cra-audit 2.2.0 → 2.4.0

package/src/core/license-checker.js

@@ -32,6 +32,7 @@ function checkLicenses(projectRoot, policy = {}, { parsed: given } = {}) {
       name: c.name,
       version: c.version,
       purl: c.purl || null,
+      location: c.location || null,
       license: normalized,
       status, // 'ok' | 'missing' | 'denied' | 'not-allowed'
     };

package/src/core/manifest-reader.js

@@ -0,0 +1,374 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/**
+ * Reads the dependency manifests of non-npm ecosystems straight from the
+ * repository, without an SBOM generator:
+ *
+ *  - Python: poetry.lock, uv.lock, Pipfile.lock (exact, preferred) or
+ *            requirements*.txt (only `==` pins; `-r` includes are followed)
+ *  - Go:     go.mod (every required module, direct and `// indirect`)
+ *  - Java:   gradle.lockfile (exact), pom.xml (declared dependencies with
+ *            `${property}` and dependencyManagement resolution)
+ *
+ * Returns the same shape as readSbom(), so the OSV/KEV scan, VEX and SARIF
+ * work unchanged. Every component records the file and line it came from.
+ * Versions that are not pinned cannot be audited reliably: they are skipped
+ * and reported, never guessed.
+ *
+ * @param {string} projectRoot
+ * @returns {null | {
+ *   ok: true, manager: 'manifest', purlBased: true, format: 'manifest',
+ *   lockfileName: string, sourceFile: null, files: string[],
+ *   root: { name: string, version: string, purl: string, dependsOn: string[] },
+ *   components: object[], unidentified: number, notes: string[],
+ *   dependencyGraphComplete: false, ecosystems: string[]
+ * }} null when no supported manifest exists.
+ */
+function readManifests(projectRoot) {
+  const found = [];
+  const notes = [];
+  let skipped = 0;
+
+  const collect = (result) => {
+    if (!result) return;
+    found.push(result);
+    skipped += result.skipped || 0;
+    if (result.note) notes.push(result.note);
+  };
+
+  // Python: an exact lockfile wins over requirements files.
+  const pyLock = firstExisting(projectRoot, ['poetry.lock', 'uv.lock', 'Pipfile.lock']);
+  if (pyLock) {
+    collect(pyLock === 'Pipfile.lock' ? readPipfileLock(projectRoot, pyLock) : readTomlLock(projectRoot, pyLock));
+  } else {
+    for (const file of requirementsFiles(projectRoot)) collect(readRequirements(projectRoot, file));
+  }
+
+  if (exists(projectRoot, 'go.mod')) collect(readGoMod(projectRoot, 'go.mod'));
+  if (exists(projectRoot, 'gradle.lockfile')) collect(readGradleLock(projectRoot, 'gradle.lockfile'));
+  if (exists(projectRoot, 'pom.xml')) collect(readPom(projectRoot, 'pom.xml'));
+
+  if (!found.length) return null;
+
+  const components = dedupe(found.flatMap((r) => r.components));
+  const files = found.map((r) => r.file);
+  const name = path.basename(path.resolve(projectRoot));
+  const rootName = found.map((r) => r.rootName).find(Boolean) || name;
+  const rootVersion = found.map((r) => r.rootVersion).find(Boolean) || '0.0.0';
+  return {
+    ok: true,
+    manager: 'manifest',
+    purlBased: true,
+    format: 'manifest',
+    lockfileName: files.join(', '),
+    sourceFile: null,
+    files,
+    root: {
+      name: rootName,
+      version: rootVersion,
+      purl: `pkg:generic/${encodeURIComponent(rootName)}@${encodeURIComponent(rootVersion)}`,
+      dependsOn: components.filter((c) => c.direct).map((c) => c.key),
+    },
+    components,
+    unidentified: skipped,
+    notes,
+    dependencyGraphComplete: false,
+    ecosystems: [...new Set(components.map((c) => c.ecosystem))].sort(),
+  };
+}
+
+/** True when the folder holds a manifest this reader understands. */
+function hasManifests(projectRoot) {
+  return ['poetry.lock', 'uv.lock', 'Pipfile.lock', 'go.mod', 'gradle.lockfile', 'pom.xml']
+    .some((f) => exists(projectRoot, f)) || requirementsFiles(projectRoot).length > 0;
+}
+
+// --- Python ------------------------------------------------------------------------
+
+function requirementsFiles(root) {
+  let names = [];
+  try {
+    names = fs.readdirSync(root);
+  } catch {
+    return [];
+  }
+  return names.filter((n) => /^requirements([-_.][\w.-]+)?\.txt$/i.test(n)).sort();
+}
+
+/**
+ * pip requirements: `name==1.2.3`, extras, environment markers, `--hash`
+ * continuation lines and `-r other.txt` includes. Anything that is not an
+ * exact pin (ranges, URLs, editable installs) is skipped and counted.
+ */
+function readRequirements(root, file, seen = new Set()) {
+  const full = path.join(root, file);
+  if (seen.has(full)) return { file, components: [], skipped: 0 };
+  seen.add(full);
+  const components = [];
+  let skipped = 0;
+  const dev = /dev|test|lint|doc/i.test(path.basename(file));
+
+  lines(full).forEach((raw, index) => {
+    const line = raw.replace(/\s+#.*$/, '').replace(/\\$/, '').trim();
+    if (!line || line.startsWith('#') || line.startsWith('--hash')) return;
+    const include = line.match(/^(?:-r|--requirement)\s+(.+)$/);
+    if (include) {
+      const nested = readRequirements(root, path.join(path.dirname(file), include[1].trim()), seen);
+      components.push(...nested.components);
+      skipped += nested.skipped;
+      return;
+    }
+    if (line.startsWith('-')) return; // pip options: -c, -i, --index-url, -e…
+    const spec = line.split(';')[0].trim();
+    const m = spec.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?\s*===?\s*([^\s,]+)$/);
+    if (m) components.push(pypi(m[1], m[2], file, index + 1, { dev, direct: true }));
+    else skipped++;
+  });
+  const note = skipped ? `${file}: ${skipped} requirement(s) without an exact == pin were not audited` : null;
+  return { file, components, skipped, note };
+}
+
+/** poetry.lock / uv.lock: `[[package]]` tables with `name` and `version`. */
+function readTomlLock(root, file) {
+  const components = [];
+  let current = null;
+  let rootName = null;
+  let rootVersion = null;
+  const flush = () => {
+    if (!current || !current.name || !current.version) return;
+    if (current.local) {
+      rootName = rootName || current.name;
+      rootVersion = rootVersion || current.version;
+    } else {
+      components.push(pypi(current.name, current.version, file, current.line, { direct: false }));
+    }
+  };
+  lines(path.join(root, file)).forEach((raw, index) => {
+    const line = raw.trim();
+    if (line === '[[package]]') {
+      flush();
+      current = { line: index + 1 };
+      return;
+    }
+    if (!current) return;
+    if (/^\[/.test(line)) { // a sub-table: [package.dependencies], [package.source]…
+      if (!line.startsWith('[package.')) { flush(); current = null; }
+      return;
+    }
+    const kv = line.match(/^(name|version)\s*=\s*"([^"]+)"/);
+    if (kv && !current[kv[1]]) current[kv[1]] = kv[2];
+    // uv marks the project itself with an editable/virtual source.
+    if (/^source\s*=\s*\{\s*(editable|virtual)\s*=/.test(line)) current.local = true;
+  });
+  flush();
+  return { file, components, rootName, rootVersion };
+}
+
+/** Pipfile.lock (JSON): `default` and `develop` maps of `"==version"`. */
+function readPipfileLock(root, file) {
+  let doc;
+  try {
+    doc = JSON.parse(fs.readFileSync(path.join(root, file), 'utf8'));
+  } catch {
+    return { file, components: [], skipped: 0, note: `${file} could not be parsed` };
+  }
+  const text = lines(path.join(root, file));
+  const components = [];
+  for (const [group, dev] of [['default', false], ['develop', true]]) {
+    for (const [name, info] of Object.entries(doc[group] || {})) {
+      const version = info && typeof info.version === 'string' ? info.version.replace(/^===?/, '') : null;
+      if (!version) continue;
+      const line = text.findIndex((l) => l.includes(`"${name}": {`)) + 1 || 1;
+      components.push(pypi(name, version, file, line, { dev, direct: true }));
+    }
+  }
+  return { file, components };
+}
+
+function pypi(name, version, file, line, { dev = false, direct = false } = {}) {
+  // PEP 503 normalisation, as purl and OSV use it.
+  const normalized = name.toLowerCase().replace(/[-_.]+/g, '-');
+  return component({
+    ecosystem: 'pypi', name: normalized, osvName: normalized, version,
+    purl: `pkg:pypi/${normalized}@${version}`, file, line, dev, direct,
+  });
+}
+
+// --- Go ------------------------------------------------------------------------------
+
+/** go.mod `require` directives (single and block form); `replace` is applied. */
+function readGoMod(root, file) {
+  const text = lines(path.join(root, file));
+  const requires = [];
+  const replaces = new Map();
+  let block = null;
+  let moduleName = null;
+
+  text.forEach((raw, index) => {
+    const line = raw.replace(/\/\/(?!\s*indirect).*$/, '').trim();
+    const mod = line.match(/^module\s+(\S+)/);
+    if (mod) moduleName = mod[1];
+    if (/^(require|replace|exclude|retract)\s*\($/.test(line)) { block = line.split(/\s/)[0]; return; }
+    if (line === ')') { block = null; return; }
+    const single = line.match(/^(require|replace)\s+(.+)$/);
+    const kind = single ? single[1] : block;
+    const body = single ? single[2] : line;
+    if (kind === 'require') {
+      const m = body.match(/^(\S+)\s+(v\S+)(\s+\/\/\s*indirect)?/);
+      if (m) requires.push({ module: m[1], version: m[2], indirect: Boolean(m[3]), line: index + 1 });
+    } else if (kind === 'replace') {
+      const m = body.match(/^(\S+)(?:\s+v\S+)?\s+=>\s+(\S+)\s+(v\S+)/);
+      if (m) replaces.set(m[1], { module: m[2], version: m[3] });
+    }
+  });
+
+  const components = requires.map((r) => {
+    const target = replaces.get(r.module) || { module: r.module, version: r.version };
+    return component({
+      ecosystem: 'golang', name: target.module, osvName: target.module, version: target.version,
+      purl: `pkg:golang/${target.module}@${target.version}`, file, line: r.line, direct: !r.indirect,
+    });
+  });
+  return { file, components, rootName: moduleName ? moduleName.split('/').pop() : null };
+}
+
+// --- Java --------------------------------------------------------------------------------
+
+/** gradle.lockfile: `group:artifact:version=configurations`. */
+function readGradleLock(root, file) {
+  const components = [];
+  lines(path.join(root, file)).forEach((raw, index) => {
+    const m = raw.trim().match(/^([^:#\s]+):([^:\s]+):([^=\s]+)=(.*)$/);
+    if (!m) return;
+    const configs = m[4];
+    const dev = configs && !/(runtimeClasspath|compileClasspath)/.test(configs);
+    components.push(maven(m[1], m[2], m[3], file, index + 1, { dev, direct: false }));
+  });
+  return { file, components };
+}
+
+/**
+ * pom.xml declared dependencies. Versions come from the dependency itself,
+ * `${property}` values in <properties> (and project.version) or the
+ * <dependencyManagement> section. Transitive dependencies need Maven to be
+ * resolved, so only the declared ones are audited.
+ */
+function readPom(root, file) {
+  const xml = fs.readFileSync(path.join(root, file), 'utf8');
+  const stripped = xml.replace(/<!--[\s\S]*?-->/g, (c) => c.replace(/[^\n]/g, ' '));
+
+  const tag = (block, name) => {
+    const m = block.match(new RegExp(`<${name}>\\s*([^<]*?)\\s*</${name}>`));
+    return m ? m[1] : null;
+  };
+  // Top-level project fields, ignoring <parent>, <dependencies> and the like.
+  const topLevel = stripped
+    .replace(/<parent>[\s\S]*?<\/parent>/, '')
+    .replace(/<(dependencies|dependencyManagement|build|profiles|plugins|reporting)>[\s\S]*?<\/\1>/g, '');
+  const parentBlock = (stripped.match(/<parent>([\s\S]*?)<\/parent>/) || [])[1] || '';
+  const props = {
+    'project.version': tag(topLevel, 'version') || tag(parentBlock, 'version'),
+    'project.groupId': tag(topLevel, 'groupId') || tag(parentBlock, 'groupId'),
+  };
+  const propsBlock = (stripped.match(/<properties>([\s\S]*?)<\/properties>/) || [])[1] || '';
+  for (const m of propsBlock.matchAll(/<([\w.-]+)>\s*([^<]*?)\s*<\/\1>/g)) props[m[1]] = m[2];
+  const resolve = (value) => {
+    let v = value;
+    for (let i = 0; i < 5 && v && /\$\{([^}]+)\}/.test(v); i++) {
+      v = v.replace(/\$\{([^}]+)\}/g, (_, key) => (props[key] !== undefined && props[key] !== null ? props[key] : `\${${key}}`));
+    }
+    return v;
+  };
+
+  const managedBlock = (stripped.match(/<dependencyManagement>([\s\S]*?)<\/dependencyManagement>/) || [])[1] || '';
+  const managed = new Map();
+  for (const m of managedBlock.matchAll(/<dependency>([\s\S]*?)<\/dependency>/g)) {
+    const g = resolve(tag(m[1], 'groupId'));
+    const a = resolve(tag(m[1], 'artifactId'));
+    const v = resolve(tag(m[1], 'version'));
+    if (g && a && v) managed.set(`${g}:${a}`, v);
+  }
+
+  const components = [];
+  let skipped = 0;
+  const outside = stripped.replace(/<dependencyManagement>[\s\S]*?<\/dependencyManagement>/, (c) => c.replace(/[^\n]/g, ' '));
+  for (const m of outside.matchAll(/<dependency>([\s\S]*?)<\/dependency>/g)) {
+    const block = m[1];
+    const g = resolve(tag(block, 'groupId'));
+    const a = resolve(tag(block, 'artifactId'));
+    let v = resolve(tag(block, 'version')) || managed.get(`${g}:${a}`) || null;
+    if (!g || !a || !v || /\$\{|[[\]()]/.test(v)) { skipped++; continue; } // unresolved or a version range
+    const scope = tag(block, 'scope');
+    const line = outside.slice(0, m.index).split('\n').length + block.slice(0, block.indexOf('<artifactId>')).split('\n').length - 1;
+    components.push(maven(g, a, v, file, line, { dev: scope === 'test' || scope === 'provided', direct: true }));
+  }
+  const notes = ['pom.xml: declared dependencies only; commit a Maven-generated SBOM (cyclonedx-maven-plugin) to audit transitive ones'];
+  if (skipped) notes.push(`pom.xml: ${skipped} dependency(ies) with a version inherited from a parent/BOM or a range were not audited`);
+  return {
+    file, components, skipped, note: notes.join('; '),
+    rootName: tag(topLevel, 'artifactId'), rootVersion: props['project.version'],
+  };
+}
+
+function maven(group, artifact, version, file, line, { dev = false, direct = false } = {}) {
+  return component({
+    ecosystem: 'maven', name: `${group}:${artifact}`, osvName: `${group}:${artifact}`, version,
+    purl: `pkg:maven/${group}/${artifact}@${version}`, file, line, dev, direct,
+  });
+}
+
+// --- Shared ------------------------------------------------------------------------------
+
+function component({ ecosystem, name, osvName, version, purl, file, line, dev = false, direct = false }) {
+  return {
+    key: purl,
+    name,
+    version,
+    purl,
+    ecosystem,
+    osvName,
+    license: null,
+    scope: dev ? 'optional' : 'required',
+    dev,
+    optional: dev,
+    direct,
+    dependsOn: [],
+    location: { file, line },
+  };
+}
+
+function dedupe(components) {
+  const seen = new Map();
+  for (const c of components) {
+    const existing = seen.get(c.key);
+    if (!existing) seen.set(c.key, c);
+    else {
+      existing.direct = existing.direct || c.direct;
+      existing.optional = existing.optional && c.optional;
+      existing.dev = existing.optional;
+      existing.scope = existing.optional ? 'optional' : 'required';
+    }
+  }
+  return [...seen.values()].sort((a, b) => a.key.localeCompare(b.key));
+}
+
+function lines(file) {
+  try {
+    return fs.readFileSync(file, 'utf8').split(/\r?\n/);
+  } catch {
+    return [];
+  }
+}
+
+function exists(root, file) {
+  return fs.existsSync(path.join(root, file));
+}
+
+function firstExisting(root, files) {
+  return files.find((f) => exists(root, f)) || null;
+}
+
+module.exports = { readManifests, hasManifests };

package/src/core/policy.js

@@ -23,6 +23,9 @@ const DEFAULT_POLICY = {
   // Fail when a dependency has an actively exploited vulnerability (CISA KEV),
   // the trigger of the CRA Art. 14 reporting obligation.
   failOnKev: true,
+  // ISO 3166-1 alpha-2 country of the manufacturer's main establishment: it
+  // decides the CSIRT that receives CRA Art. 14 notifications (e.g. "ES").
+  country: null,
   // Audit only production dependencies (recommended for shipped products).
   productionOnly: false,
   vulnerabilities: {

package/src/core/project-source.js

@@ -0,0 +1,62 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { parseLockfile } = require('./lockfile-parser');
+const { readSbom } = require('./sbom-reader');
+const { readManifests, hasManifests } = require('./manifest-reader');
+
+/**
+ * Decides where the components of a project come from:
+ *
+ *  - `sbom`:          an input SBOM (`-i`), any ecosystem
+ *  - `npm`:           the npm/Yarn/pnpm lockfile (native, richest data)
+ *  - `manifest`:      requirements.txt / poetry.lock / go.mod / pom.xml… when
+ *                     there is no npm lockfile
+ *  - `npm+manifest`:  both in the same folder (e.g. a JS front end next to a
+ *                     Python service); vulnerabilities cover both
+ *
+ * `parsed` is what the scanner, license check, VEX and SARIF consume; it is
+ * null for plain npm projects, which keep their existing code paths.
+ *
+ * @param {string} projectRoot
+ * @param {{ input?: string|null }} [options]
+ */
+function loadProject(projectRoot, { input = null } = {}) {
+  if (input) {
+    const parsed = readSbom(input);
+    return { mode: 'sbom', parsed, manifests: null };
+  }
+
+  const lock = parseLockfile(projectRoot);
+  const manifests = hasManifests(projectRoot) ? readManifests(projectRoot) : null;
+
+  if (lock.ok && manifests) {
+    // npm components keep their name-based lookups; manifest ones use purls.
+    const parsed = {
+      ...lock,
+      purlBased: false,
+      components: [...lock.components, ...manifests.components],
+      root: { ...lock.root, dependsOn: [...lock.root.dependsOn, ...manifests.root.dependsOn] },
+    };
+    return { mode: 'npm+manifest', parsed, manifests };
+  }
+  if (!lock.ok && manifests) return { mode: 'manifest', parsed: manifests, manifests };
+  return { mode: 'npm', parsed: null, manifests: null };
+}
+
+/**
+ * The nearest folder, walking up from `start`, with a package.json or a
+ * supported manifest of another ecosystem. Null when there is none.
+ */
+function findAnyProjectRoot(start) {
+  let dir = path.resolve(start);
+  for (;;) {
+    if (fs.existsSync(path.join(dir, 'package.json')) || hasManifests(dir)) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+module.exports = { loadProject, findAnyProjectRoot };

package/src/core/readiness.js

@@ -5,6 +5,8 @@ const path = require('node:path');
 const { readJson } = require('../utils/fs');
 const { parseLockfile } = require('./lockfile-parser');
 const { repositoryUrl } = require('./installed-metadata');
+const { readManifests } = require('./manifest-reader');
+const { reportingGuide } = require('./reporting');
 
 /**
  * Organisational CRA duties that can be checked from the repository itself:
@@ -29,10 +31,11 @@ const URL = /https?:\/\/\S+/;
 
 /**
  * @param {string} projectRoot
- * @param {{ now?: Date }} [options]
+ * @param {{ now?: Date, country?: string|null }} [options]
+ *   `country`: main establishment (ISO alpha-2); adds its CSIRT's checks.
  * @returns {{ checks: Array<object>, passed: boolean, files: object }}
  */
-function checkReadiness(projectRoot, { now = new Date() } = {}) {
+function checkReadiness(projectRoot, { now = new Date(), country = null } = {}) {
   const checks = [];
   const add = (id, label, level, passed, detail, reference) => checks.push({ id, label, level, passed: Boolean(passed), detail, reference });
 
@@ -53,8 +56,9 @@ function checkReadiness(projectRoot, { now = new Date() } = {}) {
 
   // --- Support period ---------------------------------------------------------
   const supportText = `${securityMd}\n${readme}`;
-  const supportMention = /support(ed)?\s+period|supported\s+until|end\s+of\s+(security\s+)?support|end[-\s]of[-\s]life|\bEOL\b/i.test(supportText);
-  const supportDate = supportMention && /\b(19|20)\d{2}-\d{2}(-\d{2})?\b|\b\d+\s+years?\b/i.test(supportText);
+  // English and Spanish wording ("periodo de soporte", "fin del soporte"…).
+  const supportMention = /support(ed)?\s+period|supported\s+until|end\s+of\s+(security\s+)?support|end[-\s]of[-\s]life|\bEOL\b|periodo\s+de\s+soporte|soporte\s+(de\s+seguridad\s+)?hasta|fin\s+del\s+soporte|fin\s+de\s+vida/i.test(supportText);
+  const supportDate = supportMention && /\b(19|20)\d{2}-\d{2}(-\d{2})?\b|\b\d+\s+(years?|años?)\b/i.test(supportText);
   add('support-period', 'Support period and its end date stated', 'required', supportMention && supportDate,
     !supportMention ? 'No mention of the support period in SECURITY.md or README.md'
       : supportDate ? 'Support period with an end date or duration found' : 'Support period mentioned without an end date',
@@ -62,14 +66,23 @@ function checkReadiness(projectRoot, { now = new Date() } = {}) {
 
   // --- Recommended content ------------------------------------------------------
   add('supported-versions', 'Supported versions listed', 'recommended',
-    /supported\s+versions/i.test(securityMd), 'A "Supported Versions" section in SECURITY.md', 'CRA Annex II (7)');
+    /supported\s+versions|versiones\s+(con\s+soporte|soportadas)/i.test(securityMd), 'A "Supported Versions" section in SECURITY.md', 'CRA Annex II (7)');
   add('response-timeline', 'Response timeline for reporters', 'recommended',
-    /\b\d+\s*(business\s+)?(hours?|days?|weeks?)\b/i.test(securityMd), 'Acknowledgement / fix time frames in SECURITY.md',
+    /\b\d+\s*(business\s+)?(hours?|days?|weeks?|horas?|d[ií]as?|semanas?)\b/i.test(securityMd), 'Acknowledgement / fix time frames in SECURITY.md',
     'CRA Annex I Part II (5)');
   add('art14-process', 'Art. 14 reporting process (CSIRT / ENISA, 24 h / 72 h)', 'recommended',
-    /ENISA|CSIRT|single\s+reporting\s+platform|24\s*h(ours)?/i.test(securityMd),
+    /ENISA|CSIRT|single\s+reporting\s+platform|24\s*h(ours|oras)?/i.test(securityMd),
     'How actively exploited vulnerabilities and severe incidents are reported', 'CRA Art. 14');
 
+  // The coordinating CSIRT of the manufacturer's country (Art. 14(7)).
+  const local = reportingGuide(country).local;
+  if (local) {
+    add('coordinating-csirt', `Coordinating CSIRT named (${local.csirt})`, 'recommended',
+      new RegExp(local.csirt.split('-')[0], 'i').test(securityMd),
+      `SECURITY.md should say Art. 14 notifications go to ${local.csirt} via the ENISA SRP (access: ${local.srpAccess.contact})`,
+      'CRA Art. 14(7)');
+  }
+
   // --- security.txt (RFC 9116) --------------------------------------------------
   const securityTxtPath = firstExisting(projectRoot, SECURITY_TXT_PATHS);
   const txt = parseSecurityTxt(securityTxtPath ? read(path.join(projectRoot, securityTxtPath)) : '');
@@ -106,9 +119,12 @@ function checkReadiness(projectRoot, { now = new Date() } = {}) {
   // an SBOM produced by their own tooling (Syft, cdxgen…) kept in the repo.
   const parsed = parseLockfile(projectRoot);
   const sbomFile = parsed.ok ? null : findSbomFile(projectRoot);
-  add('sbom', 'SBOM available (npm lockfile or an SBOM file)', 'required', parsed.ok || sbomFile,
+  const manifests = parsed.ok || sbomFile ? null : readManifests(projectRoot);
+  add('sbom', 'Dependency inventory for the SBOM (lockfile, manifest or SBOM file)', 'required', parsed.ok || sbomFile || manifests,
     parsed.ok ? `${parsed.lockfileName} (${parsed.components.length} components)`
-      : sbomFile ? `Found ${sbomFile}` : `${parsed.error} For other ecosystems, commit an SBOM (e.g. sbom.cdx.json).`,
+      : sbomFile ? `Found ${sbomFile}`
+        : manifests ? `${manifests.files.join(', ')} (${manifests.components.length} components)`
+          : 'No lockfile, supported manifest or SBOM file found.',
     'CRA Annex I Part II (1)');
 
   add('package-repository', 'package.json links the source repository', 'recommended', Boolean(repositoryUrl(pkg.repository)),
@@ -140,7 +156,7 @@ function parseSecurityTxt(text) {
  *
  * @returns {Array<{ file: string, created: boolean }>}
  */
-function writeTemplates(projectRoot, { now = new Date() } = {}) {
+function writeTemplates(projectRoot, { now = new Date(), lang = 'en', country = null } = {}) {
   const pkg = readJson(path.join(projectRoot, 'package.json')) || {};
   const repo = repositoryUrl(pkg.repository);
   const advisories = repo && /github\.com/.test(repo) ? `${repo}/security/advisories/new` : null;
@@ -152,7 +168,7 @@ function writeTemplates(projectRoot, { now = new Date() } = {}) {
   if (existingMd) {
     results.push({ file: existingMd, created: false });
   } else {
-    fs.writeFileSync(path.join(projectRoot, 'SECURITY.md'), securityMdTemplate({ name, major, advisories }));
+    fs.writeFileSync(path.join(projectRoot, 'SECURITY.md'), securityMdTemplate({ name, major, advisories, lang, country }));
     results.push({ file: 'SECURITY.md', created: true });
   }
 
@@ -163,16 +179,26 @@ function writeTemplates(projectRoot, { now = new Date() } = {}) {
     const base = fs.existsSync(path.join(projectRoot, 'public')) ? 'public/.well-known' : '.well-known';
     fs.mkdirSync(path.join(projectRoot, base), { recursive: true });
     const expires = new Date(now.getTime() + 364 * DAY).toISOString().replace(/\.\d{3}Z$/, 'Z');
-    fs.writeFileSync(path.join(projectRoot, base, 'security.txt'), securityTxtTemplate({ advisories, repo, expires }));
+    fs.writeFileSync(path.join(projectRoot, base, 'security.txt'), securityTxtTemplate({ advisories, repo, expires, lang }));
     results.push({ file: `${base}/security.txt`, created: true });
   }
   return results;
 }
 
-function securityMdTemplate({ name, major, advisories }) {
+function securityMdTemplate({ name, major, advisories, lang, country }) {
+  if (lang === 'es') return securityMdTemplateEs({ name, major, advisories, country });
   const channel = advisories
     ? `Report it privately through [GitHub Security Advisories](${advisories}), or by email to TODO: security@example.com.`
     : 'Report it privately by email to TODO: security@example.com.';
+  const local = reportingGuide(country).local;
+  const csirtSection = local && local.country === 'ES' ? `
+### Spain — INCIBE-CERT
+
+Our main establishment is in Spain, so our coordinating CSIRT is **INCIBE-CERT**. Access to the ENISA
+Single Reporting Platform is requested from INCIBE (${local.srpAccess.contact}), which validates the
+manufacturer before registration. Cybersecurity incidents outside the CRA go to ${local.otherChannels[0].contact};
+if we are unsure whether a case is in CRA scope, we report it through INCIBE-CERT's usual channels first.
+` : '';
   return `# Security Policy
 
 ## Supported Versions
@@ -209,15 +235,74 @@ we notify the coordinating CSIRT and ENISA through the Single Reporting Platform
 - a **final report within 14 days** after a corrective measure is available (one month for severe incidents).
 
 Affected users are informed of the issue and of the corrective measures to take.
-`;
+${csirtSection}`;
+}
+
+function securityMdTemplateEs({ name, major, advisories, country }) {
+  const channel = advisories
+    ? `Comunícalo de forma privada mediante [GitHub Security Advisories](${advisories}) o por correo a TODO: security@example.com.`
+    : 'Comunícalo de forma privada por correo a TODO: security@example.com.';
+  const local = reportingGuide(country).local;
+  const csirt = local && local.country === 'ES'
+    ? `nuestro CSIRT coordinador, **INCIBE-CERT**, y a ENISA a través de la plataforma única de notificación (SRP)`
+    : 'el CSIRT coordinador de nuestro Estado miembro y a ENISA a través de la plataforma única de notificación (SRP)';
+  const spain = local && local.country === 'ES' ? `
+### España — INCIBE-CERT
+
+Nuestro establecimiento principal está en España, por lo que nuestro CSIRT coordinador es **INCIBE-CERT**:
+
+- El acceso a la plataforma SRP de ENISA se solicita a INCIBE (${local.srpAccess.contact}), que valida al
+  fabricante antes de completar el registro.
+- Los incidentes de ciberseguridad que no entran en el CRA se comunican a ${local.otherChannels[0].contact}.
+- Si dudamos de si un caso entra en el ámbito del CRA, lo notificamos primero por los canales habituales
+  de INCIBE-CERT, que nos indica si debe registrarse formalmente en la SRP.
+` : '';
+  return `# Política de seguridad
+
+## Versiones con soporte
+
+| Versión | Soporte | Fin del soporte de seguridad |
+| ------- | ------- | ---------------------------- |
+| ${major}.x     | ✅      | TODO: AAAA-MM-DD             |
+| < ${major}.0   | ❌      | —                            |
+
+**Periodo de soporte:** ${name} ${major}.x recibe actualizaciones de seguridad hasta el TODO: AAAA-MM-DD
+(el Reglamento de Ciberresiliencia de la UE prevé al menos 5 años, o el tiempo de uso previsto del producto).
+
+## Cómo comunicar una vulnerabilidad
+
+Por favor, **no** abras una incidencia pública para problemas de seguridad.
+
+${channel}
+
+Indica la versión afectada, una descripción del problema y, si es posible, los pasos para reproducirlo.
+
+## Nuestro proceso (divulgación coordinada de vulnerabilidades)
+
+- Acusamos recibo en un máximo de **3 días hábiles** y enviamos una primera valoración en **10 días hábiles**.
+- Acordamos con quien informa una fecha de publicación, normalmente en **90 días**, y le damos crédito si lo desea.
+- Las correcciones se publican como actualizaciones de seguridad, separadas de las de funcionalidad cuando es
+  posible, y se anuncian en las notas de versión y en un GitHub Security Advisory.
+
+## Reglamento de Ciberresiliencia de la UE — Notificación (art. 14)
+
+Cuando tenemos conocimiento de una vulnerabilidad activamente explotada en ${name}, o de un incidente grave que
+afecte a su seguridad, lo notificamos a ${csirt}:
+
+- una **alerta temprana en 24 horas**,
+- una **notificación en 72 horas**,
+- un **informe final en 14 días** desde que haya una medida correctora (en incidentes graves, un mes tras la notificación).
+
+Informamos a los usuarios afectados del problema y de las medidas que deben aplicar.
+${spain}`;
 }
 
-function securityTxtTemplate({ advisories, repo, expires }) {
+function securityTxtTemplate({ advisories, repo, expires, lang }) {
   const lines = ['# RFC 9116 — https://securitytxt.org', 'Contact: mailto:TODO-security@example.com'];
   if (advisories) lines.push(`Contact: ${advisories}`);
   lines.push(`Expires: ${expires}`);
   if (repo) lines.push(`Policy: ${repo}/blob/HEAD/SECURITY.md`);
-  lines.push('Preferred-Languages: en', '');
+  lines.push(`Preferred-Languages: ${lang === 'es' ? 'es, en' : 'en'}`, '');
   return lines.join('\n');
 }