@cyclonedx/cdxgen 12.4.3 → 12.4.4

package/lib/cli/index.js

@@ -42,6 +42,7 @@ import {
 } from "../helpers/asarutils.js";
 import { expandBomAuditCategories } from "../helpers/auditCategories.js";
 import {
+  isCycloneDxComponentTypeEnabled,
   setCycloneDxFormat,
   toCycloneDxSpecVersionString,
 } from "../helpers/bomUtils.js";
@@ -57,8 +58,10 @@ import {
   discoverChromiumExtensionDirs,
 } from "../helpers/chromextutils.js";
 import {
+  filterInvalidCryptoComponents,
   mergeDependencies,
   mergeServices,
+  propagateRequiredScopeFromDependencies,
   trimComponents,
 } from "../helpers/depsUtils.js";
 import {
@@ -192,7 +195,9 @@ import {
   parseLeinDep,
   parseLeiningenData,
   parseMakeDFile,
+  parseMavenArgs,
   parseMavenTree,
+  parseMavenTreeJson,
   parseMillDependency,
   parseMinJs,
   parseMixLockData,
@@ -1727,7 +1732,7 @@ export async function createJavaBom(path, options) {
       }
       // Support for passing additional settings and profile to maven
       if (process.env.MVN_ARGS) {
-        const addArgs = process.env.MVN_ARGS.split(" ");
+        const addArgs = parseMavenArgs(process.env.MVN_ARGS);
         mvnArgs = mvnArgs.concat(addArgs);
       }
       // specVersion 1.4 doesn't support externalReferences.type=distribution-intake
@@ -1804,180 +1809,270 @@ export async function createJavaBom(path, options) {
         result?.status !== 0 ||
         result?.error
       ) {
-        const tempMvnTree = join(basePath, "target", "cdxgen-mvn-tree.txt");
-        const tempMvnParentTree = join(
-          basePath,
-          "target",
+        const tempRoot = getTmpDir();
+        const tempDir = safeMkdtempSync(join(tempRoot, "cdxgen-mvn-"));
+        const tempMvnTree = join(tempDir, "cdxgen-mvn-tree.json");
+        const tempMvnTreeText = join(tempDir, "cdxgen-mvn-tree.txt");
+        const tempMvnParentTree = join(tempDir, "cdxgen-mvn-parent-tree.json");
+        const tempMvnParentTreeText = join(
+          tempDir,
           "cdxgen-mvn-parent-tree.txt",
         );
-        let mvnTreeArgs = ["dependency:tree", `-DoutputFile=${tempMvnTree}`];
-        let addArgs = "";
-        if (process.env.MVN_ARGS) {
-          addArgs = process.env.MVN_ARGS.split(" ");
-          mvnTreeArgs = mvnTreeArgs.concat(addArgs);
-        }
-        // Automatically use settings.xml to improve the success for fallback
-        if (safeExistsSync(settingsXml)) {
-          mvnTreeArgs.push("-s");
-          mvnTreeArgs.push(settingsXml);
-        }
-        // For the first pom alone, we need to execute first in non-recursive mode to capture
-        // the parent component. Then, we execute all of them in recursive mode
-        if (f === firstPom) {
-          thoughtLog(
-            "What is the parent component here? Let's use maven command to find out.",
-          );
-          let findParentComponentArgs = [
+        try {
+          let mvnTreeArgs = [
             "dependency:tree",
-            "-N",
-            `-DoutputFile=${tempMvnParentTree}`,
+            `-DoutputFile=${tempMvnTree}`,
+            "-DoutputType=json",
           ];
-          if (addArgs) {
-            findParentComponentArgs = findParentComponentArgs.concat(addArgs);
+          let addArgs = [];
+          if (process.env.MVN_ARGS) {
+            addArgs = parseMavenArgs(process.env.MVN_ARGS);
+            mvnTreeArgs = mvnTreeArgs.concat(addArgs);
           }
-          result = safeSpawnSync("mvn", findParentComponentArgs, {
-            cwd: basePath,
-            shell: isWin,
-          });
-          if (result.status === 0) {
+          // Automatically use settings.xml to improve the success for fallback
+          if (safeExistsSync(settingsXml)) {
+            mvnTreeArgs.push("-s");
+            mvnTreeArgs.push(settingsXml);
+          }
+          // For the first pom alone, we need to execute first in non-recursive mode to capture
+          // the parent component. Then, we execute all of them in recursive mode
+          if (f === firstPom) {
+            thoughtLog(
+              "What is the parent component here? Let's use maven command to find out.",
+            );
+            let findParentComponentArgs = [
+              "dependency:tree",
+              "-N",
+              `-DoutputFile=${tempMvnParentTree}`,
+              "-DoutputType=json",
+            ];
+            if (addArgs.length) {
+              findParentComponentArgs = findParentComponentArgs.concat(addArgs);
+            }
+            result = safeSpawnSync(mavenCmd, findParentComponentArgs, {
+              cwd: basePath,
+              shell: isWin,
+            });
+            // If json is empty or unparseable, fallback to text parsing
+            let emptyJson = !safeExistsSync(tempMvnParentTree);
             if (safeExistsSync(tempMvnParentTree)) {
               const mvnTreeString = readFileSync(tempMvnParentTree, {
                 encoding: "utf-8",
               });
-              const parsedList = parseMavenTree(mvnTreeString, f);
-              const dlist = parsedList.pkgList;
-              const tmpParentComponent = dlist.splice(0, 1)[0];
-              tmpParentComponent.type = "application";
-              parentComponent = tmpParentComponent;
-              parentComponent.components = [];
-              if (parentComponent.name) {
-                thoughtLog(
-                  `Parent component is called ${parentComponent.name}!`,
-                );
+              const parsedList = parseMavenTreeJson(mvnTreeString, f);
+              if (!parsedList?.pkgList?.length) {
+                emptyJson = true;
+                // Remove the invalid json file so text output is preferred below.
+                if (safeExistsSync(tempMvnParentTree)) {
+                  safeUnlinkSync(tempMvnParentTree);
+                }
+              }
+            }
+            if (result.status !== 0 || result.error || emptyJson) {
+              findParentComponentArgs = [
+                "dependency:tree",
+                "-N",
+                `-DoutputFile=${tempMvnParentTreeText}`,
+              ];
+              if (addArgs.length) {
+                findParentComponentArgs =
+                  findParentComponentArgs.concat(addArgs);
+              }
+              result = safeSpawnSync(mavenCmd, findParentComponentArgs, {
+                cwd: basePath,
+                shell: isWin,
+              });
+            }
+            if (result.status === 0) {
+              const parentTreeFile = safeExistsSync(tempMvnParentTreeText)
+                ? tempMvnParentTreeText
+                : tempMvnParentTree;
+              if (safeExistsSync(parentTreeFile)) {
+                const mvnTreeString = readFileSync(parentTreeFile, {
+                  encoding: "utf-8",
+                });
+                const parsedList = parentTreeFile.endsWith(".json")
+                  ? parseMavenTreeJson(mvnTreeString, f)
+                  : parseMavenTree(mvnTreeString, f);
+                const dlist = parsedList.pkgList || [];
+                if (dlist.length) {
+                  const tmpParentComponent = dlist.splice(0, 1)[0];
+                  tmpParentComponent.type = "application";
+                  parentComponent = tmpParentComponent;
+                  parentComponent.components = [];
+                  if (parentComponent.name) {
+                    thoughtLog(
+                      `Parent component is called ${parentComponent.name}!`,
+                    );
+                  }
+                }
               }
             }
           }
-        }
-        thoughtLog(
-          `**MAVEN**: Let's use Maven to collect packages from ${basePath}.`,
-        );
-        if (DEBUG_MODE) {
-          console.log(`Executing 'mvn dependency:tree ...' in ${basePath}`);
-        }
-        // Prefer the built-in maven
-        result = safeSpawnSync(
-          PREFER_MAVEN_DEPS_TREE ? "mvn" : mavenCmd,
-          mvnTreeArgs,
-          {
+          thoughtLog(
+            `**MAVEN**: Let's use Maven to collect packages from ${basePath}.`,
+          );
+          if (DEBUG_MODE) {
+            console.log(
+              `Executing '${basename(mavenCmd)} dependency:tree ...' in ${basePath}`,
+            );
+          }
+          result = safeSpawnSync(mavenCmd, mvnTreeArgs, {
             cwd: basePath,
             shell: isWin,
-          },
-        );
-        if (result.status !== 0 || result.error) {
-          possible_misses = true;
-          // Our approach to recursively invoking the maven plugin for each sub-module is bound to result in failures
-          // These could be due to a range of reasons that are covered below.
-          if (pomFiles.length === 1 || DEBUG_MODE || PREFER_MAVEN_DEPS_TREE) {
-            if (result.stdout) {
-              console.log(result.stdout);
+          });
+          let emptyJson = !safeExistsSync(tempMvnTree);
+          if (safeExistsSync(tempMvnTree)) {
+            const mvnTreeString = readFileSync(tempMvnTree, {
+              encoding: "utf-8",
+            });
+            const parsedList = parseMavenTreeJson(mvnTreeString, f);
+            if (!parsedList?.pkgList?.length) {
+              emptyJson = true;
+              // Remove the invalid json file so text output is preferred below.
+              if (safeExistsSync(tempMvnTree)) {
+                safeUnlinkSync(tempMvnTree);
+              }
             }
-            if (result.stderr) {
-              console.log(result.stderr);
-              console.log("The above build errors could be due to:\n");
+          }
+          if (result.status !== 0 || result.error || emptyJson) {
+            mvnTreeArgs = [
+              "dependency:tree",
+              `-DoutputFile=${tempMvnTreeText}`,
+            ];
+            if (addArgs.length) {
+              mvnTreeArgs = mvnTreeArgs.concat(addArgs);
             }
-            if (
-              result.stdout &&
-              (result.stdout.includes("Non-resolvable parent POM") ||
-                result.stdout.includes("points at wrong local POM"))
-            ) {
-              console.log(
-                "1. Check if the pom.xml contains valid settings for parent and modules. Some projects can be built only from a specific directory.",
-              );
-            } else if (
-              result.stdout &&
-              (result.stdout.includes("Could not resolve dependencies") ||
-                result.stdout.includes("no dependency information available") ||
-                result.stdout.includes(
-                  "The following artifacts could not be resolved",
-                ))
-            ) {
-              console.log(
-                "1. Try building the project with 'mvn package -Dmaven.test.skip=true' using the correct version of Java and maven before invoking cdxgen.",
-              );
-            } else if (
-              result.stdout?.includes(
-                "Could not resolve target platform specification",
-              )
-            ) {
+            if (safeExistsSync(settingsXml)) {
+              mvnTreeArgs.push("-s");
+              mvnTreeArgs.push(settingsXml);
+            }
+            result = safeSpawnSync(mavenCmd, mvnTreeArgs, {
+              cwd: basePath,
+              shell: isWin,
+            });
+          }
+          if (result.status !== 0 || result.error) {
+            possible_misses = true;
+            // Our approach to recursively invoking the maven plugin for each sub-module is bound to result in failures
+            // These could be due to a range of reasons that are covered below.
+            if (pomFiles.length === 1 || DEBUG_MODE || PREFER_MAVEN_DEPS_TREE) {
+              if (result.stdout) {
+                console.log(result.stdout);
+              }
+              if (result.stderr) {
+                console.log(result.stderr);
+                console.log("The above build errors could be due to:\n");
+              }
+              if (
+                result.stdout &&
+                (result.stdout.includes("Non-resolvable parent POM") ||
+                  result.stdout.includes("points at wrong local POM"))
+              ) {
+                console.log(
+                  "1. Check if the pom.xml contains valid settings for parent and modules. Some projects can be built only from a specific directory.",
+                );
+              } else if (
+                result.stdout &&
+                (result.stdout.includes("Could not resolve dependencies") ||
+                  result.stdout.includes(
+                    "no dependency information available",
+                  ) ||
+                  result.stdout.includes(
+                    "The following artifacts could not be resolved",
+                  ))
+              ) {
+                console.log(
+                  "1. Try building the project with 'mvn package -Dmaven.test.skip=true' using the correct version of Java and maven before invoking cdxgen.",
+                );
+              } else if (
+                result.stdout?.includes(
+                  "Could not resolve target platform specification",
+                )
+              ) {
+                console.log(
+                  "1. Some projects can be built only from the root directory. Invoke cdxgen with --no-recurse option",
+                );
+              } else {
+                console.log(
+                  "1. Java version requirement: cdxgen container image bundles Java 24 with maven 3.9 which might be incompatible. Try running cdxgen with the custom JDK11-based image `ghcr.io/cyclonedx/cdxgen-java11:v12`.",
+                );
+              }
               console.log(
-                "1. Some projects can be built only from the root directory. Invoke cdxgen with --no-recurse option",
+                "2. Private dependencies cannot be downloaded: Check if any additional arguments must be passed to maven and set them via MVN_ARGS environment variable.",
               );
-            } else {
               console.log(
-                "1. Java version requirement: cdxgen container image bundles Java 24 with maven 3.9 which might be incompatible. Try running cdxgen with the custom JDK11-based image `ghcr.io/cyclonedx/cdxgen-java11:v12`.",
+                "3. Check if all required environment variables including any maven profile arguments are passed correctly to this tool.",
               );
             }
+            // Do not fall back to methods that can produce incomplete results when failOnError is set
+            options.failOnError && process.exit(1);
             console.log(
-              "2. Private dependencies cannot be downloaded: Check if any additional arguments must be passed to maven and set them via MVN_ARGS environment variable.",
+              "\nFalling back to parsing pom.xml files. Only direct dependencies would get included!",
             );
-            console.log(
-              "3. Check if all required environment variables including any maven profile arguments are passed correctly to this tool.",
+            thoughtLog(
+              "**MAVEN**: There appear to be build errors, so the SBOM will be incomplete.",
             );
-          }
-          // Do not fall back to methods that can produce incomplete results when failOnError is set
-          options.failOnError && process.exit(1);
-          console.log(
-            "\nFalling back to parsing pom.xml files. Only direct dependencies would get included!",
-          );
-          thoughtLog(
-            "**MAVEN**: There appear to be build errors, so the SBOM will be incomplete.",
-          );
-          const dlist = parsePom(f);
-          if (dlist?.length) {
-            pkgList = pkgList.concat(dlist);
-          }
-        } else {
-          if (safeExistsSync(tempMvnTree)) {
-            const mvnTreeString = readFileSync(tempMvnTree, {
-              encoding: "utf-8",
-            });
-            const parsedList = parseMavenTree(mvnTreeString, f);
-            const dlist = parsedList.pkgList;
-            const tmpParentComponent = dlist.splice(0, 1)[0];
-            tmpParentComponent.type = "application";
-            if (dlist?.length) {
+            const pomMap = parsePom(f);
+            const dlist = pomMap?.dependencies || [];
+            if (dlist.length) {
               pkgList = pkgList.concat(dlist);
-              if (dlist.length > 1) {
-                thoughtLog(`Obtained ${dlist.length} components from maven.`);
-              } else {
+            }
+          } else {
+            const treeFile = safeExistsSync(tempMvnTreeText)
+              ? tempMvnTreeText
+              : tempMvnTree;
+            if (safeExistsSync(treeFile)) {
+              const mvnTreeString = readFileSync(treeFile, {
+                encoding: "utf-8",
+              });
+              const parsedList = treeFile.endsWith(".json")
+                ? parseMavenTreeJson(mvnTreeString, f)
+                : parseMavenTree(mvnTreeString, f);
+              const dlist = parsedList.pkgList || [];
+              const tmpParentComponent = dlist.splice(0, 1)[0];
+              if (tmpParentComponent) {
+                tmpParentComponent.type = "application";
+              }
+              if (dlist.length) {
+                pkgList = pkgList.concat(dlist);
+                if (dlist.length > 1) {
+                  thoughtLog(`Obtained ${dlist.length} components from maven.`);
+                } else {
+                  thoughtLog(
+                    `"Received very few components from the maven dependency tree command for ${basePath}."`,
+                  );
+                }
+              }
+              // Retain the parent hierarchy
+              if (!tmpParentComponent) {
                 thoughtLog(
-                  `"Received very few components from the maven dependency tree command for ${basePath}."`,
+                  `No parseable components were found after executing '${basename(mavenCmd)}'.`,
                 );
+              } else if (!Object.keys(parentComponent).length) {
+                parentComponent = tmpParentComponent;
+                parentComponent.components = [];
+              } else {
+                parentComponent.components.push(tmpParentComponent);
               }
-            }
-            // Retain the parent hierarchy
-            if (!Object.keys(parentComponent).length) {
-              parentComponent = tmpParentComponent;
-              parentComponent.components = [];
-            } else {
-              parentComponent.components.push(tmpParentComponent);
-            }
-            if (parsedList?.dependenciesList?.length) {
-              dependencies = mergeDependencies(
-                dependencies,
-                parsedList.dependenciesList,
-                tmpParentComponent,
-              );
-            } else {
-              if (dlist?.length) {
-                thoughtLog(
-                  `Hmm, I didn't find any dependencies after executing '${basename(mavenCmd)}'. However, I did get ${dlist.length} components, which is confusing.`,
+              if (parsedList?.dependenciesList?.length) {
+                dependencies = mergeDependencies(
+                  dependencies,
+                  parsedList.dependenciesList,
+                  tmpParentComponent,
                 );
+              } else {
+                if (dlist?.length) {
+                  thoughtLog(
+                    `Hmm, I didn't find any dependencies after executing '${basename(mavenCmd)}'. However, I did get ${dlist.length} components, which is confusing.`,
+                  );
+                }
               }
             }
-            if (!DEBUG_MODE) {
-              safeUnlinkSync(tempMvnTree);
-            }
+          }
+        } finally {
+          if (!DEBUG_MODE && tempDir?.startsWith(tempRoot)) {
+            safeRmSync(tempDir, { recursive: true, force: true });
           }
         }
       }
@@ -3068,7 +3163,7 @@ export async function createNodejsBom(path, options) {
         `Performing babel-based package usage analysis with source code at ${path}`,
       );
     }
-    const retData = await findJSImportsExports(path, options.deep);
+    const retData = await findJSImportsExports(path, options);
     allImports = retData.allImports;
     allExports = retData.allExports;
     if (shouldDetectMcpInventory(includedAiInventoryTypes)) {
@@ -3128,11 +3223,23 @@ export async function createNodejsBom(path, options) {
     `${options.multiProject ? "**/" : ""}pnpm-lock.yaml`,
     options,
   );
-  const pnpmWorkspaceFiles = getAllFiles(
+  let pnpmWorkspaceFiles = getAllFiles(
     path,
     `${options.multiProject ? "**/" : ""}pnpm-workspace.yaml`,
     options,
   );
+  const rootPnpmLockFile = resolve(path, "pnpm-lock.yaml");
+  const rootPnpmWorkspaceFile = resolve(path, "pnpm-workspace.yaml");
+  if (
+    safeExistsSync(rootPnpmLockFile) &&
+    safeExistsSync(rootPnpmWorkspaceFile) &&
+    pnpmLockFiles.includes(rootPnpmLockFile)
+  ) {
+    pnpmLockFiles = [rootPnpmLockFile];
+    pnpmWorkspaceFiles = [rootPnpmWorkspaceFile];
+    yarnLockFiles = [];
+    pkgLockFiles = [];
+  }
   const minJsFiles = getAllFiles(
     path,
     `${options.multiProject ? "**/" : ""}*min.js`,
@@ -3418,7 +3525,6 @@ export async function createNodejsBom(path, options) {
     const workspaceDirectDeps = {};
     const depsWorkspaceRefs = {};
     let workspaceCatalogs = {};
-    let workspaceWarningShown = false;
     const seenPkgJsonFiles = {};
     // Is this a pnpm workspace?
     for (const f of pnpmWorkspaceFiles) {
@@ -3427,16 +3533,26 @@ export async function createNodejsBom(path, options) {
       }
       const workspaceObj = parsePnpmWorkspace(f);
       if (workspaceObj?.packages) {
+        const workspaceBasePath = dirname(f);
+        const workspacePatterns =
+          workspaceObj.packagePatterns || workspaceObj.packages;
         // We need the precise purl for all workspace packages and their direct dependencies
-        for (const awp of workspaceObj.packages) {
-          const wpkgJsonFiles = getAllFiles(awp, "**/package.json", options);
+        for (const awp of workspacePatterns) {
+          const workspaceExcludes = [...(workspaceObj.excludePackages || [])];
+          const workspaceSearchOptions = {
+            ...options,
+            exclude: [...(options.exclude || []), ...workspaceExcludes],
+            includeNodeModulesDir: false,
+          };
+          const workspacePackagePattern = awp.endsWith("package.json")
+            ? awp
+            : `${awp.replace(/\/+$/, "")}/package.json`;
+          const wpkgJsonFiles = getAllFiles(
+            workspaceBasePath,
+            workspacePackagePattern,
+            workspaceSearchOptions,
+          );
           if (!wpkgJsonFiles?.length) {
-            if (!workspaceWarningShown) {
-              workspaceWarningShown = true;
-              console.warn(
-                `Unable to find any package.json files belonging to the workspace '${awp}' referred in ${f}. To improve SBOM precision, run cdxgen from the directory containing the complete source code.`,
-              );
-            }
             continue;
           }
           for (const apj of wpkgJsonFiles) {
@@ -3444,7 +3560,12 @@ export async function createNodejsBom(path, options) {
               continue;
             }
             seenPkgJsonFiles[apj] = true;
-            const pkgData = JSON.parse(readFileSync(apj, "utf-8"));
+            let pkgData;
+            try {
+              pkgData = JSON.parse(readFileSync(apj, "utf-8"));
+            } catch (_err) {
+              continue;
+            }
             if (pkgData?.name) {
               const relativePkgJsonFile = relative(path, apj);
               let workspaceRef = `pkg:npm/${pkgData.name}`;
@@ -3498,16 +3619,11 @@ export async function createNodejsBom(path, options) {
       console.log(
         `${Object.keys(seenPkgJsonFiles).length} package.json files were parsed to identify workspace names. Total number of package.json files: ${pkgJsonFiles.length}`,
       );
-      if (Object.keys(seenPkgJsonFiles).length < pkgJsonFiles.length - 1) {
-        const seenfilenames = Object.keys(seenPkgJsonFiles);
-        console.log(
-          "Following files were not parsed:",
-          pkgJsonFiles.filter((p) => !seenfilenames.includes(p)),
-        );
-        console.log(
-          "TIP: Check the configuration in pnpm-workspace.yaml to ensure all the required workspaces are included correctly.",
-        );
-      }
+    }
+    if (!Object.keys(seenPkgJsonFiles).length && pnpmWorkspaceFiles.length) {
+      console.warn(
+        `Unable to find any package.json files belonging to the workspace(s) referred in ${pnpmWorkspaceFiles.join(", ")}. To improve SBOM precision, run cdxgen from the directory containing the complete source code.`,
+      );
     }
     for (const f of pnpmLockFiles) {
       if (DEBUG_MODE) {
@@ -3570,6 +3686,7 @@ export async function createNodejsBom(path, options) {
         workspaceCatalogs,
         workspaceDirectDeps,
         depsWorkspaceRefs,
+        path,
       );
       const dlist = parsedList.pkgList;
       if (dlist?.length) {
@@ -3697,11 +3814,27 @@ export async function createNodejsBom(path, options) {
       });
     }
     if (safeExistsSync(pnpmLock)) {
-      const pnpmLockObj = await parsePnpmLock(pnpmLock);
+      const pnpmLockObj = await parsePnpmLock(
+        pnpmLock,
+        null,
+        [],
+        {},
+        {},
+        {},
+        {},
+        path,
+      );
       let pkgList = addWasmComponentsFromImports(
         pnpmLockObj.pkgList,
         allImports,
       );
+      let dependencies = [];
+      if (pnpmLockObj?.dependenciesList?.length) {
+        dependencies = mergeDependencies(
+          dependencies,
+          pnpmLockObj.dependenciesList,
+        );
+      }
       if (allImports && Object.keys(allImports).length) {
         pkgList = await addEvidenceForImports(
           pkgList,
@@ -3710,9 +3843,11 @@ export async function createNodejsBom(path, options) {
           options.deep,
         );
       }
+      pkgList = propagateRequiredScopeFromDependencies(pkgList, dependencies);
       return buildBomNSData(options, pkgList, "npm", {
         allImports,
         allExports,
+        dependencies,
         src: path,
         filename: "pnpm-lock.yaml",
       });
@@ -4013,6 +4148,7 @@ export async function createNodejsBom(path, options) {
     mergeServices([], mcpInventory.services || []),
     aiInventory.services || [],
   );
+  pkgList = propagateRequiredScopeFromDependencies(pkgList, dependencies);
   if (exactAiInventoryType === "mcp") {
     pkgList = trimComponents(filterInventorySubjectsByTypes(pkgList, ["mcp"]));
     dependencies = filterInventoryDependencies(
@@ -8341,6 +8477,13 @@ async function analyzeInstalledExtensionDirs(
  * @returns {Promise<Object>} Promise resolving to BOM object
  */
 export async function createCryptoCertsBom(path, options) {
+  if (!isCycloneDxComponentTypeEnabled("cryptographic-asset", options)) {
+    return {
+      bomJson: {
+        components: [],
+      },
+    };
+  }
   const pkgList = [];
   const certFiles = getAllFiles(
     path,
@@ -8407,7 +8550,7 @@ export async function createCryptoCertsBom(path, options) {
   }
   return {
     bomJson: {
-      components: pkgList,
+      components: filterInvalidCryptoComponents(pkgList),
     },
   };
 }
@@ -8511,6 +8654,7 @@ export async function createMultiXBom(pathList, options) {
     } = await getOSPackages(
       options.allLayersExplodedDir,
       options.exportData?.inspectData?.Config,
+      options,
     );
     // TODO: Need to test these with docker-compose type where multiple images could have different values.
     // This is also clearly misusing options, which must become immutable at some point.
@@ -9349,7 +9493,11 @@ export async function createMultiXBom(pathList, options) {
       }
     }
     // Collect any crypto keys
-    if (options.specVersion >= 1.6 && options.includeCrypto) {
+    if (
+      options.specVersion >= 1.6 &&
+      options.includeCrypto &&
+      isCycloneDxComponentTypeEnabled("cryptographic-asset", options)
+    ) {
       if (!hasAnyProjectType(["oci"], options, false)) {
         thoughtLog(
           "**CBOM**: Wait, the user wants me to look for cryptographic assets. Let's check thoroughly.",