@cdxgen/cdxgen 13.6.0 → 13.7.0

package/data/pqc-migration.json

@@ -0,0 +1,239 @@
+{
+  "$comment": "Post-quantum migration facts for cryptographic assets (cdxgen/cdxgen#4592). Each class cites the table or section its dates and members come from: NIST IR 8547 (final, October 2026), https://csrc.nist.gov/pubs/ir/8547/final, and, for DSA, FIPS 186-5. lib/inventory/pqcMigration.js classifies an asset by algorithmFamily, then OID, then normalised name (lower case, letters and digits only), and turns the class into a risks.risks[] entry. The likelihood and impact levels are cdxgen's fixed rating per class, not values from the IR; docs/CDX_CONVERT.md (CycloneDX 2.0, post-quantum migration risks) documents them, and docs/CUSTOM_PROPERTIES.md the cdx:crypto:pqc:* properties.",
+  "source": {
+    "document": "NIST IR 8547 (final, October 2026)",
+    "url": "https://csrc.nist.gov/pubs/ir/8547/final"
+  },
+  "$excludedNote": "Not classified, because IR 8547 Tables 2 and 4 do not list them: RSAES-PKCS1 (SP 800-56B specifies RSA key transport with OAEP and KTS, not PKCS #1 v1.5 encryption) and X3DH (a Signal protocol, not an SP 800-56A scheme). Quantum-safe per IR 8547 Tables 3 and 5-8, so no risk: ML-DSA, SLH-DSA, LMS/HSS, XMSS, ML-KEM, AES, Ascon, and SHA-2/SHA-3 members with at least 128 bits of collision strength.",
+  "unclassifiedPrimitives": [
+    "combiner"
+  ],
+  "$unclassifiedPrimitivesNote": "NIST IR 8547 Section 3.2.1: a hybrid (composite) key-establishment scheme combines the shared secrets of its component schemes and is approved when one input comes from an approved scheme, so a combiner is not classified by the OID of one of its inputs.",
+  "quantumSafeFamilies": [
+    "ML-DSA",
+    "SLH-DSA",
+    "LMS",
+    "XMSS",
+    "ML-KEM",
+    "AES",
+    "Ascon",
+    "SHA-2",
+    "SHA-3",
+    "HMAC",
+    "HKDF",
+    "KMAC"
+  ],
+  "minimumKeySizes": {
+    "$comment": "Smallest key size per key family with the 112 bits of classical security strength that IR 8547 Table 2 (ECDSA, RSA) and Table 4 (finite-field and elliptic-curve DH and MQV, RSA) list as the approved parameters. Key sizes for 112 bits: SP 800-57 Part 1 Rev. 5 Table 2 (RSA k = 2048, FFC L = 2048, ECC f = 224).",
+    "rsa": 2048,
+    "ff": 2048,
+    "ec": 224
+  },
+  "namedGroupKeySizes": {
+    "$comment": "Finite-field groups whose name carries no separate key size: the ffdhe groups of RFC 7919, whose modulus size is the number in the name.",
+    "ffdhe2048": 2048,
+    "ffdhe3072": 3072,
+    "ffdhe4096": 4096,
+    "ffdhe6144": 6144,
+    "ffdhe8192": 8192
+  },
+  "classes": {
+    "quantum-vulnerable-signature": {
+      "source": "NIST IR 8547 Table 2 (quantum-vulnerable digital signature algorithms): ECDSA and RSA at >= 112 bits, EdDSA at >= 128 bits of classical security strength [FIPS186]",
+      "transition": "Deprecated after 2030; disallowed after 2035",
+      "deprecatedAfter": "2030",
+      "disallowedAfter": "2035",
+      "riskName": "Post-quantum migration",
+      "statement": "This digital signature algorithm is quantum-vulnerable; NIST IR 8547 Table 2 deprecates it after 2030 and disallows it after 2035.",
+      "rationale": "{algorithm} is a quantum-vulnerable digital signature algorithm listed in NIST IR 8547 Table 2: deprecated after 2030, disallowed after 2035.",
+      "likelihood": "high",
+      "impact": "major",
+      "families": {
+        "ECDSA": "ec",
+        "EdDSA": null,
+        "RSASSA-PKCS1": "rsa",
+        "RSASSA-PSS": "rsa",
+        "RSA-X931": "rsa"
+      },
+      "oids": {
+        "1.2.840.10045.4.1": "ec",
+        "1.2.840.10045.4.3.1": "ec",
+        "1.2.840.10045.4.3.2": "ec",
+        "1.2.840.10045.4.3.3": "ec",
+        "1.2.840.10045.4.3.4": "ec",
+        "1.3.101.112": null,
+        "1.3.101.113": null,
+        "1.2.840.113549.1.1.2": "rsa",
+        "1.2.840.113549.1.1.3": "rsa",
+        "1.2.840.113549.1.1.4": "rsa",
+        "1.2.840.113549.1.1.5": "rsa",
+        "1.2.840.113549.1.1.10": "rsa",
+        "1.2.840.113549.1.1.11": "rsa",
+        "1.2.840.113549.1.1.12": "rsa",
+        "1.2.840.113549.1.1.13": "rsa",
+        "1.2.840.113549.1.1.14": "rsa",
+        "1.2.840.113549.1.1.15": "rsa",
+        "1.2.840.113549.1.1.16": "rsa",
+        "2.16.840.1.101.3.4.3.9": "ec",
+        "2.16.840.1.101.3.4.3.10": "ec",
+        "2.16.840.1.101.3.4.3.11": "ec",
+        "2.16.840.1.101.3.4.3.12": "ec",
+        "2.16.840.1.101.3.4.3.13": "rsa",
+        "2.16.840.1.101.3.4.3.14": "rsa",
+        "2.16.840.1.101.3.4.3.15": "rsa",
+        "2.16.840.1.101.3.4.3.16": "rsa"
+      },
+      "names": {
+        "ecdsa": "ec",
+        "eddsa": null,
+        "ed25519": null,
+        "ed448": null,
+        "rsapss": "rsa",
+        "rsassapss": "rsa",
+        "rsassapkcs1": "rsa"
+      }
+    },
+    "quantum-vulnerable-key-establishment": {
+      "source": "NIST IR 8547 Table 4 (quantum-vulnerable key-establishment schemes): finite-field DH and MQV, elliptic-curve DH and MQV [SP80056A] and RSA [SP80056B], at >= 112 bits of classical security strength",
+      "transition": "Deprecated after 2030; disallowed after 2035",
+      "deprecatedAfter": "2030",
+      "disallowedAfter": "2035",
+      "riskName": "Post-quantum migration",
+      "statement": "This key-establishment scheme is quantum-vulnerable; NIST IR 8547 Table 4 deprecates it after 2030 and disallows it after 2035.",
+      "rationale": "{algorithm} is a quantum-vulnerable key-establishment scheme listed in NIST IR 8547 Table 4: deprecated after 2030, disallowed after 2035.",
+      "likelihood": "high",
+      "impact": "major",
+      "families": {
+        "FFDH": "ff",
+        "MQV": "ff",
+        "ECDH": "ec",
+        "RSAES-OAEP": "rsa"
+      },
+      "oids": {
+        "1.2.840.10046.2.1": "ff",
+        "1.2.840.113549.1.3.1": "ff",
+        "1.3.132.1.12": "ec",
+        "1.3.132.1.13": "ec",
+        "1.3.101.110": null,
+        "1.3.101.111": null,
+        "1.2.840.113549.1.1.7": "rsa"
+      },
+      "names": {
+        "dh": "ff",
+        "ffdh": "ff",
+        "mqv": "ff",
+        "ecdh": "ec",
+        "ecmqv": "ec",
+        "x25519": null,
+        "x448": null,
+        "rsaoaep": "rsa",
+        "rsaesoaep": "rsa",
+        "ffdhe2048": "ff",
+        "ffdhe3072": "ff",
+        "ffdhe4096": "ff",
+        "ffdhe6144": "ff",
+        "ffdhe8192": "ff"
+      }
+    },
+    "quantum-vulnerable-public-key": {
+      "source": "NIST IR 8547 Table 2 (ECDSA, RSA [FIPS186]) and Table 4 (elliptic-curve DH and MQV [SP80056A], RSA [SP80056B]): the key algorithm alone does not say which use applies, and both tables give the same transition",
+      "transition": "Deprecated after 2030; disallowed after 2035",
+      "deprecatedAfter": "2030",
+      "disallowedAfter": "2035",
+      "riskName": "Post-quantum migration",
+      "statement": "This public-key algorithm is quantum-vulnerable whether it signs (NIST IR 8547 Table 2) or establishes keys (Table 4); both tables deprecate it after 2030 and disallow it after 2035.",
+      "rationale": "{algorithm} is a quantum-vulnerable public-key algorithm listed in NIST IR 8547 Table 2 and Table 4: deprecated after 2030, disallowed after 2035.",
+      "likelihood": "high",
+      "impact": "major",
+      "families": {},
+      "oids": {
+        "1.2.840.113549.1.1.1": "rsa",
+        "1.2.840.10045.2.1": "ec"
+      },
+      "names": {
+        "rsa": "rsa",
+        "rsaencryption": "rsa",
+        "ec": "ec",
+        "ecpublickey": "ec",
+        "idecpublickey": "ec"
+      }
+    },
+    "below-minimum-strength": {
+      "source": "NIST IR 8547 Table 2 and Table 4 list only parameters with >= 112 bits of classical security strength; key sizes per SP 800-57 Part 1 Rev. 5 Table 2",
+      "transition": "Below the minimum strength of the currently approved parameters in NIST IR 8547 Table 2 and Table 4",
+      "riskName": "Key below the approved strength",
+      "statement": "This key is below the 112 bits of classical security strength that NIST IR 8547 Tables 2 and 4 list for the currently approved quantum-vulnerable public-key algorithms.",
+      "rationale": "{algorithm} uses a {size}-bit key, below the {minimum}-bit minimum (112 bits of classical security strength) of the parameters NIST IR 8547 Table 2 and Table 4 list.",
+      "likelihood": "very-high",
+      "impact": "major"
+    },
+    "hash-sha1": {
+      "source": "NIST IR 8547 Table 8 (hash functions and XOFs), footnote 4",
+      "transition": "Currently deprecated for all remaining technical applications; disallowed for use in FIPS-validated cryptographic modules after 2030",
+      "disallowedAfter": "2030",
+      "riskName": "Deprecated hash function",
+      "statement": "SHA-1 is currently deprecated for all remaining technical applications and will be disallowed for use in FIPS-validated cryptographic modules after 2030 (NIST IR 8547 Table 8, footnote 4).",
+      "rationale": "{algorithm} is SHA-1, whose collision security strength is below 80 bits (NIST IR 8547 Table 8); it is currently deprecated and disallowed in FIPS-validated modules after 2030.",
+      "likelihood": "high",
+      "impact": "moderate",
+      "families": {
+        "SHA-1": null
+      },
+      "oids": {
+        "1.3.14.3.2.26": null
+      },
+      "names": {
+        "sha1": null
+      }
+    },
+    "symmetric-112-bit": {
+      "source": "NIST IR 8547 Section 4.1.3 and Table 8: SHA-224, SHA-512/224 and SHA3-224 have 112 bits of collision security strength",
+      "transition": "Disallowed in 2030",
+      "disallowedIn": "2030",
+      "riskName": "112-bit security strength",
+      "statement": "This algorithm provides 112 bits of security; NIST IR 8547 section 4.1.3 says NIST's symmetric standards at the 112-bit security level will be disallowed in 2030.",
+      "rationale": "{algorithm} has 112 bits of collision security strength (NIST IR 8547 Table 8); section 4.1.3 says the 112-bit symmetric standards will be disallowed in 2030.",
+      "likelihood": "medium",
+      "impact": "moderate",
+      "families": {},
+      "oids": {
+        "2.16.840.1.101.3.4.2.4": null,
+        "2.16.840.1.101.3.4.2.5": null,
+        "2.16.840.1.101.3.4.2.7": null
+      },
+      "names": {
+        "sha224": null,
+        "sha512224": null,
+        "sha3224": null
+      }
+    },
+    "dsa-generation-not-approved": {
+      "source": "FIPS 186-5 (February 2023), section 4 (The Digital Signature Algorithm) and Appendix E: DSA is no longer approved for digital signature generation and may be used to verify signatures generated prior to the implementation date of FIPS 186-5; NIST IR 8547 Table 2 does not list it",
+      "url": "https://csrc.nist.gov/pubs/fips/186-5/final",
+      "transition": "No longer approved for digital signature generation; may be used only to verify signatures generated prior to the implementation date of FIPS 186-5",
+      "riskName": "Signature algorithm no longer approved",
+      "statement": "FIPS 186-5 no longer approves DSA for digital signature generation; DSA may be used only to verify signatures generated prior to the implementation date of FIPS 186-5 (section 4).",
+      "rationale": "{algorithm} is DSA, which FIPS 186-5 (section 4) no longer approves for digital signature generation; it may be used only to verify signatures generated prior to the implementation date of FIPS 186-5.",
+      "likelihood": "high",
+      "impact": "moderate",
+      "families": {
+        "DSA": null
+      },
+      "oids": {
+        "1.2.840.10040.4.1": null,
+        "1.2.840.10040.4.3": null,
+        "2.16.840.1.101.3.4.3.1": null,
+        "2.16.840.1.101.3.4.3.2": null,
+        "2.16.840.1.101.3.4.3.3": null,
+        "2.16.840.1.101.3.4.3.4": null,
+        "2.16.840.1.101.3.4.3.5": null,
+        "2.16.840.1.101.3.4.3.6": null,
+        "2.16.840.1.101.3.4.3.7": null,
+        "2.16.840.1.101.3.4.3.8": null
+      },
+      "names": {
+        "dsa": null
+      }
+    }
+  }
+}

package/data/remediations.json

@@ -167,6 +167,58 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
   },
+  "jvm.gradle.lockfile-only": {
+    "ecosystem": "java",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "The components came from Gradle dependency lockfiles, which record no dependency graph between them",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Let Gradle run to read the resolved dependency graph: drop --no-install-deps, and drop the gradle-prefer-lockfile flag or the GRADLE_PREFER_LOCKFILE variable if either is set."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "jvm.gradle.lockfile-only"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
+  "jvm.gradle.verification-metadata-only": {
+    "ecosystem": "java",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "The components came from gradle/verification-metadata.xml, which records no dependency graph between them",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Let Gradle run to read the resolved dependency graph: drop --no-install-deps, and drop the gradle-prefer-lockfile flag or the GRADLE_PREFER_LOCKFILE variable if either is set."
+      },
+      {
+        "kind": "config",
+        "command": "Commit Gradle dependency lockfiles for a flat but resolved inventory: enable dependencyLocking and run 'gradle dependencies --write-locks'."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "jvm.gradle.verification-metadata-only"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
   "jvm.gradle.invocation-failed": {
     "ecosystem": "java",
     "kind": "command.failed",

package/data/rules/cbom-security.yaml

@@ -287,11 +287,12 @@
     }
 
 # Post-quantum OIDs (ML-DSA RFC 9881, SLH-DSA RFC 9909, ML-KEM RFC 9935) and
-# the classical-only cutoff. NIST IR 8547 (initial public draft) proposes
-# classical algorithms be disallowed after 2035.
+# the classical-only cutoff. NIST IR 8547 (final, October 2026) Tables 2 and 4
+# disallow quantum-vulnerable signature and key-establishment algorithms after
+# 2035.
 - id: CBC-005
   name: "Classical-only CA certificate valid past the post-quantum transition"
-  description: "A CA certificate whose key and signature algorithms are both classical stays valid beyond 2035-01-01, past the date NIST IR 8547 (initial public draft) proposes to disallow classical algorithms."
+  description: "A CA certificate whose key and signature algorithms are both classical stays valid beyond 2035-01-01, past the date after which NIST IR 8547 (final, October 2026, Tables 2 and 4) disallows quantum-vulnerable algorithms."
   severity: low
   category: cbom-security
   dry-run-support: full

package/data/rules/package-integrity.yaml

@@ -362,3 +362,31 @@
       "platform": $contains(purl, 'platform=') ? $substringAfter(purl, 'platform=') : 'ruby',
       "requiredRubyVersion": $prop($, 'cdx:gem:rubyVersionSpecifiers')
     }
+
+- id: INT-016
+  name: "Gradle verification metadata disagrees with the artifact digest"
+  description: >-
+    A component carries cdx:gradle:verificationMismatch=true: the digest
+    gradle/verification-metadata.xml records for this component's artifact
+    differs from the digest cdxgen computed from the artifact in the local
+    cache. A released Maven version does not change after publishing, so a
+    stale file cannot explain this. The likely causes are an artifact
+    republished on a mirror or internal repository, or a corrupted or
+    tampered cache. The recorded digest is never applied over the
+    artifact's own, and SNAPSHOT versions are not compared.
+  severity: high
+  category: package-integrity
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:gradle:verificationMismatch') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "The digest gradle/verification-metadata.xml records for '{{ name }}@{{ version }}' differs from the digest of the artifact on disk"
+  mitigation: "Compare the jar in the local cache with the copy the repository serves, and find out which repository or mirror served the differing one. Regenerate gradle/verification-metadata.xml only after that check: regenerating it first records the suspect digest and removes the evidence"
+  evidence: |
+    {
+      "verificationMethods": $prop($, 'cdx:gradle:verificationMethods'),
+      "pgpKeyIds": $prop($, 'cdx:gradle:pgpKeyIds')
+    }

package/lib/audit/index.js

@@ -30,6 +30,10 @@ import {
   getNonCycloneDxErrorMessage,
   isCycloneDxBom,
 } from "../inventory/bomUtils.js";
+import {
+  formatReadLossNotice,
+  loadBomForAnalysis,
+} from "../inventory/cyclonedx20.js";
 import {
   collectPolicyViolations,
   loadPolicy,
@@ -122,10 +126,14 @@ const PYTHON_OBFUSCATION_PATTERN =
 const PYTHON_SETUP_CMDCLASS_PATTERN = /\bcmdclass\s*=/i;
 
 /**
- * Read and validate a CycloneDX BOM file.
+ * Read and validate a CycloneDX BOM file. A CycloneDX 2.0 document is read
+ * into cdxgen's internal 1.x-shaped model, so the audit rules keep reading
+ * `components`, `bom-ref` and `metadata.component`; the number of losses
+ * the read reported is printed once on stderr, with the details in
+ * thoughtLog.
  *
  * @param {string} bomPath BOM file path
- * @returns {object} parsed CycloneDX BOM
+ * @returns {object} parsed CycloneDX BOM in the 1.x shape
  */
 export function loadBomFile(bomPath) {
   const resolvedPath = resolve(bomPath);
@@ -138,7 +146,21 @@ export function loadBomFile(bomPath) {
   if (!isCycloneDxBom(bomJson)) {
     throw new Error(getNonCycloneDxErrorMessage(bomJson, "cdx-audit"));
   }
-  return bomJson;
+  let analysis;
+  try {
+    analysis = loadBomForAnalysis(bomJson);
+  } catch (error) {
+    throw new Error(`Failed to read ${resolvedPath}: ${error.message}`);
+  }
+  const { internalBom, losses } = analysis;
+  if (losses.length) {
+    // stderr: stdout carries the --report json/sarif payload.
+    console.warn(formatReadLossNotice(losses));
+    for (const loss of losses) {
+      thoughtLog(`cdx-audit 2.0 loss at ${loss.pointer}: ${loss.reason}`);
+    }
+  }
+  return internalBom;
 }
 
 /**

package/lib/cli/bomAssembly.js

@@ -1113,6 +1113,65 @@ export function hasNpmBinCommandEvidence(allImports, pkg) {
   return false;
 }
 
+/**
+ * Return a CycloneDX organisational entity built from a collector-supplied
+ * supplier or manufacturer, or undefined when the value is not a well-formed
+ * entity.
+ *
+ * An entity needs a non-empty string name. When a url is present it must be
+ * an array of valid IRI references; any other shape (a single string, an
+ * array holding non-strings) drops the entity so the BOM stays schema
+ * valid. Each contact is reduced to its string name, email and phone, and a
+ * contact with none of them is left out. The entity bom-ref is not copied,
+ * because CycloneDX 1.4 does not allow it there.
+ *
+ * @param {Object} entity Collector-supplied organisational entity
+ * @returns {Object|undefined} Organisational entity, or undefined
+ */
+export function toOrganizationalEntity(entity) {
+  if (!entity || typeof entity !== "object" || Array.isArray(entity)) {
+    return undefined;
+  }
+  if (typeof entity.name !== "string" || !entity.name.trim().length) {
+    return undefined;
+  }
+  const result = { name: entity.name.trim() };
+  if (entity.url !== undefined) {
+    if (
+      !Array.isArray(entity.url) ||
+      !entity.url.every(
+        (u) => typeof u === "string" && u.length && isValidIriReference(u),
+      )
+    ) {
+      return undefined;
+    }
+    if (entity.url.length) {
+      result.url = [...entity.url];
+    }
+  }
+  if (Array.isArray(entity.contact)) {
+    const contacts = [];
+    for (const contact of entity.contact) {
+      if (!contact || typeof contact !== "object" || Array.isArray(contact)) {
+        continue;
+      }
+      const reduced = {};
+      for (const field of ["name", "email", "phone"]) {
+        if (typeof contact[field] === "string" && contact[field].trim()) {
+          reduced[field] = contact[field].trim();
+        }
+      }
+      if (Object.keys(reduced).length) {
+        contacts.push(reduced);
+      }
+    }
+    if (contacts.length) {
+      result.contact = contacts;
+    }
+  }
+  return result;
+}
+
 /**
  * Given the specified package, create a CycloneDX component and add it to the list.
  */
@@ -1192,7 +1251,9 @@ export function addComponent(
     const description = pkg.description || undefined;
     let compScope = pkg.scope;
     let isTypeOnlyPkg = false;
-    if (allImports) {
+    // addEvidenceForImports flags an installed version that none of the
+    // project's imports resolve to; its name matching an import is no use.
+    if (allImports && !pkg._npmImportsResolveElsewhere) {
       const impPkgs = Object.keys(allImports);
       const hasBinCommandEvidence = hasNpmBinCommandEvidence(allImports, pkg);
       if (
@@ -1281,6 +1342,24 @@ export function addComponent(
       delete component.swhid;
     }
     processHashes(pkg, component);
+    // A collector that resolved the organisations behind a component keeps
+    // them here: the AI collectors record the Hugging Face namespace that
+    // published a model or dataset as the supplier, and the organisation
+    // that created a model as the manufacturer. The supplier is a valid
+    // component field in every spec version cdxgen emits; the manufacturer
+    // arrived in CycloneDX 1.6. Only a well-formed organisational entity is
+    // copied, so a collector that puts a string url or a build string on the
+    // package cannot make the BOM fail schema validation.
+    const supplier = toOrganizationalEntity(pkg.supplier);
+    if (supplier) {
+      component.supplier = supplier;
+    }
+    if (options.specVersion >= 1.6) {
+      const manufacturer = toOrganizationalEntity(pkg.manufacturer);
+      if (manufacturer) {
+        component.manufacturer = manufacturer;
+      }
+    }
     // Upgrade authors section
     if (options.specVersion >= 1.6 && component.author) {
       const authorsList = [];