cra-audit 0.1.0 → 1.1.0

package/src/core/sbom-validator.js

@@ -1,124 +1,228 @@
-'use strict';
-
-/**
- * Validates an SBOM document against the minimum elements required by
- * CRA Annex I (2)(1) and BSI TR-03183 Part 2. It auto-detects whether the
- * document is CycloneDX or SPDX.
- *
- * Minimum required elements (TR-03183 §6 "minimum elements"):
- *  - SBOM format declared (CycloneDX or SPDX)
- *  - Author / creator of the SBOM
- *  - Timestamp of creation
- *  - For each component: name, version, supplier/author, unique identifier,
- *    cryptographic hash, license and dependency relationship.
- */
-function validateSbom(document) {
-  if (!document || typeof document !== 'object') {
-    return invalid('El SBOM no es un objeto JSON válido.');
-  }
-
-  if (document.bomFormat === 'CycloneDX' || document.specVersion) {
-    return validateCycloneDx(document);
-  }
-  if (document.spdxVersion || document.SPDXID === 'SPDXRef-DOCUMENT') {
-    return validateSpdx(document);
-  }
-
-  return invalid('Formato de SBOM no reconocido (no es CycloneDX ni SPDX).');
-}
-
-function validateCycloneDx(doc) {
-  const issues = [];
-  const checks = [];
-
-  pushCheck(checks, 'format', 'Formato declarado (CycloneDX)', doc.bomFormat === 'CycloneDX');
-  pushCheck(checks, 'specVersion', 'Versión de especificación presente', Boolean(doc.specVersion));
-  pushCheck(checks, 'serialNumber', 'Identificador único del documento (serialNumber)', Boolean(doc.serialNumber));
-  pushCheck(checks, 'timestamp', 'Marca temporal de creación', Boolean(doc.metadata && doc.metadata.timestamp));
-  pushCheck(checks, 'author', 'Autor / herramienta generadora declarada',
-    Boolean(doc.metadata && (doc.metadata.tools || doc.metadata.authors)));
-  pushCheck(checks, 'rootComponent', 'Componente raíz (producto) identificado',
-    Boolean(doc.metadata && doc.metadata.component && doc.metadata.component.name));
-
-  const components = Array.isArray(doc.components) ? doc.components : [];
-  pushCheck(checks, 'components', 'Contiene al menos un componente', components.length > 0);
-
-  const stats = { total: components.length, missingVersion: 0, missingHash: 0, missingLicense: 0, missingPurl: 0 };
-  for (const comp of components) {
-    const label = comp.name || comp['bom-ref'] || 'desconocido';
-    if (!comp.version) { stats.missingVersion++; issues.push(`Componente sin versión: ${label}`); }
-    if (!hasCdxHash(comp)) { stats.missingHash++; issues.push(`Componente sin hash criptográfico: ${label}`); }
-    if (!hasCdxLicense(comp)) { stats.missingLicense++; issues.push(`Componente sin licencia: ${label}`); }
-    if (!comp.purl && !comp['bom-ref']) { stats.missingPurl++; issues.push(`Componente sin identificador único (purl): ${label}`); }
-  }
-
-  pushCheck(checks, 'componentVersions', 'Todos los componentes tienen versión', stats.missingVersion === 0);
-  pushCheck(checks, 'componentHashes', 'Todos los componentes tienen hash criptográfico', stats.missingHash === 0);
-  pushCheck(checks, 'componentLicenses', 'Todos los componentes tienen licencia', stats.missingLicense === 0);
-  pushCheck(checks, 'componentIdentifiers', 'Todos los componentes tienen identificador único', stats.missingPurl === 0);
-
-  return summarize('cyclonedx', checks, issues, stats);
-}
-
-function validateSpdx(doc) {
-  const issues = [];
-  const checks = [];
-
-  pushCheck(checks, 'format', 'Formato declarado (SPDX)', Boolean(doc.spdxVersion));
-  pushCheck(checks, 'dataLicense', 'Licencia de los datos declarada', Boolean(doc.dataLicense));
-  pushCheck(checks, 'serialNumber', 'Namespace único del documento', Boolean(doc.documentNamespace));
-  pushCheck(checks, 'timestamp', 'Marca temporal de creación', Boolean(doc.creationInfo && doc.creationInfo.created));
-  pushCheck(checks, 'author', 'Autor / creador declarado',
-    Boolean(doc.creationInfo && Array.isArray(doc.creationInfo.creators) && doc.creationInfo.creators.length));
-
-  const packages = Array.isArray(doc.packages) ? doc.packages : [];
-  pushCheck(checks, 'components', 'Contiene al menos un paquete', packages.length > 0);
-
-  const stats = { total: packages.length, missingVersion: 0, missingHash: 0, missingLicense: 0, missingPurl: 0 };
-  for (const pkg of packages) {
-    const label = pkg.name || pkg.SPDXID || 'desconocido';
-    if (pkg.SPDXID === 'SPDXRef-Package-root') continue;
-    if (!pkg.versionInfo || pkg.versionInfo === 'NOASSERTION') { stats.missingVersion++; issues.push(`Paquete sin versión: ${label}`); }
-    if (!Array.isArray(pkg.checksums) || pkg.checksums.length === 0) { stats.missingHash++; issues.push(`Paquete sin checksum: ${label}`); }
-    if (!pkg.licenseConcluded || pkg.licenseConcluded === 'NOASSERTION') { stats.missingLicense++; issues.push(`Paquete sin licencia: ${label}`); }
-    if (!Array.isArray(pkg.externalRefs) || !pkg.externalRefs.some((r) => r.referenceType === 'purl')) { stats.missingPurl++; issues.push(`Paquete sin purl: ${label}`); }
-  }
-
-  pushCheck(checks, 'componentVersions', 'Todos los paquetes tienen versión', stats.missingVersion === 0);
-  pushCheck(checks, 'componentHashes', 'Todos los paquetes tienen checksum', stats.missingHash === 0);
-  pushCheck(checks, 'componentLicenses', 'Todos los paquetes tienen licencia', stats.missingLicense === 0);
-  pushCheck(checks, 'componentIdentifiers', 'Todos los paquetes tienen purl', stats.missingPurl === 0);
-
-  return summarize('spdx', checks, issues, stats);
-}
-
-function hasCdxHash(comp) {
-  return Array.isArray(comp.hashes) && comp.hashes.length > 0;
-}
-
-function hasCdxLicense(comp) {
-  return Array.isArray(comp.licenses) && comp.licenses.length > 0;
-}
-
-function pushCheck(checks, id, label, passed) {
-  checks.push({ id, label, passed: Boolean(passed) });
-}
-
-function summarize(format, checks, issues, stats) {
-  const failed = checks.filter((c) => !c.passed);
-  return {
-    ok: true,
-    format,
-    valid: failed.length === 0,
-    checks,
-    failedChecks: failed,
-    issues,
-    stats,
-  };
-}
-
-function invalid(message) {
-  return { ok: false, valid: false, error: message, checks: [], issues: [message] };
-}
-
-module.exports = { validateSbom };
+'use strict';
+
+/**
+ * Validates an SBOM document against the requirements of CRA Annex I and
+ * BSI TR-03183-2 v2.1.0. It auto-detects whether the document is CycloneDX
+ * or SPDX.
+ *
+ * TR-03183-2 v2.1.0 requirements checked:
+ *  - §4:     format CycloneDX >= 1.6 or SPDX >= 3.0.1
+ *  - §5.2.1: creator of the SBOM (email or URL) and timestamp
+ *  - §5.2.2: for each component: creator (email or URL), name, version,
+ *            filename, dependencies (and completeness of that enumeration),
+ *            licence, SHA-512 hash of the deployable component and the
+ *            executable / archive / structured properties
+ *  - §5.2.4: unique identifier (purl, CPE, SWID)
+ */
+function validateSbom(document) {
+  if (!document || typeof document !== 'object') {
+    return invalid('The SBOM is not a valid JSON object.');
+  }
+
+  if (document.bomFormat === 'CycloneDX' || document.specVersion) {
+    return validateCycloneDx(document);
+  }
+  if (document.spdxVersion || document.SPDXID === 'SPDXRef-DOCUMENT') {
+    return validateSpdx(document);
+  }
+
+  return invalid('Unrecognized SBOM format (neither CycloneDX nor SPDX).');
+}
+
+const BSI_PROPERTIES = ['bsi:component:executable', 'bsi:component:archive', 'bsi:component:structured'];
+
+function validateCycloneDx(doc) {
+  const issues = [];
+  const checks = [];
+  const metadata = doc.metadata || {};
+
+  pushCheck(checks, 'format', 'Format declared (CycloneDX)', doc.bomFormat === 'CycloneDX');
+  pushCheck(checks, 'specVersion', 'Specification version CycloneDX >= 1.6 (TR-03183-2 §4)',
+    compareVersions(doc.specVersion, '1.6') >= 0);
+  pushCheck(checks, 'serialNumber', 'Unique document identifier (serialNumber)', Boolean(doc.serialNumber));
+  pushCheck(checks, 'timestamp', 'Creation timestamp', Boolean(metadata.timestamp));
+  pushCheck(checks, 'author', 'Creator of the SBOM (email or URL)',
+    hasCdxContact(metadata.manufacturer) || toArray(metadata.authors).some((a) => a && a.email));
+  pushCheck(checks, 'rootComponent', 'Root component (product) identified',
+    Boolean(metadata.component && metadata.component.name));
+
+  const components = toArray(doc.components);
+  pushCheck(checks, 'components', 'Contains at least one component', components.length > 0);
+
+  const graphRefs = new Set(toArray(doc.dependencies).map((d) => d && d.ref));
+  const stats = {
+    total: components.length,
+    missingVersion: 0,
+    missingCreator: 0,
+    missingFilename: 0,
+    missingHash: 0,
+    missingLicense: 0,
+    missingPurl: 0,
+    missingProperties: 0,
+    missingDependencies: 0,
+  };
+
+  for (const comp of components) {
+    const label = comp.name || comp['bom-ref'] || 'unknown';
+    const props = new Map(toArray(comp.properties).map((p) => [p && p.name, p && p.value]));
+
+    if (!comp.version) { stats.missingVersion++; issues.push(`Component without a version: ${label}`); }
+    if (!hasCdxContact(comp.manufacturer) && !hasCdxContact(comp.supplier) && !hasEmail(comp.authors)) {
+      stats.missingCreator++; issues.push(`Component without a creator (email or URL): ${label}`);
+    }
+    if (!props.get('bsi:component:filename')) { stats.missingFilename++; issues.push(`Component without a filename: ${label}`); }
+    if (!hasCdxSha512(comp)) { stats.missingHash++; issues.push(`Component without a SHA-512 hash: ${label}`); }
+    if (!hasCdxLicense(comp)) { stats.missingLicense++; issues.push(`Component without a license: ${label}`); }
+    if (!comp.purl && !comp.cpe && !comp.swid && !comp['bom-ref']) {
+      stats.missingPurl++; issues.push(`Component without a unique identifier (purl): ${label}`);
+    }
+    if (BSI_PROPERTIES.some((name) => !props.get(name))) {
+      stats.missingProperties++; issues.push(`Component without the executable/archive/structured properties: ${label}`);
+    }
+    if (!graphRefs.has(comp['bom-ref'])) {
+      stats.missingDependencies++; issues.push(`Component missing from the dependency graph: ${label}`);
+    }
+  }
+
+  const completeness = toArray(doc.compositions).some((c) => c && c.aggregate);
+
+  pushCheck(checks, 'componentVersions', 'All components have a version', stats.missingVersion === 0);
+  pushCheck(checks, 'componentCreators', 'All components have a creator (email or URL)', stats.missingCreator === 0);
+  pushCheck(checks, 'componentFilenames', 'All components have a filename', stats.missingFilename === 0);
+  pushCheck(checks, 'componentHashes', 'All components have a SHA-512 hash', stats.missingHash === 0);
+  pushCheck(checks, 'componentLicenses', 'All components have a license', stats.missingLicense === 0);
+  pushCheck(checks, 'componentIdentifiers', 'All components have a unique identifier', stats.missingPurl === 0);
+  pushCheck(checks, 'componentProperties', 'All components declare executable/archive/structured', stats.missingProperties === 0);
+  pushCheck(checks, 'dependencyGraph', 'Dependency graph covers every component', stats.missingDependencies === 0);
+  pushCheck(checks, 'dependencyCompleteness', 'Completeness of the dependency graph declared (compositions)', completeness);
+
+  return summarize('cyclonedx', checks, issues, stats);
+}
+
+function validateSpdx(doc) {
+  const issues = [];
+  const checks = [];
+  const creators = toArray(doc.creationInfo && doc.creationInfo.creators);
+
+  pushCheck(checks, 'format', 'Format declared (SPDX)', Boolean(doc.spdxVersion));
+  const spdxVersion = String(doc.spdxVersion || '').replace(/^SPDX-/, '');
+  pushCheck(checks, 'specVersion', 'Specification version SPDX >= 3.0.1 (TR-03183-2 §4; use CycloneDX)',
+    compareVersions(spdxVersion, '3.0.1') >= 0);
+  pushCheck(checks, 'dataLicense', 'Data license declared', Boolean(doc.dataLicense));
+  pushCheck(checks, 'serialNumber', 'Unique document namespace', Boolean(doc.documentNamespace));
+  pushCheck(checks, 'timestamp', 'Creation timestamp', Boolean(doc.creationInfo && doc.creationInfo.created));
+  pushCheck(checks, 'author', 'Creator of the SBOM (organization or person)',
+    creators.some((c) => /^(Organization|Person):/.test(String(c))));
+
+  const packages = toArray(doc.packages);
+  pushCheck(checks, 'components', 'Contains at least one package', packages.length > 0);
+
+  const relationships = toArray(doc.relationships);
+  const inGraph = new Set();
+  for (const r of relationships) {
+    if (r && r.relationshipType === 'DEPENDS_ON') {
+      inGraph.add(r.spdxElementId);
+      inGraph.add(r.relatedSpdxElement);
+    }
+  }
+
+  const stats = {
+    total: packages.length,
+    missingVersion: 0,
+    missingCreator: 0,
+    missingFilename: 0,
+    missingHash: 0,
+    missingLicense: 0,
+    missingPurl: 0,
+    missingDependencies: 0,
+  };
+  for (const pkg of packages) {
+    const label = pkg.name || pkg.SPDXID || 'unknown';
+    if (pkg.SPDXID === 'SPDXRef-Package-root') continue;
+    if (!pkg.versionInfo || pkg.versionInfo === 'NOASSERTION') { stats.missingVersion++; issues.push(`Package without a version: ${label}`); }
+    if (!isAssertion(pkg.originator) && !isAssertion(pkg.supplier)) { stats.missingCreator++; issues.push(`Package without an originator: ${label}`); }
+    if (!pkg.packageFileName) { stats.missingFilename++; issues.push(`Package without a filename: ${label}`); }
+    if (!toArray(pkg.checksums).some((c) => /^SHA-?512$/i.test(String(c && c.algorithm)))) {
+      stats.missingHash++; issues.push(`Package without a SHA-512 checksum: ${label}`);
+    }
+    if (!isAssertion(pkg.licenseConcluded)) { stats.missingLicense++; issues.push(`Package without a license: ${label}`); }
+    if (!toArray(pkg.externalRefs).some((r) => r.referenceType === 'purl')) { stats.missingPurl++; issues.push(`Package without a purl: ${label}`); }
+    if (packages.length > 2 && !inGraph.has(pkg.SPDXID)) {
+      stats.missingDependencies++; issues.push(`Package missing from the dependency graph: ${label}`);
+    }
+  }
+
+  pushCheck(checks, 'componentVersions', 'All packages have a version', stats.missingVersion === 0);
+  pushCheck(checks, 'componentCreators', 'All packages have an originator', stats.missingCreator === 0);
+  pushCheck(checks, 'componentFilenames', 'All packages have a filename', stats.missingFilename === 0);
+  pushCheck(checks, 'componentHashes', 'All packages have a SHA-512 checksum', stats.missingHash === 0);
+  pushCheck(checks, 'componentLicenses', 'All packages have a license', stats.missingLicense === 0);
+  pushCheck(checks, 'componentIdentifiers', 'All packages have a purl', stats.missingPurl === 0);
+  pushCheck(checks, 'dependencyGraph', 'Dependency relationships (DEPENDS_ON) declared', stats.missingDependencies === 0);
+
+  return summarize('spdx', checks, issues, stats);
+}
+
+/** CycloneDX organizational entity with an email contact or a URL. */
+function hasCdxContact(entity) {
+  if (!entity || typeof entity !== 'object') return false;
+  return toArray(entity.url).length > 0 || hasEmail(entity.contact);
+}
+
+function hasEmail(people) {
+  return toArray(people).some((p) => p && p.email);
+}
+
+/** SHA-512 in `hashes` or on the `distribution` reference (TR-03183 mapping). */
+function hasCdxSha512(comp) {
+  const isSha512 = (h) => h && h.alg === 'SHA-512' && h.content;
+  if (toArray(comp.hashes).some(isSha512)) return true;
+  return toArray(comp.externalReferences).some((ref) => ref && toArray(ref.hashes).some(isSha512));
+}
+
+function hasCdxLicense(comp) {
+  return toArray(comp.licenses).length > 0;
+}
+
+function isAssertion(value) {
+  return Boolean(value) && value !== 'NOASSERTION' && value !== 'NONE';
+}
+
+/** Compares dotted numeric versions ("1.6" vs "1.5"); missing parts are 0. */
+function compareVersions(a, b) {
+  if (!a) return -1;
+  const pa = String(a).split('.').map((n) => parseInt(n, 10) || 0);
+  const pb = String(b).split('.').map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const diff = (pa[i] || 0) - (pb[i] || 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+
+function toArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+
+function pushCheck(checks, id, label, passed) {
+  checks.push({ id, label, passed: Boolean(passed) });
+}
+
+function summarize(format, checks, issues, stats) {
+  const failed = checks.filter((c) => !c.passed);
+  return {
+    ok: true,
+    format,
+    valid: failed.length === 0,
+    checks,
+    failedChecks: failed,
+    issues,
+    stats,
+  };
+}
+
+function invalid(message) {
+  return { ok: false, valid: false, error: message, checks: [], issues: [message] };
+}
+
+module.exports = { validateSbom };

package/src/core/vuln-scanner.js

@@ -1,6 +1,11 @@
 'use strict';
 
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
 const { runJson } = require('../utils/exec');
+const { exists } = require('../utils/fs');
+const { parseLockfile, toNpmLockfile } = require('./lockfile-parser');
 
 const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
 
@@ -9,22 +14,47 @@ const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
  * `npm audit --json`. The CRA requires products to ship "without known
  * exploitable vulnerabilities", so this is the core gate of the audit.
  *
+ * npm projects are audited in place. Yarn/pnpm projects (which have no npm
+ * lockfile) are audited against a synthetic `package-lock.json` generated from
+ * their lockfile, preserving the exact installed versions.
+ *
  * @param {string} projectRoot
  * @param {{ production?: boolean }} [options]
  */
 function scanVulnerabilities(projectRoot, { production = false } = {}) {
+  if (hasNpmLockfile(projectRoot)) {
+    return runNpmAudit(projectRoot, { production });
+  }
+
+  const parsed = parseLockfile(projectRoot);
+  if (parsed.ok && parsed.components.length > 0) {
+    return auditSynthesized(parsed, { production });
+  }
+
+  // No usable lockfile: run npm audit in place so the user gets npm's own error.
+  return runNpmAudit(projectRoot, { production });
+}
+
+function hasNpmLockfile(projectRoot) {
+  return exists(path.join(projectRoot, 'package-lock.json')) ||
+    exists(path.join(projectRoot, 'npm-shrinkwrap.json'));
+}
+
+/** Runs `npm audit --json` in the given directory. */
+function runNpmAudit(cwd, { production = false, packageLockOnly = false } = {}) {
   const args = ['audit', '--json'];
   if (production) args.push('--omit=dev');
+  if (packageLockOnly) args.push('--package-lock-only');
 
-  const result = runJson('npm', args, { cwd: projectRoot });
+  const result = runJson('npm', args, { cwd });
 
   if (!result.data) {
     return {
       ok: false,
       error:
-        'No se pudo ejecutar `npm audit`. Asegúrate de tener npm instalado y un ' +
-        'package-lock.json presente. ' +
-        (result.stderr ? `Detalle: ${result.stderr.trim()}` : ''),
+        'Could not run `npm audit`. Make sure npm is installed and a ' +
+        'lockfile is present. ' +
+        (result.stderr ? `Detail: ${result.stderr.trim()}` : ''),
       counts: emptyCounts(),
       vulnerabilities: [],
     };
@@ -46,6 +76,32 @@ function scanVulnerabilities(projectRoot, { production = false } = {}) {
   };
 }
 
+/**
+ * Audits a Yarn/pnpm project by materializing a synthetic npm lockfile in a
+ * temporary directory and running `npm audit --package-lock-only` there.
+ */
+function auditSynthesized(parsed, { production = false } = {}) {
+  const { packageJson, packageLock } = toNpmLockfile(parsed);
+  let tmpDir;
+  try {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cra-audit-'));
+    fs.writeFileSync(path.join(tmpDir, 'package.json'), JSON.stringify(packageJson, null, 2));
+    fs.writeFileSync(path.join(tmpDir, 'package-lock.json'), JSON.stringify(packageLock, null, 2));
+    return runNpmAudit(tmpDir, { production, packageLockOnly: true });
+  } catch (err) {
+    return {
+      ok: false,
+      error: `Could not analyze vulnerabilities from lockfile ${parsed.lockfileName || ''}: ${err.message}`.trim(),
+      counts: emptyCounts(),
+      vulnerabilities: [],
+    };
+  } finally {
+    if (tmpDir) {
+      try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch { /* best effort */ }
+    }
+  }
+}
+
 function parseModernReport(data) {
   const counts = emptyCounts();
   const vulnerabilities = [];
@@ -63,14 +119,14 @@ function parseModernReport(data) {
     const advisories = via.filter((v) => typeof v === 'object');
     const sources = advisories.length
       ? advisories.map((adv) => ({
-          title: adv.title || 'Vulnerabilidad conocida',
+          title: adv.title || 'Known vulnerability',
           url: adv.url || null,
           cwe: adv.cwe || [],
           cvss: adv.cvss ? adv.cvss.score : null,
           source: adv.source || null,
           range: adv.range || null,
         }))
-      : [{ title: `Dependencia vulnerable a través de ${via.join(', ')}`, url: null, cwe: [], cvss: null }];
+      : [{ title: `Dependency vulnerable through ${via.join(', ')}`, url: null, cwe: [], cvss: null }];
 
     vulnerabilities.push({
       name,

package/src/reporters/console.js

@@ -16,10 +16,10 @@ const SEVERITY_COLORS = {
  * @param {import('../core/auditor').AuditResult} report
  */
 function reportConsole(report) {
-  logger.heading('  CRA Audit — Cyber Resilience Act (UE 2024/2847) · BSI TR-03183');
-  logger.detail(`Proyecto: ${report.project.name}@${report.project.version}`);
+  logger.heading('  CRA Audit — Cyber Resilience Act (EU 2024/2847) · BSI TR-03183');
+  logger.detail(`Project: ${report.project.name}@${report.project.version}`);
   if (report.policySource) {
-    logger.detail(`Política: ${report.policySource}`);
+    logger.detail(`Policy: ${report.policySource}`);
   }
 
   if (report.sections.vulnerabilities) renderVulnerabilities(report.sections.vulnerabilities);
@@ -30,7 +30,7 @@ function reportConsole(report) {
 }
 
 function renderVulnerabilities(section) {
-  logger.heading('1) Vulnerabilidades conocidas (Art. 13 CRA)');
+  logger.heading('1) Known vulnerabilities (CRA Art. 13)');
   if (!section.ok) {
     logger.error(section.error);
     return;
@@ -38,13 +38,13 @@ function renderVulnerabilities(section) {
 
   const c = section.counts;
   if (c.total === 0) {
-    logger.success('Sin vulnerabilidades conocidas. Cumple el requisito de "cero vulnerabilidades explotables".');
+    logger.success('No known vulnerabilities. Meets the "zero exploitable vulnerabilities" requirement.');
     return;
   }
 
   logger.log(
-    `  ${color.red(`${c.critical} críticas`)} · ${color.red(`${c.high} altas`)} · ` +
-    `${color.yellow(`${c.moderate} moderadas`)} · ${color.yellow(`${c.low} bajas`)} · ${color.gray(`${c.info} info`)}`
+    `  ${color.red(`${c.critical} critical`)} · ${color.red(`${c.high} high`)} · ` +
+    `${color.yellow(`${c.moderate} moderate`)} · ${color.yellow(`${c.low} low`)} · ${color.gray(`${c.info} info`)}`
   );
 
   const top = section.vulnerabilities.slice(0, 15);
@@ -56,25 +56,25 @@ function renderVulnerabilities(section) {
     if (adv && adv.title) logger.detail(`${adv.title}${adv.url ? ' — ' + adv.url : ''}`);
   }
   if (section.vulnerabilities.length > top.length) {
-    logger.detail(`… y ${section.vulnerabilities.length - top.length} más.`);
+    logger.detail(`… and ${section.vulnerabilities.length - top.length} more.`);
   }
 }
 
 function describeFix(fix) {
-  if (fix === true) return color.green('(fix disponible)');
+  if (fix === true) return color.green('(fix available)');
   if (fix && typeof fix === 'object') {
     return color.green(`(fix: ${fix.name}@${fix.version}${fix.breaking ? ', breaking' : ''})`);
   }
-  return color.gray('(sin fix)');
+  return color.gray('(no fix)');
 }
 
 function renderSbom(section) {
-  logger.heading('2) Lista de Materiales de Software · SBOM (Anexo I CRA)');
+  logger.heading('2) Software Bill of Materials · SBOM (CRA Annex I)');
   if (!section.ok) {
     logger.error(section.error);
     return;
   }
-  logger.detail(`Formato: ${section.format} · Componentes: ${section.componentCount}`);
+  logger.detail(`Format: ${section.format} · Components: ${section.componentCount}`);
 
   if (section.validation) {
     const v = section.validation;
@@ -83,53 +83,53 @@ function renderSbom(section) {
       logger.log(`  ${mark} ${check.label}`);
     }
     if (v.valid) {
-      logger.success('El SBOM cumple los elementos mínimos de TR-03183 §6.');
+      logger.success('The SBOM meets the TR-03183-2 required data fields.');
     } else {
-      logger.warn(`El SBOM no cumple ${v.failedChecks.length} requisito(s) mínimo(s).`);
+      logger.warn(`The SBOM does not meet ${v.failedChecks.length} minimum requirement(s).`);
     }
   }
   if (section.outputPath) {
-    logger.detail(`SBOM escrito en: ${section.outputPath}`);
+    logger.detail(`SBOM written to: ${section.outputPath}`);
   }
 }
 
 function renderLicenses(section) {
-  logger.heading('3) Licencias de componentes de terceros (TR-03183 §6)');
+  logger.heading('3) Third-party component licenses (TR-03183-2 §5.2)');
   if (!section.ok) {
     logger.error(section.error);
     return;
   }
   const s = section.summary;
-  logger.detail(`Documentadas: ${s.documented}/${s.total}`);
+  logger.detail(`Documented: ${s.documented}/${s.total}`);
 
   if (s.missing.length) {
-    logger.warn(`${s.missing.length} componente(s) sin licencia documentada:`);
+    logger.warn(`${s.missing.length} component(s) without a documented license:`);
     for (const c of s.missing.slice(0, 10)) logger.log(`    ${color.gray('•')} ${c.name}@${c.version}`);
   }
   if (s.denied.length) {
-    logger.error(`${s.denied.length} componente(s) con licencia prohibida por la política:`);
+    logger.error(`${s.denied.length} component(s) with a license denied by the policy:`);
     for (const c of s.denied) logger.log(`    ${color.red('•')} ${c.name}@${c.version} (${c.license})`);
   }
   if (s.notAllowed.length) {
-    logger.warn(`${s.notAllowed.length} componente(s) con licencia fuera de la allowlist:`);
+    logger.warn(`${s.notAllowed.length} component(s) with a license outside the allowlist:`);
     for (const c of s.notAllowed.slice(0, 10)) logger.log(`    ${color.yellow('•')} ${c.name}@${c.version} (${c.license})`);
   }
   if (!s.missing.length && !s.denied.length && !s.notAllowed.length) {
-    logger.success('Todas las licencias están documentadas y permitidas.');
+    logger.success('All licenses are documented and allowed.');
   }
 }
 
 function renderSummary(report) {
-  logger.heading('Resultado');
+  logger.heading('Result');
   for (const item of report.gate.reasons) {
     const mark = item.passed ? color.green('✔') : color.red('✖');
     logger.log(`  ${mark} ${item.label}`);
   }
   logger.log('');
   if (report.gate.passed) {
-    logger.success(color.bold('AUDITORÍA SUPERADA — el proyecto cumple la política CRA configurada.'));
+    logger.success(color.bold('AUDIT PASSED — the project meets the configured CRA policy.'));
   } else {
-    logger.error(color.bold('AUDITORÍA FALLIDA — se han detectado incumplimientos del CRA.'));
+    logger.error(color.bold('AUDIT FAILED — CRA compliance issues were detected.'));
   }
   logger.log('');
 }

package/src/utils/logger.js

@@ -80,6 +80,25 @@ const logger = {
   detail(msg) {
     this.log(`  ${color.gray(msg)}`);
   },
+  /**
+   * Renders an in-place progress bar with a percentage and a done/total count.
+   * On a TTY the same line is rewritten on each call; a trailing newline is
+   * emitted once `done >= total`. On non-TTY streams nothing is written to
+   * avoid flooding logs (CI pipelines), so callers should log a final summary.
+   */
+  progress(label, done, total) {
+    if (!process.stdout.isTTY) return;
+    const ratio = total > 0 ? Math.min(1, done / total) : 1;
+    const pct = Math.floor(ratio * 100);
+    const width = 24;
+    const filled = Math.round(ratio * width);
+    const bar = '█'.repeat(filled) + '░'.repeat(width - filled);
+    const line =
+      `  ${color.gray(label)} ${color.cyan(`[${bar}]`)} ` +
+      `${String(pct).padStart(3)}% ${color.gray(`(${done}/${total})`)}`;
+    process.stdout.write(`\r\x1b[K${line}`);
+    if (done >= total) process.stdout.write('\n');
+  },
 };
 
 module.exports = { logger, color, SYMBOLS };