cra-audit 2.2.0 → 2.4.0

package/src/core/reporting.js

@@ -0,0 +1,79 @@
+'use strict';
+
+/**
+ * Where and how a manufacturer reports under CRA Art. 14. Notifications go
+ * through ENISA's Single Reporting Platform (SRP) to the CSIRT designated as
+ * coordinator of the Member State of the manufacturer's main establishment.
+ *
+ * Country-specific procedures are added only when they have been verified
+ * against the CSIRT's own publications (see `source`).
+ */
+
+const SRP = {
+  url: 'https://portal.cra-srp.enisa.europa.eu',
+  faq: 'https://www.enisa.europa.eu/topics/product-security/single-reporting-platform-srp/frequently-asked-questions',
+};
+
+const DEADLINES = {
+  vulnerability: [
+    { step: 'early-warning', deadline: '24 hours after becoming aware' },
+    { step: 'notification', deadline: '72 hours after becoming aware' },
+    { step: 'final-report', deadline: '14 days after a corrective or mitigating measure is available' },
+  ],
+  incident: [
+    { step: 'early-warning', deadline: '24 hours after becoming aware' },
+    { step: 'notification', deadline: '72 hours after becoming aware' },
+    { step: 'final-report', deadline: '1 month after the 72-hour notification' },
+  ],
+};
+
+const CSIRTS = {
+  ES: {
+    country: 'ES',
+    csirt: 'INCIBE-CERT',
+    website: 'https://www.incibe.es/incibe-cert',
+    srpAccess: {
+      contact: 'cve-coordination@incibe.es',
+      steps: [
+        'Email cve-coordination@incibe.es asking for a user on the ENISA Single Reporting Platform (SRP).',
+        'INCIBE replies with the information and documents it needs, and validates that you are a manufacturer bound by the CRA.',
+        'Once validated, INCIBE sends the instructions to complete the SRP registration and start notifying.',
+      ],
+      advice: 'Request SRP access before you need it: the validation happens before you can notify, and the 24-hour clock does not wait.',
+    },
+    otherChannels: [
+      { purpose: 'Other cybersecurity incidents (outside CRA Art. 14)', contact: 'incidencias@incibe-cert.es' },
+      { purpose: 'Undisclosed (0-day) vulnerabilities needing coordination and a CVE ID (INCIBE CNA)', contact: 'cve-coordination@incibe.es' },
+    ],
+    whenInDoubt: 'If you are not sure a case is in CRA scope, report it through INCIBE-CERT\'s usual channels; INCIBE tells you whether to file it formally in the SRP.',
+    source: 'https://www.incibe.es/incibe-cert/blog/reglamento-de-ciberresiliencia-cra-que-es-quien-afecta-y-como-prepararse',
+    verified: '2026-09-09',
+  },
+};
+
+/**
+ * Reporting guidance for a country (ISO 3166-1 alpha-2), or the generic
+ * EU procedure when the country is unknown or not yet covered.
+ *
+ * @param {string|null|undefined} country
+ */
+function reportingGuide(country) {
+  const code = typeof country === 'string' ? country.trim().toUpperCase() : null;
+  const local = code ? CSIRTS[code] || null : null;
+  return {
+    country: code,
+    platform: 'ENISA Single Reporting Platform (SRP)',
+    srp: SRP,
+    recipients: local
+      ? `${local.csirt} (CSIRT designated as coordinator) and ENISA`
+      : 'the CSIRT designated as coordinator of your main establishment\'s Member State, and ENISA',
+    deadlines: DEADLINES,
+    local,
+  };
+}
+
+function supportedCountries() {
+  return Object.keys(CSIRTS);
+}
+
+module.exports = { reportingGuide, supportedCountries };

package/src/core/sbom-reader.js

@@ -45,6 +45,7 @@ function readSbom(file) {
   return {
     ok: true,
     manager: 'sbom',
+    purlBased: true,
     format: result.format,
     lockfileName: path.basename(file),
     sourceFile: file,

package/src/core/vuln-scanner.js

@@ -25,19 +25,19 @@ const SEVERITY_ORDER = ['info', 'low', 'moderate', 'high', 'critical'];
  *    CVEs found are cross-checked with the CISA KEV catalogue.
  *  - `npm`: `npm audit`. Also the fallback when OSV.dev is unreachable.
  *
- * An existing SBOM of any ecosystem can be scanned instead of the lockfile by
- * passing the result of readSbom() as `parsed`; its components are looked up
- * in OSV.dev by Package URL.
+ * Other ecosystems are scanned by passing, as `parsed`, the result of
+ * readSbom() (an input SBOM) or readManifests() (requirements.txt, go.mod,
+ * pom.xml…); their components are looked up in OSV.dev by Package URL.
  *
  * @param {string} projectRoot
  * @param {{ production?: boolean, source?: 'osv'|'npm', kev?: boolean, parsed?: object }} [options]
  * @returns {Promise<object>}
  */
 async function scanVulnerabilities(projectRoot, { production = false, source = 'osv', kev = true, parsed: given } = {}) {
-  const fromSbom = Boolean(given && given.manager === 'sbom');
+  const fromSbom = Boolean(given && given.purlBased);
   if (source === 'npm') {
     if (fromSbom) {
-      return { ok: false, error: '`npm audit` cannot scan an input SBOM; use the default OSV source.', counts: emptyCounts(), vulnerabilities: [] };
+      return { ok: false, error: '`npm audit` only scans npm projects; use the default OSV source.', counts: emptyCounts(), vulnerabilities: [] };
     }
     return npmAuditSection(projectRoot, { production });
   }
@@ -88,7 +88,9 @@ async function scanVulnerabilities(projectRoot, { production = false, source = '
     ok: true,
     source: 'osv',
     scanned: scannable.length,
-    input: fromSbom ? { file: parsed.sourceFile, format: parsed.format, unidentified: parsed.unidentified } : null,
+    input: fromSbom
+      ? { file: parsed.sourceFile || parsed.lockfileName, format: parsed.format, unidentified: parsed.unidentified, notes: parsed.notes || [] }
+      : null,
     ecosystems: [...new Set(scannable.map((c) => c.ecosystem || 'npm'))].sort(),
     kev: catalogue
       ? (catalogue.ok
@@ -135,6 +137,7 @@ function toFinding(component, records, isDirect, catalogue) {
     version: component.version,
     purl: component.purl || buildPurl(component.name, component.version),
     ecosystem: component.ecosystem || 'npm',
+    location: component.location || null,
     severity,
     direct: isDirect,
     range: null,
@@ -169,7 +172,8 @@ function productionComponents(parsed, rootPkg) {
       if (!seen.has(dep)) { seen.add(dep); queue.push(dep); }
     }
   }
-  return parsed.components.filter((c) => seen.has(componentKey(c.name, c.version)));
+  // Components of other ecosystems (npm+manifest projects) use their own scope.
+  return parsed.components.filter((c) => (c.ecosystem ? !c.optional : seen.has(componentKey(c.name, c.version))));
 }
 
 function severityRank(severity) {

package/src/reporters/console.js

@@ -23,14 +23,14 @@ function reportConsole(report) {
     logger.detail(`Policy: ${report.policySource}`);
   }
 
-  if (report.sections.vulnerabilities) renderVulnerabilities(report.sections.vulnerabilities);
+  if (report.sections.vulnerabilities) renderVulnerabilities(report.sections.vulnerabilities, report.reporting);
   if (report.sections.sbom) renderSbom(report.sections.sbom);
   if (report.sections.licenses) renderLicenses(report.sections.licenses);
 
   renderSummary(report);
 }
 
-function renderVulnerabilities(section) {
+function renderVulnerabilities(section, reporting) {
   logger.heading('1) Known vulnerabilities (CRA Annex I · Art. 14)');
   if (!section.ok) {
     logger.error(section.error);
@@ -38,6 +38,7 @@ function renderVulnerabilities(section) {
   }
   logger.detail(describeSources(section));
   for (const warning of section.warnings || []) logger.warn(warning);
+  for (const note of (section.input && section.input.notes) || []) logger.detail(note);
 
   const c = section.counts;
   if (c.total === 0) {
@@ -74,7 +75,7 @@ function renderVulnerabilities(section) {
     logger.detail(`… and ${ordered.length - top.length} more.`);
   }
 
-  if (c.kev) renderArticle14Notice();
+  if (c.kev) renderArticle14Notice(reporting);
   if (c.malicious) {
     logger.log('');
     logger.error(color.bold('Malicious package(s) detected: treat this as a security incident.'));
@@ -89,22 +90,33 @@ function describeSources(section) {
     ? `CISA KEV ${section.kev.catalogVersion || ''} (${section.kev.entries} entries)`.replace('  ', ' ')
     : `CISA KEV not checked (${(section.kev && section.kev.error) || 'unavailable'})`;
   const scope = section.input
-    ? `${section.scanned} components from ${shortPath(section.input.file)} (${(section.ecosystems || []).join(', ')})` +
-      (section.input.unidentified ? ` · ${section.input.unidentified} without purl skipped` : '')
-    : `${section.scanned} components`;
+    ? `${section.scanned} components from ${section.input.format === 'manifest' ? section.input.file : shortPath(section.input.file)} (${(section.ecosystems || []).join(', ')})` +
+      (section.input.unidentified ? ` · ${section.input.unidentified} ${section.input.format === 'manifest' ? 'not pinned, skipped' : 'without purl skipped'}` : '')
+    : `${section.scanned} components${(section.ecosystems || []).length > 1 ? ` (${section.ecosystems.join(', ')})` : ''}`;
   return `Sources: OSV.dev (GitHub advisories + OpenSSF malicious packages) · ${kev} · ${scope}`;
 }
 
 /** CRA Art. 14 reporting clock, shown when a KEV-listed vulnerability is found. */
-function renderArticle14Notice() {
+function renderArticle14Notice(reporting) {
+  const local = reporting && reporting.local;
   logger.log('');
   logger.warn(color.bold('CRA Art. 14 — actively exploited vulnerability in a dependency'));
   logger.detail('If it affects a product with digital elements you place on the EU market, notify');
-  logger.detail('the coordinating CSIRT and ENISA through the Single Reporting Platform:');
+  logger.detail(`${local ? `${local.csirt} and ENISA` : 'the coordinating CSIRT and ENISA'} through the Single Reporting Platform (SRP):`);
   logger.detail('  • Early warning ........ within 24 hours of becoming aware');
   logger.detail('  • Notification ......... within 72 hours');
   logger.detail('  • Final report ......... within 14 days after a corrective measure is available');
   logger.detail('Assess exploitability in your product first; document the decision either way.');
+  if (local) {
+    logger.log('');
+    logger.detail(color.bold(`${local.csirt} (${local.country}) — access to the SRP:`));
+    local.srpAccess.steps.forEach((step, i) => logger.detail(`  ${i + 1}. ${step}`));
+    logger.detail(`  ${local.srpAccess.advice}`);
+    logger.detail(`  ${local.whenInDoubt}`);
+    logger.detail(`  Source: ${local.source}`);
+  } else {
+    logger.detail(`SRP: ${reporting ? reporting.srp.url : 'https://portal.cra-srp.enisa.europa.eu'} · Set your country (--country, e.g. ES) for its CSIRT's steps.`);
+  }
 }
 
 function describeFix(fix) {
@@ -121,6 +133,12 @@ function renderSbom(section) {
     logger.error(section.error);
     return;
   }
+  if (section.manifest) {
+    logger.detail(`Components read from ${section.files.join(', ')} (${section.ecosystems.join(', ')}): ${section.componentCount}`);
+    logger.warn('cra-audit builds TR-03183 SBOMs from npm lockfiles. For these ecosystems, commit the SBOM your');
+    logger.detail('build tooling produces (Syft, cdxgen, cyclonedx-maven-plugin, cyclonedx-py…) and audit it with -i.');
+    return;
+  }
   logger.detail(`${section.input ? `Input SBOM: ${shortPath(section.input)} · ` : ''}Format: ${section.format} · Components: ${section.componentCount}`);
 
   if (section.validation) {

package/src/reporters/sarif.js

@@ -30,7 +30,8 @@ function buildSarif(report, projectRoot, policy = {}) {
   const rules = new Map();
   const results = [];
   const vulns = report.sections.vulnerabilities;
-  const inputFile = vulns && vulns.input ? vulns.input.file : null;
+  // An input SBOM is searched for purls; manifest findings carry their own location.
+  const inputFile = vulns && vulns.input && vulns.input.format !== 'manifest' ? vulns.input.file : null;
   const lock = lockfileLocator(projectRoot, inputFile);
   const assessments = normalizeAllowlist(policy);
 
@@ -47,7 +48,7 @@ function buildSarif(report, projectRoot, policy = {}) {
             : finding.malicious || source.kev || ['critical', 'high'].includes(source.severity || finding.severity) ? 'error'
               : (source.severity || finding.severity) === 'moderate' ? 'warning' : 'note',
           message: { text: vulnerabilityMessage(finding, source) },
-          locations: [lock.locate(finding.name, finding.version, finding.purl)],
+          locations: [finding.location ? lock.at(finding.location) : lock.locate(finding.name, finding.version, finding.purl)],
           partialFingerprints: { 'craAudit/v1': `${ruleId}:${finding.name}@${finding.version || ''}` },
         };
         if (accepted) {
@@ -71,14 +72,17 @@ function buildSarif(report, projectRoot, policy = {}) {
       ['cra-audit/license-missing', s.missing, 'warning', (c) => `${c.name}@${c.version} has no documented license (TR-03183-2 §5.2.2).`],
     ];
     for (const [ruleId, list, level, text] of groups) {
-      if (!list.length) continue;
+      // Manifests (requirements.txt, go.mod…) never declare licenses: that gap is
+      // reported once by the audit, not as one alert per dependency.
+      const relevant = ruleId === 'cra-audit/license-missing' ? list.filter((c) => !c.location) : list;
+      if (!relevant.length) continue;
       rules.set(ruleId, licenseRule(ruleId));
-      for (const c of list) {
+      for (const c of relevant) {
         results.push({
           ruleId,
           level,
           message: { text: text(c) },
-          locations: [lock.locate(c.name, c.version, c.purl)],
+          locations: [c.location ? lock.at(c.location) : lock.locate(c.name, c.version, c.purl)],
           partialFingerprints: { 'craAudit/v1': `${ruleId}:${c.name}@${c.version}` },
         });
       }
@@ -193,7 +197,14 @@ function lockfileLocator(projectRoot, inputFile = null) {
       },
     };
   };
-  return { repoRoot, locate };
+  // A known file + line (components read from manifests).
+  const at = ({ file: rel, line }) => ({
+    physicalLocation: {
+      artifactLocation: { uri: path.relative(repoRoot, path.resolve(projectRoot, rel)).split(path.sep).join('/'), uriBaseId: '%SRCROOT%' },
+      region: { startLine: line || 1 },
+    },
+  });
+  return { repoRoot, locate, at };
 }
 
 function findEntryLine(lines, name, version) {