@cyclonedx/cdxgen 12.3.3 → 12.4.0

package/lib/cli/index.js

@@ -11,7 +11,6 @@ import { platform as _platform, arch, homedir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import process from "node:process";
 
-import got from "got";
 import { PackageURL } from "packageurl-js";
 import { gte, lte } from "semver";
 import { parse } from "ssri";
@@ -35,8 +34,15 @@ import {
   detectPythonMcpInventory,
   findJSImportsExports,
 } from "../helpers/analyzer.js";
+import {
+  cleanupAsarTempDir,
+  extractAsarToTempDir,
+  parseAsarArchive,
+  rewriteExtractedArchivePaths,
+} from "../helpers/asarutils.js";
 import { expandBomAuditCategories } from "../helpers/auditCategories.js";
 import { parseCaxaMetadata } from "../helpers/caxa.js";
+import { collectSourceCryptoComponents } from "../helpers/cbomutils.js";
 import {
   CHROME_EXTENSION_PURL_TYPE,
   collectChromeExtensionsFromPath,
@@ -49,15 +55,19 @@ import {
   trimComponents,
 } from "../helpers/depsUtils.js";
 import { GIT_COMMAND } from "../helpers/envcontext.js";
-import { thoughtLog } from "../helpers/logger.js";
 import {
-  classifyMcpReference,
-  enrichComponentWithMcpMetadata,
-} from "../helpers/mcp.js";
+  createHbomDocument,
+  ensureHbomRuntimeSupport,
+  ensureNoMixedHbomProjectTypes,
+  hasHbomProjectType,
+} from "../helpers/hbom.js";
+import { mergeHostInventoryBoms } from "../helpers/hostTopology.js";
+import { thoughtLog } from "../helpers/logger.js";
+import { enrichComponentWithMcpMetadata } from "../helpers/mcp.js";
 import { isPyLockFile } from "../helpers/pylockutils.js";
 import {
   buildDependencyTrackBomPayload,
-  getDependencyTrackBomUrl,
+  getDependencyTrackBomApiUrl,
 } from "../helpers/remote/dependency-track.js";
 import { table } from "../helpers/table.js";
 import {
@@ -71,6 +81,7 @@ import {
   CARGO_CMD,
   CDXGEN_VERSION,
   CLJ_CMD,
+  cdxgenAgent,
   checksumFile,
   cleanupPlugin,
   collectGemModuleNames,
@@ -111,6 +122,7 @@ import {
   getTmpDir,
   hasAnyProjectType,
   includeMavenTestScope,
+  isAllowedHttpHost,
   isDryRun,
   isFeatureEnabled,
   isMac,
@@ -201,6 +213,7 @@ import {
   readZipEntry,
   recomputeScope,
   recordActivity,
+  recordSensitiveFileRead,
   resetActivityContext,
   SWIFT_CMD,
   safeExistsSync,
@@ -226,10 +239,12 @@ import {
   VSCODE_EXTENSION_PURL_TYPE,
 } from "../helpers/vsixutils.js";
 import {
+  enrichOSComponentsWithTrustData,
   executeOsQuery,
   getBinaryBom,
   getDotnetSlices,
   getOSPackages,
+  getPluginToolComponents,
 } from "../managers/binary.js";
 import {
   addSkippedSrcFiles,
@@ -369,6 +384,18 @@ const shouldIncludeNodeModulesDir = (options = {}, baseProjectTypes = []) => {
   );
 };
 
+const hasExplicitProjectTypeSelection = (options, baseProjectType) => {
+  options = options || {};
+  const projectTypes = Array.isArray(options.projectType)
+    ? options.projectType
+    : options.projectType
+      ? [options.projectType]
+      : [];
+  return projectTypes.some((selectedProjectType) =>
+    PROJECT_TYPE_ALIASES[baseProjectType]?.includes(selectedProjectType),
+  );
+};
+
 const determineParentComponent = (options) => {
   let parentComponent;
   if (options.parentComponent && Object.keys(options.parentComponent).length) {
@@ -840,6 +867,18 @@ function addMetadata(parentComponent = {}, options = {}, context = {}) {
         value: options.allOSComponentTypes.sort().join("\\n"),
       });
     }
+    if (Number.isInteger(options?.unpackagedExecutableCount)) {
+      mproperties.push({
+        name: "cdx:container:unpackagedExecutableCount",
+        value: String(options.unpackagedExecutableCount),
+      });
+    }
+    if (Number.isInteger(options?.unpackagedSharedLibraryCount)) {
+      mproperties.push({
+        name: "cdx:container:unpackagedSharedLibraryCount",
+        value: String(options.unpackagedSharedLibraryCount),
+      });
+    }
     // Should we move these to formulation?
     if (options?.bundledSdks?.length) {
       for (const sdk of options.bundledSdks) {
@@ -943,6 +982,9 @@ export function listComponents(options, allImports, pkg, ptype = "npm") {
   return Object.keys(compMap).map((k) => compMap[k]);
 }
 
+// These component types do not have PURLs
+const NON_PURL_TYPES = ["cryptographic-asset", "file", "data"];
+
 /**
  * Given the specified package, create a CycloneDX component and add it to the list.
  */
@@ -979,9 +1021,9 @@ function addComponent(
     }
     const version = pkg.version || "";
     const licenses = pkg.licenses || getLicenses(pkg);
-    let purl =
-      pkg.purl ||
-      new PackageURL(
+    let purl = pkg.purl;
+    if (!purl && ptype) {
+      purl = new PackageURL(
         ptype,
         encodeForPurl(group),
         encodeForPurl(name),
@@ -989,9 +1031,9 @@ function addComponent(
         pkg.qualifiers,
         encodeForPurl(pkg.subpath),
       );
-    let purlString = purl.toString();
-    // There is no purl for cryptographic-asset
-    if (ptype === "cryptographic-asset") {
+    }
+    let purlString = purl?.toString();
+    if (NON_PURL_TYPES.includes(ptype) || NON_PURL_TYPES.includes(pkg.type)) {
       purl = undefined;
       purlString = undefined;
     }
@@ -1102,7 +1144,7 @@ function addComponent(
     if (pkg.properties?.length) {
       component.properties = pkg.properties;
     }
-    if (pkg.cryptoProperties?.length) {
+    if (pkg.cryptoProperties && typeof pkg.cryptoProperties === "object") {
       component.cryptoProperties = pkg.cryptoProperties;
     }
     // Retain nested components
@@ -2769,11 +2811,10 @@ export async function createJavaBom(path, options) {
 }
 
 /**
- * Function to create bom string for Node.js projects
+ * Identify the requested AI inventory project types.
  *
- * @param {string} path to the project
  * @param {Object} options Parse options from the cli
- * @returns {Promise<Object>} Promise resolving to BOM object
+ * @returns {string[]} Requested AI inventory types
  */
 function getRequestedAiInventoryTypes(options) {
   return AI_INVENTORY_PROJECT_TYPES.filter((type) =>
@@ -2787,6 +2828,48 @@ function getExcludedAiInventoryTypes(options) {
   );
 }
 
+function filterIncludedAiInventoryTypes(
+  includedAiInventoryTypes,
+  excludedAiInventoryTypes,
+) {
+  return [...new Set(includedAiInventoryTypes)].filter(
+    (type) => !excludedAiInventoryTypes.includes(type),
+  );
+}
+
+/**
+ * Determine which AI inventory types should be collected for a scan.
+ *
+ * This combines explicit project-type opt-ins with BOM audit category-driven
+ * opt-ins, then removes any explicitly excluded inventory types.
+ *
+ * @param {Object} options Parse options from the CLI
+ * @returns {string[]} AI inventory types to collect
+ */
+function getIncludedAiInventoryTypes(options) {
+  const requestedAiInventoryTypes = getRequestedAiInventoryTypes(options);
+  const excludedAiInventoryTypes = getExcludedAiInventoryTypes(options);
+  const exactAiInventoryType = getExactAiInventoryType(options);
+  if (exactAiInventoryType) {
+    return filterIncludedAiInventoryTypes(
+      requestedAiInventoryTypes,
+      excludedAiInventoryTypes,
+    );
+  }
+  const auditCategories = expandBomAuditCategories(options?.bomAuditCategories);
+  const includedAiInventoryTypes = [...requestedAiInventoryTypes];
+  if (auditCategories.includes("ai-agent")) {
+    includedAiInventoryTypes.push("ai-skill");
+  }
+  if (auditCategories.includes("mcp-server")) {
+    includedAiInventoryTypes.push("mcp");
+  }
+  return filterIncludedAiInventoryTypes(
+    includedAiInventoryTypes,
+    excludedAiInventoryTypes,
+  );
+}
+
 function getExactAiInventoryType(options) {
   const requestedAiInventoryTypes = getRequestedAiInventoryTypes(options);
   return requestedAiInventoryTypes.length === 1 &&
@@ -2796,22 +2879,14 @@ function getExactAiInventoryType(options) {
     : undefined;
 }
 
-function shouldDetectMcpInventory(options, allImports = {}) {
-  if (hasAnyProjectType(["mcp"], options, false)) {
-    return true;
-  }
-  const auditCategories = expandBomAuditCategories(options?.bomAuditCategories);
-  if (
-    auditCategories.some((category) =>
-      ["mcp-server", "ai-agent"].includes(category),
-    )
-  ) {
-    return true;
-  }
-  return Object.keys(allImports).some((importName) => {
-    const classification = classifyMcpReference(importName);
-    return classification.isMcp;
-  });
+/**
+ * Determine whether MCP source-code analysis should run for the current scan.
+ *
+ * @param {string[]} includedAiInventoryTypes AI inventory types selected for collection
+ * @returns {boolean} True when MCP inventory collection is enabled
+ */
+function shouldDetectMcpInventory(includedAiInventoryTypes) {
+  return includedAiInventoryTypes.includes("mcp");
 }
 
 function summarizeAiInventoryNames(subjects, discoveryPath, kindSet) {
@@ -2906,14 +2981,8 @@ export async function createNodejsBom(path, options) {
   let parentComponent = {};
   const parentSubComponents = [];
   let ppurl = "";
-  const requestedAiInventoryTypes = getRequestedAiInventoryTypes(options);
-  const excludedAiInventoryTypes = getExcludedAiInventoryTypes(options);
   const exactAiInventoryType = getExactAiInventoryType(options);
-  const includedAiInventoryTypes = exactAiInventoryType
-    ? requestedAiInventoryTypes
-    : AI_INVENTORY_PROJECT_TYPES.filter(
-        (type) => !excludedAiInventoryTypes.includes(type),
-      );
+  const includedAiInventoryTypes = getIncludedAiInventoryTypes(options);
   let aiInventory = { components: [], dependencies: [], services: [] };
   // Docker mode requires special handling
   if (hasAnyProjectType(["docker", "oci", "container", "os"], options, false)) {
@@ -2965,16 +3034,13 @@ export async function createNodejsBom(path, options) {
     const retData = await findJSImportsExports(path, options.deep);
     allImports = retData.allImports;
     allExports = retData.allExports;
-    if (shouldDetectMcpInventory(options, allImports)) {
+    if (shouldDetectMcpInventory(includedAiInventoryTypes)) {
       mcpInventory = detectMcpInventory(path, options.deep);
     }
   }
   if (includedAiInventoryTypes.length) {
     aiInventory = collectAiInventory(path, options, includedAiInventoryTypes);
   }
-  if (excludedAiInventoryTypes.includes("mcp")) {
-    mcpInventory = { components: [], dependencies: [], services: [] };
-  }
   const aiInventorySummary = summarizeAiInventory(aiInventory);
   if (!exactAiInventoryType) {
     if (aiInventorySummary.instructionCount || aiInventorySummary.skillCount) {
@@ -2987,7 +3053,6 @@ export async function createNodejsBom(path, options) {
         `I found ${aiInventorySummary.mcpConfigCount} MCP config component(s). Use '--exclude-type mcp' to drop them, or '--bom-audit --bom-audit-categories ai-inventory --tlp-classification AMBER' to keep and flag them.`,
       );
     }
-    emitAiInventorySummary(aiInventory, path);
   }
   if (exactAiInventoryType === "ai-skill") {
     const exactComponents = trimComponents([...(aiInventory.components || [])]);
@@ -3167,11 +3232,15 @@ export async function createNodejsBom(path, options) {
       }
       const basePath = dirname(apkgJson);
       let npmrcData;
-      if (safeExistsSync(join(basePath, ".npmrc"))) {
+      const npmrcFile = join(basePath, ".npmrc");
+      if (safeExistsSync(npmrcFile)) {
         thoughtLog(
           "Wait, there is a .npmrc file here! I'm going to check if it has anything malicious.",
         );
-        npmrcData = readFileSync(join(basePath, ".npmrc"), "utf-8");
+        npmrcData = readFileSync(npmrcFile, "utf-8");
+        recordSensitiveFileRead(npmrcFile, {
+          label: "npm registry configuration",
+        });
         const npmrcObj = parseNpmrc(npmrcData);
         for (const [key, value] of Object.entries(npmrcObj)) {
           const baseKey = key.replace(/^(?:\/\/[^/]+\/|@[^:]+:)/, "");
@@ -4102,14 +4171,7 @@ export async function createPythonBom(path, options) {
   let dependencies = [];
   let pkgList = [];
   let formulationList = [];
-  const requestedAiInventoryTypes = getRequestedAiInventoryTypes(options);
-  const excludedAiInventoryTypes = getExcludedAiInventoryTypes(options);
-  const includedAiInventoryTypes = AI_INVENTORY_PROJECT_TYPES.filter(
-    (type) =>
-      (!requestedAiInventoryTypes.length ||
-        requestedAiInventoryTypes.includes(type)) &&
-      !excludedAiInventoryTypes.includes(type),
-  );
+  const includedAiInventoryTypes = getIncludedAiInventoryTypes(options);
   let aiInventory = { components: [], dependencies: [], services: [] };
   let mcpInventory = { components: [], dependencies: [], services: [] };
   const tempDir = safeMkdtempSync(join(getTmpDir(), "cdxgen-venv-"));
@@ -5955,6 +6017,7 @@ export function createOSBom(_path, options) {
   let pkgList = [];
   let bomData = {};
   let parentComponent = {};
+  let externalTools = getPluginToolComponents(["osquery"]);
   for (const queryCategory of Object.keys(osQueries)) {
     const queryObj = osQueries[queryCategory];
     const results = executeOsQuery(queryObj.query);
@@ -5973,6 +6036,20 @@ export function createOSBom(_path, options) {
       );
     }
   } // for
+  const hostTrustInventory = enrichOSComponentsWithTrustData(pkgList);
+  if (hostTrustInventory?.components?.length) {
+    pkgList = hostTrustInventory.components;
+  }
+  if (hostTrustInventory?.tools?.length) {
+    externalTools = externalTools.concat(hostTrustInventory.tools);
+  }
+  if (externalTools.length) {
+    options.tools = Array.from(
+      new Map(
+        externalTools.map((tool) => [tool["bom-ref"] || tool.name, tool]),
+      ).values(),
+    );
+  }
   if (pkgList.length) {
     bomData = buildBomNSData(options, pkgList, "", {
       src: "",
@@ -7776,6 +7853,10 @@ export async function createVscodeExtensionBom(path, options) {
   let pkgList = [];
   let dependencies = [];
   const tempDirs = [];
+  const shouldDiscoverInstalledIdeExtensions = hasExplicitProjectTypeSelection(
+    options,
+    "vscode-extension",
+  );
 
   // Mode 1: Scan for .vsix files in the given directory, or treat the input
   // path as a single .vsix file.
@@ -7821,7 +7902,7 @@ export async function createVscodeExtensionBom(path, options) {
   }
 
   // Mode 2: Auto-discover extensions from known IDE locations
-  if (options.deep || options.projectType?.includes("ide-extensions")) {
+  if (shouldDiscoverInstalledIdeExtensions) {
     const ideDirs = discoverIdeExtensionDirs();
     if (ideDirs.length) {
       if (DEBUG_MODE) {
@@ -7863,6 +7944,198 @@ export async function createVscodeExtensionBom(path, options) {
   });
 }
 
+/**
+ * Function to create BOM for Electron ASAR archives.
+ *
+ * @param {string} path to a single archive or a directory to scan
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export async function createAsarBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let parentComponent = {};
+  const tempDirs = [];
+  const processedArchives = new Set();
+  const maxNestedAsarDepth = 4;
+  const explicitAsarPath = path.endsWith(".asar") ? resolve(path) : undefined;
+  const asarFiles = explicitAsarPath
+    ? [explicitAsarPath]
+    : getAllFiles(path, `${options.multiProject ? "**/" : ""}*.asar`, options);
+
+  const aggregateArchiveResults = (
+    archiveAnalysis,
+    isPrimaryArchive = false,
+  ) => {
+    if (
+      archiveAnalysis.parentComponent &&
+      Object.keys(archiveAnalysis.parentComponent).length
+    ) {
+      if (isPrimaryArchive && !Object.keys(parentComponent).length) {
+        parentComponent = archiveAnalysis.parentComponent;
+      } else {
+        pkgList.push(archiveAnalysis.parentComponent);
+      }
+    }
+    if (archiveAnalysis.components?.length) {
+      pkgList = pkgList.concat(archiveAnalysis.components);
+    }
+    if (archiveAnalysis.dependencies?.length) {
+      dependencies = mergeDependencies(
+        dependencies,
+        archiveAnalysis.dependencies,
+        parentComponent,
+      );
+    }
+  };
+
+  const analyzeExtractedArchive = async (
+    extractedDir,
+    archiveAnalysis,
+    archiveIdentityPath,
+  ) => {
+    if (!archiveAnalysis.packageManifestPaths?.length) {
+      return undefined;
+    }
+    const nodeBomOptions = {
+      ...options,
+      installDeps: false,
+      multiProject: true,
+      noBabel: false,
+      path: extractedDir,
+      projectType: ["js"],
+    };
+    const nodeBomData = await createNodejsBom(extractedDir, nodeBomOptions);
+    if (nodeBomData?.bomJson?.components?.length) {
+      rewriteExtractedArchivePaths(
+        nodeBomData.bomJson.components,
+        extractedDir,
+        archiveIdentityPath,
+      );
+      pkgList = pkgList.concat(nodeBomData.bomJson.components);
+    }
+    if (nodeBomData?.bomJson?.dependencies?.length) {
+      dependencies = mergeDependencies(
+        dependencies,
+        nodeBomData.bomJson.dependencies,
+      );
+    }
+    if (
+      archiveAnalysis.parentComponent?.["bom-ref"] &&
+      nodeBomData?.parentComponent?.["bom-ref"] &&
+      archiveAnalysis.parentComponent["bom-ref"] !==
+        nodeBomData.parentComponent["bom-ref"]
+    ) {
+      rewriteExtractedArchivePaths(
+        nodeBomData.parentComponent,
+        extractedDir,
+        archiveIdentityPath,
+      );
+      dependencies = mergeDependencies(dependencies, [
+        {
+          ref: archiveAnalysis.parentComponent["bom-ref"],
+          dependsOn: [nodeBomData.parentComponent["bom-ref"]],
+        },
+      ]);
+    }
+    return nodeBomData;
+  };
+
+  const processAsarArchive = async (
+    archivePath,
+    archiveIdentityPath,
+    isPrimaryArchive = false,
+    depth = 0,
+  ) => {
+    const processedKey = archiveIdentityPath;
+    if (processedArchives.has(processedKey)) {
+      return undefined;
+    }
+    processedArchives.add(processedKey);
+    const archiveAnalysis = await parseAsarArchive(archivePath, {
+      ...options,
+      asarVirtualPath: archiveIdentityPath,
+    });
+    aggregateArchiveResults(archiveAnalysis, isPrimaryArchive);
+    const shouldExtract =
+      archiveAnalysis.packageManifestPaths?.length ||
+      (depth < maxNestedAsarDepth &&
+        archiveAnalysis.summary?.nestedArchiveCount > 0);
+    if (!shouldExtract) {
+      return archiveAnalysis.parentComponent?.["bom-ref"];
+    }
+    const extractedDir = await extractAsarToTempDir(archivePath);
+    if (!extractedDir) {
+      return archiveAnalysis.parentComponent?.["bom-ref"];
+    }
+    tempDirs.push(extractedDir);
+    await analyzeExtractedArchive(
+      extractedDir,
+      archiveAnalysis,
+      archiveIdentityPath,
+    );
+    if (depth < maxNestedAsarDepth) {
+      const nestedAsarFiles = getAllFiles(extractedDir, "**/*.asar", options);
+      for (const nestedArchivePath of nestedAsarFiles) {
+        const relativeNestedArchivePath = relative(
+          extractedDir,
+          nestedArchivePath,
+        ).replaceAll("\\", "/");
+        if (
+          !relativeNestedArchivePath ||
+          relativeNestedArchivePath.startsWith("..")
+        ) {
+          continue;
+        }
+        const nestedArchiveIdentityPath = `${archiveIdentityPath}#/${relativeNestedArchivePath}`;
+        const nestedParentRef = await processAsarArchive(
+          nestedArchivePath,
+          nestedArchiveIdentityPath,
+          false,
+          depth + 1,
+        );
+        if (
+          archiveAnalysis.parentComponent?.["bom-ref"] &&
+          nestedParentRef &&
+          archiveAnalysis.parentComponent["bom-ref"] !== nestedParentRef
+        ) {
+          dependencies = mergeDependencies(dependencies, [
+            {
+              ref: archiveAnalysis.parentComponent["bom-ref"],
+              dependsOn: [nestedParentRef],
+            },
+          ]);
+        }
+      }
+    }
+    return archiveAnalysis.parentComponent?.["bom-ref"];
+  };
+  try {
+    for (const archivePath of asarFiles) {
+      const isPrimaryArchive =
+        explicitAsarPath && resolve(archivePath) === explicitAsarPath;
+      await processAsarArchive(
+        archivePath,
+        resolve(archivePath),
+        isPrimaryArchive,
+        0,
+      );
+    }
+  } finally {
+    for (const tempDir of tempDirs) {
+      cleanupAsarTempDir(tempDir);
+    }
+  }
+  pkgList = trimComponents(pkgList);
+  return buildBomNSData(options, pkgList, "asar", {
+    src: path,
+    filename: asarFiles.join(", "),
+    nsMapping: {},
+    dependencies,
+    parentComponent,
+  });
+}
+
 /**
  * Function to create BOM for installed Chrome and Chromium-based browser extensions.
  *
@@ -7874,7 +8147,8 @@ export async function createChromeExtensionBom(path, options) {
   let dependencies = [];
   let sourcePaths = [];
   const directResult = collectChromeExtensionsFromPath(path);
-  const chromeDirs = discoverChromiumExtensionDirs();
+  const shouldDiscoverInstalledChromeExtensions =
+    hasExplicitProjectTypeSelection(options, "chrome-extension");
   let pkgList = directResult.components || [];
   if (directResult.extensionDirs?.length) {
     sourcePaths = directResult.extensionDirs.slice();
@@ -7893,20 +8167,23 @@ export async function createChromeExtensionBom(path, options) {
       `Found ${pkgList.length} component(s) from direct Chrome extension path scan`,
     );
   }
-  if (chromeDirs.length) {
-    if (DEBUG_MODE) {
-      thoughtLog(
-        `Discovered Chromium extension directories: ${chromeDirs.map((d) => `${d.browser} (${d.channel}): ${d.dir}`).join(", ")}`,
-      );
-    }
-    if (!pkgList.length) {
-      pkgList = collectInstalledChromeExtensions(chromeDirs);
-      sourcePaths = chromeDirs.map((d) => d.dir);
-    }
-    if (DEBUG_MODE && pkgList.length && !directResult.components?.length) {
-      thoughtLog(
-        `Found ${pkgList.length} Chrome/Chromium extension(s) from ${chromeDirs.length} browser location(s)`,
-      );
+  if (shouldDiscoverInstalledChromeExtensions) {
+    const chromeDirs = discoverChromiumExtensionDirs();
+    if (chromeDirs.length) {
+      if (DEBUG_MODE) {
+        thoughtLog(
+          `Discovered Chromium extension directories: ${chromeDirs.map((d) => `${d.browser} (${d.channel}): ${d.dir}`).join(", ")}`,
+        );
+      }
+      if (!pkgList.length) {
+        pkgList = collectInstalledChromeExtensions(chromeDirs);
+        sourcePaths = chromeDirs.map((d) => d.dir);
+      }
+      if (DEBUG_MODE && pkgList.length && !directResult.components?.length) {
+        thoughtLog(
+          `Found ${pkgList.length} Chrome/Chromium extension(s) from ${chromeDirs.length} browser location(s)`,
+        );
+      }
     }
   }
   pkgList = trimComponents(pkgList);
@@ -8026,6 +8303,26 @@ export async function createCryptoCertsBom(path, options) {
   for (const f of certFiles) {
     const name = basename(f);
     const fileHash = await checksumFile("sha256", f);
+    let evidence;
+    if (options.evidence) {
+      const identityEvidence = {
+        field: "name",
+        confidence: 1,
+        concludedValue: name,
+        methods: [
+          {
+            technique: "filename",
+            confidence: 1,
+            value: f,
+          },
+        ],
+      };
+      evidence = {
+        identity:
+          options.specVersion >= 1.6 ? [identityEvidence] : identityEvidence,
+        occurrences: [{ location: f }],
+      };
+    }
     const apkg = {
       name,
       type: "cryptographic-asset",
@@ -8038,10 +8335,18 @@ export async function createCryptoCertsBom(path, options) {
           implementationPlatform: "unknown",
         },
       },
+      ...(evidence ? { evidence } : {}),
       properties: [{ name: "SrcFile", value: f }],
     };
     pkgList.push(apkg);
   }
+  const sourceCryptoComponents = await collectSourceCryptoComponents(
+    path,
+    options,
+  );
+  if (sourceCryptoComponents.length) {
+    pkgList.push(...sourceCryptoComponents);
+  }
   return {
     bomJson: {
       components: pkgList,
@@ -8132,6 +8437,7 @@ export async function createMultiXBom(pathList, options) {
   ) {
     const {
       osPackages,
+      osPackageFiles,
       dependenciesList,
       allTypes,
       bundledSdks,
@@ -8139,6 +8445,7 @@ export async function createMultiXBom(pathList, options) {
       binPaths,
       executables,
       sharedLibs,
+      services,
       tools,
     } = await getOSPackages(
       options.allLayersExplodedDir,
@@ -8149,14 +8456,16 @@ export async function createMultiXBom(pathList, options) {
     options.bundledSdks = bundledSdks;
     options.bundledRuntimes = bundledRuntimes;
     options.binPaths = binPaths;
+    options.unpackagedExecutableCount = executables?.length || 0;
+    options.unpackagedSharedLibraryCount = sharedLibs?.length || 0;
     if (DEBUG_MODE) {
       console.log(
-        `**OS**: Found ${osPackages.length} OS packages, ${executables?.length} executables, and ${sharedLibs.length} shared libraries at ${options.allLayersExplodedDir}`,
+        `**OS**: Found ${osPackages.length} OS packages, ${osPackageFiles?.length} package-owned files, ${executables?.length} unpackaged executables, ${sharedLibs.length} unpackaged shared libraries, and ${services?.length || 0} packaged services at ${options.allLayersExplodedDir}`,
       );
     }
     if (osPackages.length) {
       thoughtLog(
-        `I found ${osPackages.length} OS packages and ${executables?.length} executables at ${options.allLayersExplodedDir}`,
+        `I found ${osPackages.length} OS packages, ${osPackageFiles?.length || 0} package-owned files, and ${services?.length || 0} packaged services at ${options.allLayersExplodedDir}`,
       );
     } else if (executables?.length || sharedLibs?.length) {
       thoughtLog(
@@ -8178,14 +8487,20 @@ export async function createMultiXBom(pathList, options) {
       ).concat(tools);
     }
     components = components.concat(osPackages);
+    components = components.concat(osPackageFiles || []);
     components = components.concat(executables);
     components = components.concat(sharedLibs);
     if (dependenciesList?.length) {
       dependencies = mergeDependencies(dependencies, dependenciesList);
     }
+    if (services?.length) {
+      options.services = mergeServices(options.services || [], services);
+    }
     if (parentComponent && Object.keys(parentComponent).length) {
       // Make the parent oci image depend on all os components
-      const parentDependsOn = new Set(osPackages.map((p) => p["bom-ref"]));
+      const parentDependsOn = new Set(
+        osPackages.concat(osPackageFiles || []).map((p) => p["bom-ref"]),
+      );
       dependencies.splice(0, 0, {
         ref: parentComponent["bom-ref"],
         dependsOn: Array.from(parentDependsOn).sort(),
@@ -8887,6 +9202,28 @@ export async function createMultiXBom(pathList, options) {
         }
       }
     }
+    if (hasAnyProjectType(["asar"], options)) {
+      setProjectTypeActivityContext("asar", path);
+      bomData = await createAsarBom(path, options);
+      if (bomData?.bomJson?.components?.length) {
+        if (DEBUG_MODE) {
+          console.log(
+            `Found ${bomData.bomJson.components.length} ASAR component(s) at ${path}`,
+          );
+        }
+        components = components.concat(bomData.bomJson.components);
+        dependencies = mergeDependencies(
+          dependencies,
+          bomData.bomJson.dependencies,
+        );
+        if (
+          bomData.parentComponent &&
+          Object.keys(bomData.parentComponent).length
+        ) {
+          parentSubComponents.push(bomData.parentComponent);
+        }
+      }
+    }
     if (hasAnyProjectType(["vscode-extension"], options)) {
       setProjectTypeActivityContext("vscode-extension", path);
       bomData = await createVscodeExtensionBom(path, options);
@@ -9326,6 +9663,16 @@ export async function createXBom(path, options) {
     return await createVscodeExtensionBom(path, options);
   }
 
+  // Electron ASAR archives
+  const asarFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.asar`,
+    options,
+  );
+  if (asarFiles.length) {
+    return await createAsarBom(path, options);
+  }
+
   // Helm charts
   const chartFiles = getAllFiles(
     path,
@@ -9428,6 +9775,35 @@ export async function createXBom(path, options) {
   }
 }
 
+/**
+ * Function to create a hardware BOM for the current host.
+ *
+ * @param {string} _path Source path (unused for live host HBOM generation)
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} Promise resolving to BOM object
+ */
+export async function createHBom(_path, options) {
+  ensureHbomRuntimeSupport(options, options.commandName || "hbom");
+  let bomJson = await createHbomDocument(options);
+  if (options.includeRuntime) {
+    const runtimeOptions = {
+      ...options,
+      includeRuntime: false,
+      multiProject: false,
+      projectType: ["os"],
+    };
+    const obomData = await createOSBom(_path, runtimeOptions);
+    bomJson = mergeHostInventoryBoms(bomJson, obomData);
+  } else {
+    bomJson = mergeHostInventoryBoms(bomJson);
+  }
+  return {
+    bomJson,
+    dependencies: bomJson.dependencies || [],
+    parentComponent: bomJson.metadata?.component,
+  };
+}
+
 /**
  * Function to create bom string for various languages
  *
@@ -9440,6 +9816,21 @@ export async function createBom(path, options) {
   if (!projectType) {
     projectType = [];
   }
+  ensureNoMixedHbomProjectTypes(projectType);
+  if (hasHbomProjectType(projectType)) {
+    const selectedHbomProjectType = Array.isArray(projectType)
+      ? projectType[0]
+      : `${projectType}`.split(",")[0];
+    options.projectType = [selectedHbomProjectType];
+    setActivityContext({
+      projectType: selectedHbomProjectType,
+      sourcePath: path,
+    });
+    thoughtLog(
+      "The user wants a Hardware Bill-of-Materials (HBOM) for the current host. Let's use the dedicated hardware collector.",
+    );
+    return await createHBom(path, options);
+  }
   let exportData;
   let isContainerMode = false;
   const isLocalDirectoryInput =
@@ -9574,6 +9965,9 @@ export async function createBom(path, options) {
   if (path.endsWith(".war")) {
     projectType = ["java"];
   }
+  if (!projectType.length && path.endsWith(".asar")) {
+    projectType = ["asar"];
+  }
   if (projectType.length > 1) {
     setActivityContext({
       projectType: projectType.join(","),
@@ -9697,6 +10091,9 @@ export async function createBom(path, options) {
   if (PROJECT_TYPE_ALIASES["caxa"].includes(projectType[0])) {
     return await createCaxaBom(path, options);
   }
+  if (PROJECT_TYPE_ALIASES["asar"].includes(projectType[0])) {
+    return await createAsarBom(path, options);
+  }
   if (PROJECT_TYPE_ALIASES["vscode-extension"].includes(projectType[0])) {
     return await createVscodeExtensionBom(path, options);
   }
@@ -9741,17 +10138,33 @@ export async function createBom(path, options) {
  * @throws {Error} if the request fails
  */
 export async function submitBom(args, bomContents) {
+  const dependencyTrackApiUrl = getDependencyTrackBomApiUrl(args.serverUrl);
+  const serverUrl = dependencyTrackApiUrl?.toString();
+  if (!dependencyTrackApiUrl || !serverUrl) {
+    console.log(
+      "Invalid Dependency-Track server URL. Provide an absolute http(s) URL without dangerous characters.",
+    );
+    args.failOnError && process.exit(1);
+    return undefined;
+  }
+  const serverHost = dependencyTrackApiUrl.hostname;
+  if (!isAllowedHttpHost(serverHost)) {
+    console.log(
+      `Dependency-Track server host '${serverHost}' is not allowed by CDXGEN_ALLOWED_HOSTS.`,
+    );
+    args.failOnError && process.exit(1);
+    return undefined;
+  }
   if (isDryRun) {
     recordActivity({
       kind: "network",
       reason:
         "Dry run mode blocks Dependency-Track submission and reports the request instead.",
       status: "blocked",
-      target: getDependencyTrackBomUrl(args.serverUrl),
+      target: serverUrl,
     });
     return undefined;
   }
-  const serverUrl = getDependencyTrackBomUrl(args.serverUrl);
   const bomPayload = buildDependencyTrackBomPayload(args, bomContents);
   if (!bomPayload) {
     console.log(
@@ -9770,15 +10183,7 @@ export async function submitBom(args, bomContents) {
     );
   }
   try {
-    if (DEBUG_MODE && args.skipDtTlsCheck) {
-      console.log(
-        "Calling ",
-        serverUrl,
-        "with --skip-dt-tls-check argument: Skip DT TLS check.",
-      );
-    }
-    // See issue #1963 regarding CRLF hardening
-    return await got(serverUrl, {
+    const requestOptions = {
       method: "PUT",
       followRedirect: false,
       https: {
@@ -9787,11 +10192,22 @@ export async function submitBom(args, bomContents) {
       headers: {
         "X-Api-Key": (args.apiKey || "").replace(/[\r\n]/g, ""),
         "Content-Type": "application/json",
-        "user-agent": `@CycloneDX/cdxgen ${CDXGEN_VERSION}`,
       },
       json: bomPayload,
       responseType: "json",
-    }).json();
+      context: {
+        activityIntent: "bom-submit",
+      },
+    };
+    if (DEBUG_MODE && args.skipDtTlsCheck) {
+      console.log(
+        "Calling ",
+        serverUrl,
+        "with --skip-dt-tls-check argument: Skip DT TLS check.",
+      );
+    }
+    // See issue #1963 regarding CRLF hardening
+    return await cdxgenAgent(dependencyTrackApiUrl, requestOptions).json();
   } catch (error) {
     if (error.response && error.response.statusCode === 401) {
       // Unauthorized
@@ -9804,7 +10220,7 @@ export async function submitBom(args, bomContents) {
       );
       // Method not allowed errors
       try {
-        return await got(serverUrl, {
+        return await cdxgenAgent(dependencyTrackApiUrl, {
           method: "POST",
           followRedirect: false,
           https: {
@@ -9813,10 +10229,12 @@ export async function submitBom(args, bomContents) {
           headers: {
             "X-Api-Key": (args.apiKey || "").replace(/[\r\n]/g, ""),
             "Content-Type": "application/json",
-            "user-agent": `@CycloneDX/cdxgen ${CDXGEN_VERSION}`,
           },
           json: bomPayload,
           responseType: "json",
+          context: {
+            activityIntent: "bom-submit",
+          },
         }).json();
       } catch (error) {
         if (DEBUG_MODE) {