fad-checker 2.0.1 → 2.1.1

package/CHANGELOG.md

@@ -3,6 +3,56 @@
 All notable changes to `fad-checker` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.1.0]
+
+### Added
+- **Embedded-binary scanning (chapter 1B).** The Maven codec now discovers Maven
+  coordinates inside committed `.jar`/`.war`/`.ear` archives — vendored libs,
+  Spring-Boot fat-jars, shaded uber-jars — by unzipping them **in memory** (via
+  `fflate`, recursing into nested jars without touching disk, so there is no
+  zip-slip risk). Each artifact's coordinate is read from
+  `META-INF/maven/.../pom.properties` → `MANIFEST.MF` → file name; unidentifiable
+  archives are flagged in chapter 0 rather than scanned blindly. Findings carry
+  `provenance:"embedded"`, report in a dedicated **Embedded binaries** chapter
+  (grouped by containing archive), feed the `--fail-on` gate, and are labelled in
+  the SBOM (`fad:provenance`/`fad:location` + unique `bom-ref`), SARIF
+  (`provenance` + nested-jar location) and JSON exports. Auto when archives are
+  present; `--no-jars` disables it.
+
+### Changed
+- **Unified output flags.** Every output now has its own `--report-<type>` flag
+  taking an OPTIONAL path (omit it → a default name under `--report-output`):
+  `--report-html`, `--report-doc`, `--report-sbom`, `--report-csaf`,
+  `--report-json`, `--report-sarif`. With no `--report-*` flag, HTML + `.doc` are
+  written as before; selecting any flag writes exactly that set.
+  **BREAKING:** the old `--export-sbom`/`--export-csaf`/`--export-json`/`--export-sarif`
+  flags are removed — use `--report-sbom`/`-csaf`/`-json`/`-sarif`. (The unrelated
+  `--export-cache` / `--export-anonymized` flags are unchanged.)
+- **`--no-report` now writes NO output files at all** (gate-only / CI mode) — the
+  scan, terminal summary and `--fail-on` gate still run. Previously it
+  short-circuited the whole flow, so `--no-report --fail-on …` silently passed.
+
+### Fixed
+- **Catastrophic data loss**: `--target` being a *parent* of `--src` passed the
+  guardrail and `rimraf`'d the source tree. The guard now rejects overlap in both
+  directions.
+- **Missed npm/yarn/pnpm CVEs**: only the highest version of a duplicated package
+  was scanned; nested-`node_modules` lower versions are now accumulated.
+- **CPE false negatives**: AND-configurations with a `vulnerable:false` platform
+  node wrongly dropped real findings.
+- **VEX over-suppression**: an unmappable product id suppressed a CVE for every
+  dependency.
+- **CSAF/SBOM/SARIF scoring**: OSV CVSS *vectors* were mis-read as the score
+  (`3.1`), the NVD CVSS version label was malformed (`CVSS:V31`), and an NVD record
+  without metrics clobbered an OSV-derived vector — so CSAF emitted no scores and
+  SBOM showed `method:other`. CVSS v3 base scores are now computed from the vector,
+  labels normalised, and exports stay schema-valid (no empty `known_affected`, no
+  `UNKNOWN` baseSeverity, no v4 vector under a v3 score).
+- **CI / parsing**: an invalid `--fail-on <level>` (typo) now hard-fails instead of
+  silently disabling the gate; Maven version ordering for dot-aligned qualifiers
+  (`5.0.0.RC1` vs `5.0.0.5`) corrected; classic poetry.lock `category="dev"` and
+  `go.sum` highest-version selection fixed.
+
 ## [2.0.1]
 
 ### Fixed

package/README.md

@@ -1,12 +1,21 @@
 # fad-checker
 
+[![npm version](https://img.shields.io/npm/v/fad-checker.svg)](https://www.npmjs.com/package/fad-checker)
+[![npm downloads](https://img.shields.io/npm/dm/fad-checker.svg)](https://www.npmjs.com/package/fad-checker)
+[![license](https://img.shields.io/npm/l/fad-checker.svg)](https://github.com/n8tz/fad-checker/blob/main/package.json)
+[![node](https://img.shields.io/node/v/fad-checker.svg)](https://nodejs.org)
+
 > **F**ucking **A**utonomous **D**ependency **C**hecker
 
-`fad-checker` scans **Maven**, **npm**, **Yarn**, **Composer (PHP)**, **PyPI (Python)**, **NuGet (C#/.NET)** and **vendored JavaScript** in any source tree — multi-module, monorepo, polyglot, whatever you've got — and produces a single self-contained HTML report with CVE, EOL, obsolete and outdated findings, plus per-ecosystem fix recipes.
+`fad-checker` scans **Maven**, **npm**, **Yarn**, **Composer (PHP)**, **PyPI (Python)**, **NuGet (C#/.NET)**, **Go**, **Ruby** and **vendored JavaScript** in any source tree — multi-module, monorepo, polyglot, whatever you've got — and produces a single self-contained HTML report with CVE (prioritised by **EPSS + CISA KEV**), EOL, obsolete, outdated and **license** findings, plus per-ecosystem fix recipes. It also exports a **CycloneDX 1.6 SBOM** and a **CSAF 2.0 VEX**.
+
+🌐 **[Project site & docs →](https://n8tz.github.io/fad-checker/)**
+
+<p align="center"><img src="docs/assets/cli.png" alt="fad-checker terminal output — a [n/N] checklist warming each vulnerability database, then CVE findings coloured by severity" width="760"></p>
 
 It runs against the source files alone. **No `mvn`, no `npm install`, no `composer install`, no `pip`, no `dotnet restore`, no Docker.** It reads `pom.xml`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `composer.lock`, `poetry.lock`/`Pipfile.lock`/`uv.lock`/`pdm.lock`/`pyproject.toml`/`requirements.txt`, and `packages.lock.json`/`*.csproj`/`*.fsproj`/`*.vbproj`/`packages.config` directly.
 
-> **Supported ecosystems: Maven, npm, Yarn (v1 + Berry/v2+), pnpm, Composer, PyPI, NuGet.** Each is a self-contained **codec** (`lib/codecs/`) — adding another is adding a codec, no orchestrator surgery. Vendored JS (jQuery, Bootstrap, PDF.js, etc.) is also scanned via retire.js.
+> **Supported ecosystems: Maven, npm, Yarn (v1 + Berry/v2+), pnpm, Composer, PyPI, NuGet, Go, Ruby.** Each is a self-contained **codec** (`lib/codecs/`) — adding another is adding a codec, no orchestrator surgery. Vendored JS (jQuery, Bootstrap, PDF.js, etc.) is also scanned via retire.js. **Embedded JARs** committed into the tree — vendored libs, Spring-Boot fat-jars, shaded uber-jars inside `.jar`/`.war`/`.ear` — are unzipped in-memory and their Maven coordinates scanned too (disable with `--no-jars`).
 
 ---
 
@@ -23,10 +32,12 @@ Because it doesn't need anything you don't already have on disk:
 | `composer install` | `composer.lock` is parsed directly (concrete versions + transitive). `composer.json` alone → best-effort on pinned versions + warning. |
 | `pip` / `poetry` / a venv | `poetry.lock`, `Pipfile.lock`, `uv.lock`, `pdm.lock` are parsed for concrete versions; `pyproject.toml` (PEP 621 + poetry) and `requirements.txt` (following `-r`/`-c` includes) are best-effort on exact pins. Names normalised per PEP 503. |
 | `dotnet restore` | `packages.lock.json` is parsed; otherwise `*.csproj`/`*.fsproj`/`*.vbproj` (+ `Directory.Packages.props` Central Package Management) and legacy `packages.config`, best-effort on pinned versions. |
-| `snyk` binary | Built-in CVE matching via 4 independent sources (see below). Snyk is *optional* (`--snyk`). |
+| `go build` / a Go toolchain | `go.mod` is parsed (the full pruned graph on Go ≥1.17, `// indirect` → transitive); `go.sum` is the fallback. No module download. |
+| `bundle install` | `Gemfile.lock` is parsed for the resolved gem set. No Ruby, no bundler. |
+| `snyk` binary | Built-in CVE matching via CVEProject + OSV + NVD (merged), prioritised with EPSS + CISA KEV (see below). Snyk is *optional* (`--snyk`). |
 | A network connection | First run downloads CVE / OSV / EOL data; subsequent runs use cached copies (`--offline` to force). |
 
-Exactly **two** runtime dependencies must be on PATH (or installed automatically through npm): Node ≥ 20 and `retire` (the npm package, installed by `npm install`). Everything else is bundled or fetched lazily.
+Exactly **one** runtime dependencies must be on PATH (or installed automatically through npm): Node ≥ 20. Everything else is bundled or fetched lazily.
 
 ---
 
@@ -35,15 +46,17 @@ Exactly **two** runtime dependencies must be on PATH (or installed automatically
 | Chapter | Source | What it catches |
 | --- | --- | --- |
 | **0. Warnings** | local heuristics | Missing lockfiles, unresolved Maven versions (BOM-managed), private libs not on Maven Central |
-| **1. CVE (production)** | CVEProject + OSV.dev + NVD + CPE | Public CVE / GHSA in production deps, per ecosystem, per manifest file |
+| **1. CVE (production)** | CVEProject + OSV.dev + NVD + CPE | Public CVE / GHSA in production deps, per ecosystem, per manifest file — each row **prioritised** by CISA KEV + EPSS + CVSS |
+| **1B. Embedded binaries** | same, on coords read from archives | CVEs in libraries **shipped inside committed `.jar`/`.war`/`.ear`** (vendored libs, Spring-Boot fat-jars, shaded uber-jars) — not declared in any `pom.xml`. Grouped by containing archive |
 | **2. CVE in dev deps** | same | Same, but for `test`/`provided` (Maven) and `dev`/`optional`/`peer` (npm) |
 | **3. Vendored JS** | [retire.js](https://retirejs.github.io/) | Old jQuery/Bootstrap/Angular/PDF.js copies sitting in `static/` or `webapp/` with no lockfile |
 | **4. EOL frameworks** | endoflife.date | Spring Boot 2.5, Hibernate 4.x, EOL JDKs, AngularJS, Laravel/Symfony, Django, .NET, etc. |
 | **5. Obsolete libraries** | curated list (Maven) + registry maintainer flags | log4j 1.x, jackson-mapper-asl, joda-time, …; npm `deprecated`, Composer `abandoned`, PyPI `yanked`/inactive, NuGet `deprecation` |
 | **6. Outdated libraries** | Maven Central + npm / Packagist / PyPI / NuGet registries | Available newer versions, with release dates |
-| **7. Fix Recommendations** | computed | Per-ecosystem pin recipes: Maven `<dependencyManagement>`, npm `overrides`, yarn `resolutions`, `composer require`, `pip install`, `dotnet add package` |
+| **7. Licenses** | registry metadata + Maven POMs → SPDX policy | Each dep's license normalised to SPDX and classified; copyleft (GPL/AGPL/LGPL/MPL), proprietary and unknown flagged for review |
+| **8. Fix Recommendations** | computed | Per-ecosystem pin recipes: Maven `<dependencyManagement>`, npm `overrides`, yarn `resolutions`, `composer require`, `pip install`, `dotnet add package` |
 
-The HTML report opens in any browser, contains every detail (CVSS vectors, references, full descriptions, CPE configurations, via-paths for transitives) and ships a Word-compatible `.doc` twin.
+The HTML report opens in any browser, contains every detail (CVSS vectors, references, full descriptions, CPE configurations, via-paths for transitives) and ships a Word-compatible `.doc` twin. Every match carries a **composite priority** (KEV-exploited > EPSS likelihood > CVSS severity), and the run can additionally emit a **CycloneDX 1.6 SBOM** (`--report-sbom`, vulnerabilities inline) and a **CSAF 2.0 VEX** (`--report-csaf`) for downstream tooling.
 
 ---
 
@@ -97,6 +110,10 @@ Run `fad-checker --help` for the full flag list.
 
 ## What a report looks like
 
+<p align="center"><img src="docs/assets/report.png" alt="fad-checker HTML report — executive summary with severity tiles and a detailed CVE table with CWE, descriptions and fix versions" width="900"></p>
+
+The console prints a summary; the full detail lives in the self-contained HTML/`.doc`:
+
 ```
 Executive Summary [CRITICAL] — 1708 dependencies scanned
   • 81 CVE in production deps (critical=5, high=53, medium=12, low=11)
@@ -174,13 +191,20 @@ This is the surprising bit. The whole point is that you can run `fad-checker` ag
 - **Composer (PHP)** — `composer.lock` (`packages` + `packages-dev`) gives concrete + transitive versions; `composer.json` alone is best-effort.
 - **PyPI (Python)** — `poetry.lock` / `Pipfile.lock` / `uv.lock` / `pdm.lock` are parsed (TOML via `smol-toml`, or JSON); `pyproject.toml` (PEP 621 `[project]` + `[tool.poetry]`) and `requirements.txt` (following `-r`/`-c` includes recursively, with `-c` constraint pins applied to ranges) are best-effort on exact pins. Package names are PEP 503-normalised (`Flask-SQLAlchemy` → `flask-sqlalchemy`).
 - **NuGet (C#/.NET)** — `packages.lock.json` is authoritative; otherwise `*.csproj` / `*.fsproj` / `*.vbproj` `<PackageReference>` (resolving Central Package Management against `Directory.Packages.props`) and legacy `packages.config`. Ids are case-insensitive.
+- **Go** — `go.mod` `require` entries are the selected versions (full pruned graph on Go ≥1.17; `// indirect` → transitive), `go.sum` as fallback. OSV "Go" ecosystem for recall, the Go module proxy for outdated.
+- **Ruby** — `Gemfile.lock` `specs:` give the resolved gem set. OSV "RubyGems" for recall, the RubyGems API for outdated + licenses.
 - **Lockfile-first, best-effort fallback** — when a lockfile is present it wins. When it's absent, the loose manifest (`package.json` / `composer.json` / `pyproject.toml` / `requirements.txt` / `*.csproj`) is still parsed for its **pinned exact versions**, with ranges skipped and a `no-lockfile` warning in chapter 0 flagging the partial coverage.
 - **Vendored JavaScript** — `retire.js` shells out and scans `.js` / `.min.js` files by signature, catching old jQuery / Bootstrap / Angular / PDF.js copies that no lockfile knows about.
+- **Embedded JARs** — committed `.jar` / `.war` / `.ear` archives are unzipped **in memory** (via `fflate` — nested fat-jar libs are recursed without ever touching disk, so there's no zip-slip risk) and each artifact's Maven coordinate is read from `META-INF/maven/.../pom.properties` (authoritative), then `MANIFEST.MF`, then the file name. Those coordinates run through the same CVE/OSV/NVD matching as declared deps but report in their own **Embedded binaries** chapter, grouped by containing archive. An archive whose coordinate can't be resolved is flagged in chapter 0 rather than scanned blindly. Auto when archives are present; disable with `--no-jars`. (Embedded coords don't trigger Maven Central transitive resolution — a fat-jar already ships its dependencies, which the recursion finds directly.)
 - **CVE data** — three independent sources merged:
   - **CVEProject** (the canonical `cvelistV5` bundle, filtered to Maven-relevant entries)
   - **OSV.dev** (Google + GitHub Security Lab, multi-ecosystem)
   - **NVD** (official NIST records, used for enrichment: full CVSS, references, CPE configurations)
 - **CPE refinement** — once a CVE is matched, its NVD CPE configurations are checked against the dep version range. A match outside the vulnerable range is flagged `cpeFiltered: true` (likely false positive). A curated `data/cpe-coord-map.json` maps CPE `vendor:product` to Maven `g:a` (60+ entries seeded: log4j, jackson, spring, tomcat, jetty, netty, …).
+- **Prioritization** — each matched CVE is enriched with **EPSS** (FIRST.org exploit-prediction percentile) and **CISA KEV** (known-exploited catalogue), then scored: KEV (exploited in the wild) outranks EPSS-weighted CVSS. The report sorts by this composite priority and badges KEV/EPSS.
+- **Licenses** — each dependency's license is resolved (registry metadata, no extra request; Maven from cached POMs), normalised to SPDX and classified against a copyleft policy (`data/license-policy.json`) — permissive / weak / strong / network copyleft / proprietary / unknown.
+- **Unified outputs** — one `--report-<type>` flag per output, each with an OPTIONAL path (omit it → a default name under `--report-output`): `--report-html`, `--report-doc`, plus the machine-readable `--report-sbom` (**CycloneDX 1.6**, vulnerabilities inline / VDR), `--report-csaf` (**CSAF 2.0 VEX**), `--report-json` (flat findings, diff-friendly) and `--report-sarif` (**SARIF 2.1.0** for GitHub/GitLab code scanning). With no `--report-*` flag, HTML + `.doc` are written by default; `--no-report` writes nothing (gate-only). purls per ecosystem.
+- **CI gating & triage** — `--fail-on <low|medium|high|critical|kev>` sets a non-zero exit code (`kev` = fail only on a CISA-known-exploited finding). `--ignore <file>` (CVE/coord/glob rules) and `--vex <file>` (ingest a CSAF VEX) suppress accepted-risk / false-positive findings from the report and the gate, while keeping them flagged in the exports — so re-audits stay signal-rich.
 
 ---
 
@@ -194,6 +218,10 @@ All cached data lives in `~/.fad-checker/`:
 | OSV per-dep lookups | `osv-cache/<ecosystem>__<g>__<a>__<v>.json` | 12 h |
 | OSV vuln details | `osv-cache/vuln_<id>.json` | 12 h |
 | NVD CVE records | `nvd-cache/<cveId>.json` | 7 d |
+| EPSS scores (FIRST.org) | `epss-cache.json` | 24 h |
+| CISA KEV catalogue | `kev-cache.json` | 24 h |
+| Go module proxy (latest) | `go-proxy-cache.json` | 24 h |
+| RubyGems (latest + licenses) | `rubygems-cache.json` | 24 h |
 | endoflife.date cycles | `eol-cache.json` | 7 d |
 | Maven Central latest versions | `version-cache.json` | 24 h |
 | Transitive POMs from Maven Central | `poms-cache/<g>__<a>__<v>.pom` | ∞ (immutable) |
@@ -290,12 +318,16 @@ Repos are tried **in declared order, Maven Central last**. Auth is sent as a `Ba
 | [CVEProject `cvelistV5`](https://github.com/CVEProject/cvelistV5) | Daily bulk CVE bundle, filtered to Maven-relevant entries | CC0-1.0 | GitHub release asset (zip) |
 | [OSV.dev](https://osv.dev/) (Google + GitHub Security Lab) | Per-dep vulnerability lookup (Maven, npm, Packagist, PyPI, NuGet, …) | CC-BY 4.0 | `POST api.osv.dev/v1/querybatch`, `GET api.osv.dev/v1/vulns/{id}` |
 | [NIST NVD](https://nvd.nist.gov/) | Canonical CVE description + CVSS vectors + CPE configurations + CWE | US-gov public domain | `GET services.nvd.nist.gov/rest/json/cves/2.0?cveId=…` — free [API key](https://nvd.nist.gov/developers/request-an-api-key) bumps the rate limit 10× |
+| [FIRST.org EPSS](https://www.first.org/epss/) | Exploit-prediction score + percentile per CVE | CC-BY 4.0 | `GET api.first.org/data/v1/epss?cve=…` (batched) |
+| [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) | Known-exploited-vulnerability catalogue membership | US-gov public domain | `GET cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json` |
 | [endoflife.date](https://endoflife.date/) | Framework / runtime EOL cycle data | MIT | `GET endoflife.date/api/{product}.json` |
 | [Maven Central](https://search.maven.org/) | Latest-version lookups + transitive POM fetches | Free public service | Solr `search.maven.org/solrsearch/select?q=…` + `repo1.maven.org/maven2/<coord>` |
 | [npm registry](https://registry.npmjs.org/) | Per-version `deprecated` + `dist-tags.latest` | Free public service | `GET registry.npmjs.org/<pkg>` |
 | [Packagist](https://packagist.org/) | Latest stable + `abandoned` flag | Free public service | `GET packagist.org/packages/<vendor>/<pkg>.json` |
 | [PyPI](https://pypi.org/) | Latest + `yanked` + "Inactive" classifier | Free public service | `GET pypi.org/pypi/<pkg>/json` |
 | [NuGet](https://www.nuget.org/) | Latest stable + per-version `deprecation` | Free public service | `GET api.nuget.org/v3/registration5-gz-semver2/<id>/index.json` |
+| [Go module proxy](https://proxy.golang.org/) | Latest module version (outdated) | Free public service | `GET proxy.golang.org/<module>/@latest` |
+| [RubyGems](https://rubygems.org/) | Latest stable + licenses | Free public service | `GET rubygems.org/api/v1/gems/<gem>.json` |
 | [retire.js](https://retirejs.github.io/retire.js/) | Vendored-JS signature DB + scanner | Apache-2.0 | npm package `retire`, executed locally |
 | [Snyk](https://snyk.io/) (optional) | Additional CVE source via `snyk test --all-projects --json` | Per Snyk EULA; needs a Snyk account | Local CLI `snyk` |
 | [MITRE CWE](https://cwe.mitre.org/) | Weakness category links in the report | Free public reference | Linked by URL only, no API call |
@@ -314,16 +346,58 @@ Built-in guardrails that fire **before** any disk write:
 
 ---
 
-## Compared to…
-
-| Tool | What `fad-checker` adds |
-| --- | --- |
-| `mvn dependency:tree` | No Maven needed; multi-source CVE scan; HTML report |
-| `npm audit` | Polyglot (Maven + npm + Composer + PyPI + NuGet + vendored JS in one report); EOL & obsolete checks; works without installing anything |
-| Snyk CLI | Free; offline-capable; integrates Snyk's results if you have it |
-| OWASP DC | Faster (cached); cleaner UI; multi-source dedup |
-
-You don't have to choose — `fad-checker` will use any of them as input (`--snyk`) and merge results.
+## Comparison
+
+`fad-checker` is **not** a Trivy/Grype competitor — those are container-and-SBOM supply-chain
+scanners. It targets a narrower job: a **zero-setup, multi-ecosystem audit of a source
+checkout, with an audit-ready report and a confidential / air-gapped workflow** — the kind
+of thing a security consultant or an ANSSI-PASSI engagement needs.
+
+| | **fad-checker** | OSV-Scanner | Trivy | Grype + Syft | OWASP DC | Snyk OSS |
+| --- | --- | --- | --- | --- | --- | --- |
+| Ecosystems it targets¹ | Maven, npm, Yarn, **pnpm**, Composer, PyPI, NuGet, Go, Ruby + vendored JS | 11+ langs / 19+ lockfiles | 20+ | 20+ | Java/.NET (others exp.) | many |
+| Reads lockfiles without `install`/build² | ✅ | ✅ | ✅ | ✅ | ⚠️ Java needs Maven Central/build | ❌ build required |
+| Best-effort when **no lockfile** (pinned versions) | ✅ | ❌ | ❌ | ❌ | ⚠️ | ⚠️ |
+| Vulnerability sources | CVEProject + OSV + NVD + EPSS + KEV + retire.js (+ Snyk), merged | OSV.dev | Aqua DB | Anchore DB | NVD / CPE | Snyk DB |
+| False-positive control | CPE/version cross-check | ecosystem-aware | ecosystem-aware | ecosystem-aware | ⚠️ CPE → noisy | ecosystem-aware |
+| **EOL** (end-of-life) detection | ✅ endoflife.date | ❌ | ❌ | ❌ | ❌ | ~ |
+| **Outdated / deprecated** | ✅ registries + curated | ❌ | ❌ | ❌ | ❌ | ~ |
+| Containers / OS packages | ❌ | ✅ | ✅ | ✅ | ❌ | ✅ |
+| SBOM (CycloneDX/SPDX) | ✅ CycloneDX 1.6 (+ CSAF 2.0 VEX) | ✅ | ✅ | ✅ (Syft) | ~ | ✅ |
+| License compliance | ✅ SPDX + copyleft policy | ~ | ✅ | ~ | ❌ | ✅ |
+| EPSS / KEV prioritization | ✅ FIRST.org EPSS + CISA KEV | ~ | ✅ | ✅ | ❌ | ✅ |
+| CI gating (`--fail-on`) + triage | ✅ severity/KEV + ignore/VEX | ✅ | ✅ | ✅ | ⚠️ | ✅ |
+| Auto-remediation / PRs | ❌ (fix recipes only) | ✅ `fix` | ❌ | ❌ | ❌ | ✅ |
+| Offline | ✅ cache | ✅ local DB | ✅ | ✅ | ✅ feed | ❌ mostly online |
+| **Scan without exposing the codebase**³ | ✅ anonymized descriptor | ❌ | ❌ | ❌ | ❌ | ❌ |
+| **Maven private-dep cleanup** (→ Snyk) | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ |
+| Output | **HTML + Word `.doc`** + JSON / SARIF / CycloneDX / CSAF | table/JSON/SARIF | table/JSON/SARIF | table/JSON/SARIF | HTML/XML/JSON | JSON / cloud UI |
+
+¹ Narrower language coverage — no Rust/Dart/Swift (Go and Ruby are now covered).
+² Reading **lockfiles** without a build is the norm today: OSV-Scanner, Trivy and Grype/Syft
+do it too. For **Maven `pom.xml`** specifically, *every* tool — `fad-checker` included — must
+reach Maven Central (or rely on a real build / CycloneDX SBOM) to resolve transitive versions;
+Trivy can resolve wrong transitive versions in that mode, while `fad-checker` flags what it
+can't resolve in chapter 0. The genuine "no build" win is **vs Snyk** (requires building the
+project) and **OWASP DC** (needs Maven Central access for Java accuracy).
+³ Phase 1 exports only public coordinates; the online scan never sees your source tree —
+see [Air-gapped / PASSI](#air-gapped--passi-audits-anonymized-dependency-descriptor). OSV-Scanner
+has an offline mode, but it still needs the **source on the scanning machine**.
+
+**Where it fits:** a one-shot audit of a polyglot checkout you may not be able to build, a
+presentable HTML/Word deliverable, and confidential / air-gapped engagements.
+**Where it doesn't:** continuous CI supply-chain security, container/OS scanning,
+reachability analysis, auto-fix PRs — reach for **Trivy** or **Grype + Syft**. (It now
+*does* emit CycloneDX/CSAF and flag licenses + EPSS/KEV, but it isn't a gating CI daemon.)
+
+You don't have to choose — `fad-checker` takes Snyk's results as input (`--snyk`) and merges them.
+
+> Sources: [OSV-Scanner lockfiles](https://google.github.io/osv-scanner/supported-languages-and-lockfiles/) ·
+> [Trivy Java/`pom.xml` (Maven Central, `--offline-scan`)](https://trivy.dev/docs/latest/coverage/language/java/) ·
+> [Syft `java-pom-cataloger` (source dirs)](https://github.com/anchore/syft/issues/676) ·
+> [OWASP DC needs internet/build for Java](https://jeremylong.github.io/DependencyCheck/data/index.html) ·
+> [Snyk requires building the project](https://docs.snyk.io/supported-languages/technical-specifications-and-guidance) ·
+> [EOL/outdated "most tools skip" (Aikido)](https://www.aikido.dev/code/outdated-eol-software)
 
 ---
 

package/completions/fad-checker.bash

@@ -6,7 +6,7 @@ _fad_check_complete() {
 	COMPREPLY=()
 	cur="${COMP_WORDS[COMP_CWORD]}"
 	prev="${COMP_WORDS[COMP_CWORD-1]}"
-	opts="--src --target --exclude --verbose --no-report --no-transitive --no-all-libs --no-osv --no-nvd --no-retire --retire-refresh --report-output --ignore-test --cve-refresh --cve-offline --snyk --transitive-depth --offline --ecosystem --no-maven --no-npm --no-yarn --no-nuget --no-composer --no-pypi --no-js --set-nvd-key --show-config --completion --help --version -s -t -e -v"
+	opts="--src --target --exclude --verbose --no-report --no-transitive --no-all-libs --no-osv --no-nvd --no-epss --no-kev --no-licenses --no-retire --retire-refresh --report-output --report-html --report-doc --report-sbom --report-csaf --report-json --report-sarif --fail-on --ignore --vex --ignore-test --cve-refresh --cve-offline --snyk --transitive-depth --offline --ecosystem --no-maven --no-npm --no-yarn --no-nuget --no-composer --no-pypi --no-go --no-ruby --no-jars --no-js --set-nvd-key --show-config --completion --help --version -s -t -e -v"
 	case "$prev" in
 		--src|-s|--target|-t|--report-output)
 			COMPREPLY=( $(compgen -d -- "$cur") )

package/completions/fad-checker.zsh

@@ -15,7 +15,20 @@ _fad_check() {
 		'--verbose[verbose]'
 		'--test[read-only]'
 		'--report[generate CVE/EOL/obsolete report]'
-		'--report-output[report output dir]:directory:_directories'
+		'--report-output[base dir for default-named outputs]:directory:_directories'
+		'--report-html[write HTML report]::file:_files'
+		'--report-doc[write Word .doc report]::file:_files'
+		'--report-sbom[write CycloneDX 1.6 SBOM]::file:_files'
+		'--report-csaf[write CSAF 2.0 VEX]::file:_files'
+		'--report-json[write flat findings JSON]::file:_files'
+		'--report-sarif[write SARIF 2.1.0 log]::file:_files'
+		'--no-report[write no output files (gate-only)]'
+		'--no-jars[skip embedded .jar/.war/.ear scanning]'
+		'--no-go[skip the Go codec]'
+		'--no-ruby[skip the Ruby codec]'
+		'--fail-on[CI gate level]:level:(none low medium high critical kev)'
+		'--ignore[suppress findings file]:file:_files'
+		'--vex[ingest CSAF VEX]:file:_files'
 		'--ignore-test[skip test-scoped deps]'
 		'--cve-refresh[force CVE re-download]'
 		'--cve-offline[use cached CVE only]'

package/data/license-policy.json

@@ -0,0 +1,97 @@
+{
+  "_comment": "SPDX license id → policy category, plus a free-form alias map used to normalize registry/POM license strings. Categories: permissive | weak-copyleft | strong-copyleft | network-copyleft | proprietary | unknown. Edit to tune the policy.",
+  "categories": {
+    "MIT": "permissive",
+    "MIT-0": "permissive",
+    "Apache-2.0": "permissive",
+    "Apache-1.1": "permissive",
+    "BSD-2-Clause": "permissive",
+    "BSD-3-Clause": "permissive",
+    "0BSD": "permissive",
+    "ISC": "permissive",
+    "Zlib": "permissive",
+    "Unlicense": "permissive",
+    "WTFPL": "permissive",
+    "CC0-1.0": "permissive",
+    "PSF-2.0": "permissive",
+    "Python-2.0": "permissive",
+    "BSL-1.0": "permissive",
+    "Artistic-2.0": "permissive",
+    "LGPL-2.1": "weak-copyleft",
+    "LGPL-2.1-only": "weak-copyleft",
+    "LGPL-2.1-or-later": "weak-copyleft",
+    "LGPL-3.0": "weak-copyleft",
+    "LGPL-3.0-only": "weak-copyleft",
+    "LGPL-3.0-or-later": "weak-copyleft",
+    "MPL-1.1": "weak-copyleft",
+    "MPL-2.0": "weak-copyleft",
+    "EPL-1.0": "weak-copyleft",
+    "EPL-2.0": "weak-copyleft",
+    "CDDL-1.0": "weak-copyleft",
+    "CDDL-1.1": "weak-copyleft",
+    "GPL-2.0": "strong-copyleft",
+    "GPL-2.0-only": "strong-copyleft",
+    "GPL-2.0-or-later": "strong-copyleft",
+    "GPL-3.0": "strong-copyleft",
+    "GPL-3.0-only": "strong-copyleft",
+    "GPL-3.0-or-later": "strong-copyleft",
+    "AGPL-3.0": "network-copyleft",
+    "AGPL-3.0-only": "network-copyleft",
+    "AGPL-3.0-or-later": "network-copyleft",
+    "SSPL-1.0": "network-copyleft",
+    "proprietary": "proprietary",
+    "UNLICENSED": "proprietary",
+    "commercial": "proprietary"
+  },
+  "aliases": {
+    "the mit license": "MIT",
+    "mit license": "MIT",
+    "apache 2": "Apache-2.0",
+    "apache 2.0": "Apache-2.0",
+    "apache-2": "Apache-2.0",
+    "apache license 2.0": "Apache-2.0",
+    "apache license, version 2.0": "Apache-2.0",
+    "the apache software license, version 2.0": "Apache-2.0",
+    "asl 2.0": "Apache-2.0",
+    "apache software license": "Apache-2.0",
+    "bsd": "BSD-3-Clause",
+    "bsd license": "BSD-3-Clause",
+    "new bsd license": "BSD-3-Clause",
+    "bsd 3-clause": "BSD-3-Clause",
+    "bsd-3": "BSD-3-Clause",
+    "the 3-clause bsd license": "BSD-3-Clause",
+    "bsd 2-clause": "BSD-2-Clause",
+    "bsd-2": "BSD-2-Clause",
+    "simplified bsd license": "BSD-2-Clause",
+    "gnu gpl v2": "GPL-2.0",
+    "gplv2": "GPL-2.0",
+    "gpl-2": "GPL-2.0",
+    "gpl 2.0": "GPL-2.0",
+    "gnu gpl v3": "GPL-3.0",
+    "gplv3": "GPL-3.0",
+    "gpl-3": "GPL-3.0",
+    "gpl 3.0": "GPL-3.0",
+    "gnu general public license v3.0": "GPL-3.0",
+    "gnu lgpl v3": "LGPL-3.0",
+    "lgplv3": "LGPL-3.0",
+    "lgpl-3": "LGPL-3.0",
+    "gnu lgpl v2.1": "LGPL-2.1",
+    "lgplv2.1": "LGPL-2.1",
+    "lgpl-2.1": "LGPL-2.1",
+    "gnu agpl v3": "AGPL-3.0",
+    "agplv3": "AGPL-3.0",
+    "agpl-3": "AGPL-3.0",
+    "mozilla public license 2.0": "MPL-2.0",
+    "mpl 2.0": "MPL-2.0",
+    "mpl-2": "MPL-2.0",
+    "eclipse public license 2.0": "EPL-2.0",
+    "eclipse public license - v 2.0": "EPL-2.0",
+    "eclipse public license 1.0": "EPL-1.0",
+    "eclipse public license - v 1.0": "EPL-1.0",
+    "isc license": "ISC",
+    "python software foundation license": "PSF-2.0",
+    "psf": "PSF-2.0",
+    "the unlicense": "Unlicense",
+    "public domain": "CC0-1.0"
+  }
+}