fad-checker 2.4.1 → 2.4.2

package/lib/sarif-export.js

@@ -42,12 +42,25 @@ function depCoord(dep) {
 	return name;
 }
 
+// Certificate / key-material finding-type metadata → SARIF rule + level. Keyed by
+// the analyze.js issue `type`. security-severity is a CVSS-like number for GitHub.
+const CERT_RULES = {
+	"private-key-committed": { level: "error", score: "9.8", desc: "Committed private key" },
+	"keystore-committed": { level: "warning", score: "5.0", desc: "Committed keystore" },
+	"public-key-committed": { level: "note", score: "2.0", desc: "Committed public key" },
+	"cert-expired": { level: "error", score: "7.5", desc: "Expired certificate" },
+	"cert-expiring": { level: "warning", score: "4.0", desc: "Certificate expiring soon" },
+	"cert-weak-key": { level: "error", score: "7.5", desc: "Weak certificate key" },
+	"cert-weak-signature": { level: "error", score: "7.5", desc: "Weak certificate signature algorithm" },
+	"cert-self-signed": { level: "note", score: "2.0", desc: "Self-signed certificate" },
+};
+
 /**
  * Build a SARIF 2.1.0 object from matches.
- * opts: { projectInfo, toolVersion }
+ * opts: { projectInfo, toolVersion, certFindings }
  */
 function buildSarif(matches, opts = {}) {
-	const { projectInfo = {}, toolVersion = "0" } = opts;
+	const { projectInfo = {}, toolVersion = "0", certFindings = [] } = opts;
 	const srcRoot = projectInfo.src && projectInfo.src.startsWith("(") ? null : projectInfo.src;
 
 	const rulesById = new Map();
@@ -108,6 +121,39 @@ function buildSarif(matches, opts = {}) {
 		});
 	}
 
+	// Certificate / key-material findings: one rule per finding-type, one result per
+	// (file, issue). Located at the file itself (not a manifest).
+	for (const c of certFindings || []) {
+		for (const issue of c.issues || []) {
+			const meta = CERT_RULES[issue.type];
+			if (!meta) continue;
+			const ruleId = `FAD-${issue.type.toUpperCase()}`;
+			if (!rulesById.has(ruleId)) {
+				rulesById.set(ruleId, {
+					id: ruleId, name: ruleId,
+					shortDescription: { text: meta.desc },
+					properties: { "security-severity": meta.score, tags: ["security", "cryptography", "key-material"] },
+				});
+			}
+			const uri = relUri(c.path, srcRoot);
+			const vis = c.keyVisibility ? ` [${c.keyVisibility} key]` : "";
+			results.push({
+				ruleId,
+				level: meta.level,
+				message: { text: `${meta.desc}${vis}: ${issue.message} — ${uri || c.path}` },
+				...(uri ? { locations: [{ physicalLocation: { artifactLocation: { uri } } }] } : {}),
+				partialFingerprints: { fadKey: `${c.sha256 || c.path}|${issue.type}` },
+				properties: {
+					kind: c.kind,
+					...(c.keyVisibility ? { keyVisibility: c.keyVisibility } : {}),
+					...(c.algorithm ? { algorithm: c.algorithm } : {}),
+					...(c.format ? { format: c.format } : {}),
+					...(c.sha256 ? { sha256: c.sha256 } : {}),
+				},
+			});
+		}
+	}
+
 	return {
 		$schema: "https://json.schemastore.org/sarif-2.1.0.json",
 		version: "2.1.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fad-checker",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "description": "Scan ALL Maven, Gradle, npm, Yarn, Composer, Python, C#/.NET, Go & Ruby dependencies — plus embedded JARs (fat-jars/war/ear) — in a source tree ONE SHOT without mvn/python/etc — CVE (EPSS/KEV-prioritised), EOL, obsolete, outdated & licenses, with SBOM/CSAF/SARIF/JSON exports, CI gating and fix recos",
   "keywords": [
     "sca",