE_SHARED_FLAG_NAMES[name] || name}`;
+  if (!variables || !(flag in variables)) {
+    return undefined;
+  }
+  const value = variables[flag];
+  return value === true || value === "true" ? "shared" : "bundled";
+}
+
 /**
  * Get information about the runtime.
  *
@@ -2016,12 +2300,22 @@ export function getRuntimeInformation() {
           name,
           version: version || null,
         });
+        // A distro or Homebrew build links some of these as shared libraries
+        // (`configure --shared-brotli`); the version is then the shared
+        // library's, and updating Node.js alone does not update it.
+        const linkage = nodeComponentLinkage(name);
         const apkg = {
           name,
           version,
-          description: `Bundled with Node.js ${runtimeInfo.version}`,
+          description:
+            linkage === "shared"
+              ? `Linked by Node.js ${runtimeInfo.version} as a shared library`
+              : `Bundled with Node.js ${runtimeInfo.version}`,
           type: "library",
           scope: "excluded",
+          ...(linkage
+            ? { properties: [{ name: "cdx:node:linkage", value: linkage }] }
+            : {}),
         };
         applyPurl(apkg, bundledPurl);
         if (nodeSourceUrl) {

package/lib/inventory/evidenceUtils.js

@@ -6,6 +6,7 @@ import { build } from "@cdxgen/cdx-purl";
 import { safeExistsSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { sanitizeBomUrl } from "../core/propertySanitizer.js";
+import { vscodeExtensionPlatformFromPath } from "../parsers/vscodeExtensionId.js";
 import { isAgentSkillSpecValid } from "./agentSkillSpec.js";
 import {
   addDosaiReachabilityProperties,
@@ -619,6 +620,13 @@ export function convertOSQueryResults(
         // The profile an add-on was found in is not part of its purl, so the
         // add-on ID is what tells apart two add-ons that share a name.
         qualifiers = { tag_id: firefoxAddonTagId(res.identifier) };
+      } else if (queryObj.purlType === "vscode-extension") {
+        // A platform-specific build is a different artefact from the one for
+        // another platform, and the extension scan names it the same way.
+        const targetPlatform = vscodeExtensionPlatformFromPath(res.path);
+        if (targetPlatform) {
+          qualifiers = { platform: targetPlatform };
+        }
       }
       if (name) {
         name = sanitizeOsQueryIdentity(name);
@@ -788,11 +796,14 @@ export function convertOSQueryResults(
 // profile. Where it was found is not part of what it is, so the path is an
 // occurrence rather than a subpath: a home directory stays out of the purl, and
 // one package installed in two places is one component with two occurrences.
+// Chocolatey rows carry the absolute path of the package's .nuspec, which a
+// purl subpath cannot hold, so it is kept as an occurrence like these.
 const LOCATED_PACKAGE_PURL_TYPES = new Set([
   "npm",
   "pypi",
   "chrome-extension",
   "vscode-extension",
+  "chocolatey",
 ]);
 const LOCATED_PACKAGE_CATEGORIES = new Set(["firefox_addons"]);
 

package/lib/inventory/fetchBatch.js

@@ -221,7 +221,7 @@ export function openHostCircuit(
     );
   } else if (breaker === "maven-central") {
     console.warn(
-      `${host} ${what}, so cdxgen will not contact it for the next ${minutes} minute(s) and Maven metadata comes from local caches only. Set MAVEN_CENTRAL_URL to a mirror or repository manager, for example https://maven-central.storage-download.googleapis.com/maven2/, to keep license enrichment working.`,
+      `${host} ${what}, so cdxgen will not contact it for the next ${minutes} minute(s) and Maven metadata comes from local caches only. Set MAVEN_CENTRAL_MIRROR=true to use Google's Maven Central mirror, or name a repository manager in MAVEN_CENTRAL_URL, to keep license enrichment working.`,
     );
   } else {
     console.warn(