@cdxgen/cdxgen 13.6.0 → 13.7.0

package/lib/inventory/envcontext.js

@@ -47,6 +47,10 @@ import { diagnosticStream } from "../core/logger.js";
 import { dirNameStr, isMac, isWin } from "../core/paths.js";
 import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { brotliDecoderProperties, readBrotliDecoder } from "./brotliDecoder.js";
+import {
+  createHostDotnetRuntimeComponent,
+  parseDotnetListRuntimes,
+} from "./dotnetRuntime.js";
 import { isValidSdkmanVersion } from "./jvmToolEnv.js";
 import { createNodeRuntimeComponent } from "./nodeBuildInfo.js";
 import {
@@ -179,7 +183,8 @@ export function getOriginUrl(dir) {
  * @param {string} configKey Git config key
  * @param {string} dir repo directory
  *
- * @returns Output from git config or undefined
+ * @returns {string|undefined} The branch name, or undefined when git fails,
+ * for example when the directory is not a git working tree or has no commit
  */
 export function getBranch(_configKey, dir) {
   return execGitCommand(dir, ["rev-parse", "--abbrev-ref", "HEAD"]);
@@ -212,20 +217,20 @@ export function gitTreeHashes(dir) {
 }
 
 /**
- * Retrieves the files list from git
- * @param {string} dir repo directory
+ * Retrieves the files git tracks under a directory at HEAD. Only the
+ * directory's own subtree is listed, with names relative to it, so a scan of
+ * one directory of a larger repository does not record the rest of that
+ * repository.
  *
- * @returns Output from git config or undefined
+ * @param {string} dir directory inside a git working tree
+ *
+ * @returns {Object[]} files with their blob hash, name, OmniBOR id and SWHID;
+ * empty when git fails, for example when the directory is not a git working
+ * tree or has no commit
  */
 export function listFiles(dir) {
   const filesList = [];
-  const output = execGitCommand(dir, [
-    "ls-tree",
-    "-l",
-    "-r",
-    "--full-tree",
-    "HEAD",
-  ]);
+  const output = execGitCommand(dir, ["ls-tree", "-l", "-r", "HEAD"]);
   if (output) {
     output.split("\n").forEach((l) => {
       l = l.replaceAll("\r", "");
@@ -253,7 +258,10 @@ export function listFiles(dir) {
  * @param {string} dir Repo directory
  * @param {Array} args arguments to git command
  *
- * @returns Output from the git command
+ * @returns {string|undefined} git's standard output, or undefined when git
+ * could not run or exited with a non-zero status. Text git writes to standard
+ * error, including warnings of a successful command, is never part of the
+ * result.
  */
 export function execGitCommand(dir, args) {
   // Prepend hardening `-c` overrides before the subcommand and run git with a
@@ -270,6 +278,8 @@ export function execGitCommand(dir, args) {
     {
       env: hardenedGitEnv(),
       shell: false,
+      requireSuccess: true,
+      includeStderr: false,
     },
   );
 }
@@ -407,6 +417,22 @@ function recordToolProbeFailure(tool, ecosystem, command, detail) {
   }
 }
 
+/**
+ * Collapse command output to one line. The `\r` of a Windows line ending goes
+ * with the break it belongs to, and the empty lines of trailing output are
+ * dropped.
+ *
+ * @param {string} output command output
+ * @param {string} separator what to join the lines with
+ * @returns {string} the non-empty lines joined into one line
+ */
+function collapseOutputLines(output, separator) {
+  return `${output || ""}`
+    .split(/\r?\n/)
+    .filter((line) => line !== "")
+    .join(separator);
+}
+
 /**
  * Collect Java version and installed modules
  *
@@ -414,9 +440,9 @@ function recordToolProbeFailure(tool, ecosystem, command, detail) {
  * @returns Object containing the java details
  */
 export function collectJavaInfo(dir) {
-  const versionDesc = getCommandOutput(getJavaCommand(), dir, ["--version"]);
+  const versionDesc = probeCommandOutput(getJavaCommand(), dir, ["--version"]);
   const moduleDesc =
-    getCommandOutput(getJavaCommand(), dir, ["--list-modules"]) || "";
+    probeCommandOutput(getJavaCommand(), dir, ["--list-modules"]) || "";
   if (versionDesc) {
     const info = {
       type: "platform",
@@ -426,7 +452,7 @@ export function collectJavaInfo(dir) {
       properties: [
         {
           name: "java:modules",
-          value: moduleDesc.replaceAll("\n", ", "),
+          value: collapseOutputLines(moduleDesc, ", "),
         },
       ],
     };
@@ -440,20 +466,41 @@ export function collectJavaInfo(dir) {
 /**
  * Collect dotnet version
  *
+ * `version` is the version `dotnet --version` prints, which is the SDK's. .NET
+ * advisories name runtime versions, so the component itself carries no purl
+ * and no CPE. Each shared framework `dotnet --list-runtimes` reports is a
+ * nested component built by createHostDotnetRuntimeComponent, without a
+ * bom-ref like the other toolchains.
+ *
  * @param {string} dir Working directory
  * @returns Object containing dotnet details
  */
 export function collectDotnetInfo(dir) {
-  const versionDesc = getCommandOutput(DOTNET_CMD, dir, ["--version"]);
+  const versionDesc = probeCommandOutput(DOTNET_CMD, dir, ["--version"]);
   const moduleDesc =
-    getCommandOutput(DOTNET_CMD, dir, ["--list-runtimes"]) || "";
+    probeCommandOutput(DOTNET_CMD, dir, ["--list-runtimes"]) || "";
   if (versionDesc) {
     const info = {
       type: "platform",
       name: "dotnet",
       version: versionDesc.trim(),
-      description: moduleDesc.replaceAll("\n", "\\n"),
+      description: collapseOutputLines(moduleDesc, "\\n"),
     };
+    const components = [];
+    const seen = new Set();
+    for (const entry of parseDotnetListRuntimes(moduleDesc)) {
+      const key = `${entry.framework} ${entry.version}`;
+      if (seen.has(key)) {
+        continue;
+      }
+      seen.add(key);
+      components.push(
+        formulationToolchain(createHostDotnetRuntimeComponent(entry)),
+      );
+    }
+    if (components.length) {
+      info.components = components;
+    }
     recordToolProbeResolved("dotnet", "csharp", info.version);
     return info;
   }
@@ -469,15 +516,15 @@ export function collectDotnetInfo(dir) {
  */
 export function collectPythonInfo(dir) {
   const pythonCmd = getPythonCommand();
-  const versionDesc = getCommandOutput(pythonCmd, dir, ["-S", "--version"]);
+  const versionDesc = probeCommandOutput(pythonCmd, dir, ["-S", "--version"]);
   const moduleDesc =
-    getCommandOutput(pythonCmd, dir, ["-I", "-m", "pip", "--version"]) || "";
+    probeCommandOutput(pythonCmd, dir, ["-I", "-m", "pip", "--version"]) || "";
   if (versionDesc) {
     const info = {
       type: "platform",
       name: "python",
       version: versionDesc.replace("Python ", ""),
-      description: moduleDesc.replaceAll("\n", "\\n"),
+      description: collapseOutputLines(moduleDesc, "\\n"),
     };
     recordToolProbeResolved("python", "python", info.version);
     return info;
@@ -510,7 +557,7 @@ export function collectNodeInfo(dir) {
     nodeInfo.cpe = runtime.cpe;
     annotateNodeBrotli(nodeInfo.components);
   }
-  const moduleDesc = getCommandOutput(NPM_CMD, dir, ["--version"]);
+  const moduleDesc = probeCommandOutput(NPM_CMD, dir, ["--version"]);
   if (moduleDesc) {
     nodeInfo.description = `npm: ${moduleDesc}`;
     recordToolProbeResolved("npm", "npm", moduleDesc);
@@ -557,14 +604,14 @@ function annotateNodeBrotli(components) {
  * @returns Object containing gcc details
  */
 export function collectGccInfo(dir) {
-  const versionDesc = getCommandOutput(GCC_CMD, dir, ["--version"]);
-  const moduleDesc = getCommandOutput(GCC_CMD, dir, ["-print-search-dirs"]);
+  const versionDesc = probeCommandOutput(GCC_CMD, dir, ["--version"]);
+  const moduleDesc = probeCommandOutput(GCC_CMD, dir, ["-print-search-dirs"]);
   if (versionDesc) {
     const info = {
       type: "platform",
       name: "gcc",
       version: versionDesc.split("\n")[0],
-      description: (moduleDesc || "").replaceAll("\n", "\\n"),
+      description: collapseOutputLines(moduleDesc, "\\n"),
     };
     recordToolProbeResolved("gcc", "c", info.version);
     return info;
@@ -580,8 +627,8 @@ export function collectGccInfo(dir) {
  * @returns Object containing rust details
  */
 export function collectRustInfo(dir) {
-  const versionDesc = getCommandOutput(RUSTC_CMD, dir, ["--version"]);
-  const moduleDesc = getCommandOutput(CARGO_CMD, dir, ["--version"]);
+  const versionDesc = probeCommandOutput(RUSTC_CMD, dir, ["--version"]);
+  const moduleDesc = probeCommandOutput(CARGO_CMD, dir, ["--version"]);
   if (versionDesc) {
     const info = {
       type: "platform",
@@ -603,7 +650,7 @@ export function collectRustInfo(dir) {
  * @returns Object containing go details
  */
 export function collectGoInfo(dir) {
-  const versionDesc = getCommandOutput(GO_CMD, dir, ["version"]);
+  const versionDesc = probeCommandOutput(GO_CMD, dir, ["version"]);
   if (versionDesc) {
     const info = {
       type: "platform",
@@ -624,7 +671,7 @@ export function collectGoInfo(dir) {
  * @returns Object containing swift details
  */
 export function collectSwiftInfo(dir) {
-  const versionDesc = getCommandOutput(SWIFT_CMD, dir, ["--version"]);
+  const versionDesc = probeCommandOutput(SWIFT_CMD, dir, ["--version"]);
   if (versionDesc) {
     const info = {
       type: "platform",
@@ -710,7 +757,7 @@ function rubyKeepsCpe(dir) {
     const target = isWin
       ? ""
       : firstOutputLine(
-          getCommandOutput(RUBY_CMD, dir, ["-e", "print RbConfig.ruby"]),
+          probeCommandOutput(RUBY_CMD, dir, ["-e", "print RbConfig.ruby"]),
         );
     if (!isAbsolute(target)) {
       return false;
@@ -738,7 +785,7 @@ function rubyKeepsCpe(dir) {
  * @returns Object containing Ruby details
  */
 export function collectRubyInfo(dir) {
-  const versionDesc = getCommandOutput(RUBY_CMD, dir, ["--version"]);
+  const versionDesc = probeCommandOutput(RUBY_CMD, dir, ["--version"]);
   const banner = firstOutputLine(versionDesc);
   const parsed = parseRubyDescription(banner);
   if (parsed) {
@@ -800,7 +847,9 @@ export function isRubyVersionActive(info, version) {
  * @returns {Object|undefined} the RubyGems component
  */
 export function collectRubyGemsInfo(dir) {
-  const token = firstOutputLine(getCommandOutput(GEM_CMD, dir, ["--version"]));
+  const token = firstOutputLine(
+    probeCommandOutput(GEM_CMD, dir, ["--version"]),
+  );
   if (/^\d+\.\d+\.\d+$/.test(token)) {
     recordToolProbeResolved("gem", "ruby", token);
     return formulationToolchain(
@@ -828,7 +877,7 @@ export function collectRubyGemsInfo(dir) {
  */
 export function collectBundlerInfo(dir) {
   const line = firstOutputLine(
-    getCommandOutput(BUNDLE_CMD, dir, ["--version"]),
+    probeCommandOutput(BUNDLE_CMD, dir, ["--version"]),
   );
   const token = line.startsWith("Bundler version ")
     ? line.slice("Bundler version ".length).trim()
@@ -892,7 +941,7 @@ function formulationToolchain(component) {
  * @returns Object containing the PHP details
  */
 export function collectPhpInfo(dir) {
-  const output = getCommandOutput(PHP_CMD, dir, ["-n", "-v"]);
+  const output = probeCommandOutput(PHP_CMD, dir, ["-n", "-v"]);
   const banner = firstOutputLine(output);
   const reported = banner.startsWith("PHP ")
     ? parsePhpReportedVersion(banner.slice("PHP ".length))
@@ -934,7 +983,7 @@ export function collectPhpInfo(dir) {
  * @returns Object containing the Composer details
  */
 export function collectComposerInfo(dir) {
-  const output = getCommandOutput(COMPOSER_CMD, dir, [
+  const output = probeCommandOutput(COMPOSER_CMD, dir, [
     "--version",
     "--no-plugins",
     "--no-scripts",
@@ -1053,16 +1102,55 @@ export function collectEnvInfo(dir, options = undefined) {
   return infoComponents;
 }
 
+/**
+ * Longest a toolchain version probe may run. A `--version` call answers in
+ * well under a second; a tool that sets itself up on first use, such as
+ * dotnet or gem in a fresh home directory, or one that waits on a prompt,
+ * must not hold up a scan for the general spawn timeout.
+ */
+const VERSION_PROBE_TIMEOUT_MS = 60000;
+
+/**
+ * Run a toolchain version probe with VERSION_PROBE_TIMEOUT_MS as its limit.
+ *
+ * A probe that fails gives no output. Its text is then an error message, not
+ * a version: `dotnet --version` under a global.json that pins an SDK the host
+ * lacks exits with an error and lists every installed SDK, which would
+ * otherwise become the version of the dotnet component in the formulation.
+ *
+ * @param {string} cmd Command to execute
+ * @param {string} dir Working directory
+ * @param {string[]} args Arguments
+ * @returns {string|undefined} Output of the command, or undefined when it
+ * could not run or exited with a non-zero status
+ */
+const probeCommandOutput = (cmd, dir, args) =>
+  getCommandOutput(cmd, dir, args, {
+    requireSuccess: true,
+    timeout: VERSION_PROBE_TIMEOUT_MS,
+  });
+
 /**
  * Execute any command to retrieve the output
  *
  * @param {*} cmd Command to execute
  * @param {*} dir working directory
  * @param {*} args arguments
- * @param {Object} [spawnOverrides] extra options merged into spawnSync (e.g. env)
- * @returns String output from the command or undefined in case of error
+ * @param {Object} [options] extra options merged into spawnSync (e.g. env),
+ * plus `requireSuccess`, which gives undefined for a command that exits with
+ * a non-zero status, and `includeStderr`, which joins the command's standard
+ * error into the result (the default). With `includeStderr` false only the
+ * standard output is returned, so text a command writes to standard error
+ * cannot reach a parser of its output.
+ * @returns {string|undefined} Output of the command, or undefined when it
+ * could not run or printed nothing
  */
-const getCommandOutput = (cmd, dir, args, spawnOverrides = {}) => {
+const getCommandOutput = (cmd, dir, args, options = {}) => {
+  const {
+    requireSuccess = false,
+    includeStderr = true,
+    ...spawnOverrides
+  } = options;
   let commandToUse = cmd;
   // If the command includes space, automatically move it to the front of the args.
   if (cmd?.trim().includes(" ")) {
@@ -1091,7 +1179,13 @@ const getCommandOutput = (cmd, dir, args, spawnOverrides = {}) => {
     maxBuffer: MAX_BUFFER * 2,
     ...spawnOverrides,
   });
+  if (requireSuccess && (result.error || result.status !== 0)) {
+    return undefined;
+  }
   const stdout = result.stdout ? result.stdout.toString() : "";
+  if (!includeStderr) {
+    return stdout.trim() || undefined;
+  }
   const stderr = result.stderr ? result.stderr.toString() : "";
   return `${stdout}\n${stderr}`.trim() || undefined;
 };

package/lib/inventory/evidenceUtils.js

@@ -23,6 +23,7 @@ import {
 } from "./dosaiParsers.js";
 import { createGtfoBinsPropertiesFromRow } from "./gtfobins.js";
 import { createLolbasProperties } from "./lolbas.js";
+import { occurrenceLocationKey } from "./occurrenceKey.js";
 import { isOsPackagePurlType } from "./osPackagePurl.js";
 import {
   createOsQueryFallbackBomRef,
@@ -370,7 +371,7 @@ export function addEvidenceForDotnet(pkgList, slicesFile, options = {}) {
           addDosaiSetValue(
             purlLocationMap,
             modPurl,
-            `${adep.Path}#${adep.LineNumber}`,
+            occurrenceLocationKey(adep.Path, adep.LineNumber),
           );
         }
       }

package/lib/inventory/formulationParsers.js

@@ -14,6 +14,13 @@ import { githubActionsParser } from "./ciParsers/githubActions.js";
 import { gitlabCiParser } from "./ciParsers/gitlabCi.js";
 import { jenkinsParser } from "./ciParsers/jenkins.js";
 import { trimComponents } from "./depsUtils.js";
+import {
+  dotnetProjectFormulationParser,
+  formulationSourcePath,
+  goModuleFormulationParser,
+  makefileFormulationParser,
+  pythonRequirementsFormulationParser,
+} from "./ecosystemFormulationParsers.js";
 import {
   collectEnvInfo,
   getBranch,
@@ -49,8 +56,9 @@ function buildReadmeSecurityComponents(discoveryPath, options) {
     if (!scan.hasHiddenUnicode) {
       continue;
     }
+    const sourcePath = formulationSourcePath(filePath, discoveryPath);
     const properties = [
-      { name: "internal:SrcFile", value: filePath },
+      { name: "internal:SrcFile", value: sourcePath },
       { name: "cdx:file:kind", value: "readme" },
       { name: "cdx:file:hasHiddenUnicode", value: "true" },
       {
@@ -73,7 +81,7 @@ function buildReadmeSecurityComponents(discoveryPath, options) {
       });
     }
     components.push({
-      "bom-ref": `file:${filePath}`,
+      "bom-ref": `file:${sourcePath}`,
       name: basename(filePath),
       properties,
       type: "file",
@@ -92,13 +100,22 @@ function buildReadmeSecurityComponents(discoveryPath, options) {
  * {
  *   id:       string,                         // unique stable identifier
  *   patterns: string[],                       // non-empty array of glob patterns for file discovery
- *   parse(files: string[], options: Object):  // synchronous function
+ *   parse(files: string[], options: Object, context: { rootDir: string }):
+ *                                             // synchronous function
  *     { workflows?, components?, services?, properties?, dependencies? }
  * }
  * ```
+ *
+ * `context.rootDir` is the scanned project root. A parser that records file
+ * paths records them relative to it, so no path of the scanning machine
+ * reaches the BOM.
  */
 const _parsers = [
   rustFormulationParser,
+  makefileFormulationParser,
+  goModuleFormulationParser,
+  pythonRequirementsFormulationParser,
+  dotnetProjectFormulationParser,
   githubActionsParser,
   gitlabCiParser,
   jenkinsParser,
@@ -189,6 +206,49 @@ const ENV_BLOCKLIST = [
   "webhook",
 ];
 
+/**
+ * Remove the parts of every URL in an environment value that can carry
+ * credentials: the userinfo before `@`, the query string and the fragment.
+ * The value is scanned with indexOf, one URL at a time, so the work stays
+ * linear in its length.
+ *
+ * @param {string} value environment variable value
+ * @returns {string} the value with URL credentials, queries and fragments removed
+ */
+function stripUrlCredentials(value) {
+  const delimiters = " \t\r\n\"'`,;<>|";
+  let result = "";
+  let cursor = 0;
+  let schemeEnd = value.indexOf("://");
+  while (schemeEnd !== -1) {
+    const start = schemeEnd + 3;
+    let end = start;
+    while (end < value.length && !delimiters.includes(value[end])) {
+      end += 1;
+    }
+    const url = value.slice(start, end);
+    let authorityEnd = url.length;
+    for (const marker of ["/", "?", "#"]) {
+      const at = url.indexOf(marker);
+      if (at !== -1 && at < authorityEnd) {
+        authorityEnd = at;
+      }
+    }
+    const authority = url.slice(0, authorityEnd);
+    let rest = url.slice(authorityEnd);
+    for (const marker of ["?", "#"]) {
+      const at = rest.indexOf(marker);
+      if (at !== -1) {
+        rest = rest.slice(0, at);
+      }
+    }
+    result += `${value.slice(cursor, start)}${authority.slice(authority.lastIndexOf("@") + 1)}${rest}`;
+    cursor = end;
+    schemeEnd = value.indexOf("://", end);
+  }
+  return result + value.slice(cursor);
+}
+
 // The project types a scan asked for, as given on the command line.
 function requestedProjectTypes(options) {
   return [].concat(options?.projectType || []).flatMap((type) =>
@@ -302,9 +362,16 @@ export function addFormulationSection(filePath, options, context = {}) {
   // scanning host's tools say nothing about it.
   // Only an explicit container type counts: hasAnyProjectType treats
   // `universal` as every type, and a universal source scan runs on the host.
-  const describesScanningHost = !requestedProjectTypes(options).some((type) =>
+  const requestedTypes = requestedProjectTypes(options);
+  const describesScanningHost = !requestedTypes.some((type) =>
     PROJECT_TYPE_ALIASES.oci.includes(type),
   );
+  // An OS inventory (obom) describes the live host. Its path is usually the
+  // working directory, such as a home directory or /, so the build-input,
+  // CI and README discovery below would walk a tree that is not a project.
+  const describesLiveHost =
+    requestedTypes.length > 0 &&
+    requestedTypes.every((type) => PROJECT_TYPE_ALIASES.os.includes(type));
   if (!describesScanningHost) {
     thoughtLog(
       "Skipping the toolchain and OS crypto library probes for formulation, since they would describe the scanning host and not the image.",
@@ -320,8 +387,15 @@ export function addFormulationSection(filePath, options, context = {}) {
     components = components.concat(infoComponents);
   }
 
-  // OS crypto libraries (cbom mode)
-  if (options.includeCrypto && describesScanningHost) {
+  // OS crypto libraries (cbom mode). The queries also read the host's
+  // certificates, authorized keys and keychain items, so they run only when
+  // formulation was requested explicitly, not when CI, a profile, an OS type
+  // or the cbom command turned it on.
+  if (
+    options.includeCrypto &&
+    describesScanningHost &&
+    !options.formulationAutomatic
+  ) {
     const cryptoLibs = collectOSCryptoLibs(options, context?.executeOsQuery);
     if (cryptoLibs?.length) {
       components = components.concat(cryptoLibs);
@@ -335,8 +409,13 @@ export function addFormulationSection(filePath, options, context = {}) {
   const ciProperties = [];
 
   const discoveryPath = projectPath || ".";
+  if (describesLiveHost) {
+    thoughtLog(
+      "Skipping build-input, CI and README discovery for formulation, since an OS inventory describes the host and not a project tree.",
+    );
+  }
 
-  for (const parser of _parsers) {
+  for (const parser of describesLiveHost ? [] : _parsers) {
     const matchedFiles = [];
     for (const pattern of parser.patterns) {
       const found = getAllFiles(discoveryPath, pattern, options);
@@ -351,7 +430,9 @@ export function addFormulationSection(filePath, options, context = {}) {
 
     let result;
     try {
-      result = parser.parse(uniqueMatchedFiles, options);
+      result = parser.parse(uniqueMatchedFiles, options, {
+        rootDir: discoveryPath,
+      });
     } catch (err) {
       // A broken parser must not kill SBOM generation
       console.warn(
@@ -383,10 +464,9 @@ export function addFormulationSection(filePath, options, context = {}) {
     components = components.concat(ciComponents);
   }
 
-  const readmeSecurityComponents = buildReadmeSecurityComponents(
-    discoveryPath,
-    options,
-  );
+  const readmeSecurityComponents = describesLiveHost
+    ? []
+    : buildReadmeSecurityComponents(discoveryPath, options);
   if (readmeSecurityComponents.length) {
     components = components.concat(readmeSecurityComponents);
   }
@@ -405,7 +485,9 @@ export function addFormulationSection(filePath, options, context = {}) {
       !ENV_BLOCKLIST.some((b) => value.toLowerCase().includes(b)) &&
       value.length
     ) {
-      environmentVars.push({ name: aevar, value });
+      // A registry or mirror URL can carry a password before `@` or a
+      // token in its query string, so only the scheme, host and path stay.
+      environmentVars.push({ name: aevar, value: stripUrlCredentials(value) });
     }
   }
 

package/lib/inventory/hbom.js

@@ -8,6 +8,9 @@ import {
   readEnvironmentVariable,
   recordActivity,
 } from "../core/activity.js";
+import { thoughtLog } from "../core/logger.js";
+import { isCycloneDx20SpecVersion } from "./bomUtils.js";
+import { readCycloneDx20 } from "./cyclonedx20.js";
 import { getHbomCommandDiagnosticSummary } from "./hbomAnalysis.js";
 import { importHbomModule } from "./hbomLoader.js";
 import { resolveCdxgenPlugins, resolvePluginBinary } from "./plugins.js";
@@ -411,8 +414,9 @@ export function ensureSupportedHbomSpecVersion(specVersion) {
   if (specVersion === undefined || specVersion === null || specVersion === "") {
     return;
   }
-  if (Number(specVersion) !== 1.7) {
-    throw new Error("HBOM generation currently supports only CycloneDX 1.7.");
+  // cdxgen renders 2.0 itself from the 1.7 collector output.
+  if (Number(specVersion) !== 1.7 && Number(specVersion) !== 2) {
+    throw new Error("HBOM generation supports only CycloneDX 1.7 and 2.0.");
   }
 }
 
@@ -474,6 +478,10 @@ export function normalizeHbomOptions(options = {}) {
     includeSensitiveIdentifiers:
       options.includeSensitiveIdentifiers ?? options.sensitive ?? false,
     platform: options.platform,
+    // Always 1.7: cdxgen's own pipeline (postProcess and its 2.0 renderer)
+    // turns the 1.7 collector output into 2.0, the way it renders every
+    // other BOM. A cdx-hbom that can emit 2.0 itself is never asked to.
+    specVersion: "1.7",
     timeoutMs:
       Number.isNaN(timeoutMs) || timeoutMs <= 0 ? undefined : timeoutMs,
   };
@@ -722,6 +730,38 @@ export function addHbomAnalysisProperties(bomJson) {
   return bomJson;
 }
 
+/**
+ * The 1.x-shaped model of a collector result. cdxgen asks the collector for
+ * 1.7; a collector that still answers with a CycloneDX 2.0 document (a
+ * `specFormat`, or specVersion 2.0) is read with readCycloneDx20, so the
+ * 1.x pipeline that follows never mistakes it for a 1.x BOM and loses its
+ * inventories.
+ *
+ * @param {object} collected What collectHardware returned
+ * @returns {object} The 1.x-shaped HBOM
+ */
+export function toInternalHbom(collected) {
+  if (
+    !collected ||
+    typeof collected !== "object" ||
+    !(collected.specFormat || isCycloneDx20SpecVersion(collected.specVersion))
+  ) {
+    return collected;
+  }
+  const { internalBom, losses } = readCycloneDx20(collected);
+  if (losses.length) {
+    thoughtLog(
+      `The HBOM collector returned CycloneDX 2.0; reading it into the 1.x model reported ${losses.length} loss(es).`,
+      losses,
+    );
+  }
+  // The pipeline renders 2.0 again from the 1.x model, so the model says
+  // what the collector was asked for.
+  internalBom.specVersion = "1.7";
+  delete internalBom.specFormat;
+  return internalBom;
+}
+
 /**
  * Generate an HBOM using the optional cdx-hbom package.
  *
@@ -750,12 +790,11 @@ export async function createHbomDocument(options = {}) {
     });
     return createDryRunHbomDocument(options);
   }
-  const bomJson = addHbomAnalysisProperties(
-    await hbomModule.collectHardware(normalizedOptions),
-  );
+  const collected = await hbomModule.collectHardware(normalizedOptions);
+  const bomJson = addHbomAnalysisProperties(toInternalHbom(collected));
   if (isDryRun) {
     recordHbomCollectorTrace(
-      hbomModule.getCollectorTrace?.(bomJson) ?? normalizedOptions.trace,
+      hbomModule.getCollectorTrace?.(collected) ?? normalizedOptions.trace,
     );
   }
   return bomJson;