fad-checker 2.4.1 → 2.4.3

package/CHANGELOG.md

@@ -5,6 +5,69 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+### Fixed
+- **External `<parent>` POMs (spring-boot-starter-parent) now backfill their managed
+  versions.** A versionless dep whose version is inherited from an external `<parent>`
+  (e.g. `spring-boot-starter-actuator` under `spring-boot-starter-parent`, whose own
+  parent `spring-boot-dependencies` holds the version table) was left unresolved and
+  **dropped from the CVE/OSV/EOL/outdated scans** — the mainline backfill (`lib/maven-bom.js`)
+  only handled `<scope>import</scope>` BOMs, never the `<parent>` case, so this failed
+  even online (the `--transitive` overlay resolved the parent but couldn't backfill the
+  primary version). `collectExternalParents()` now feeds external parents through the same
+  `effectivePom` → `backfillVersions` path as import BOMs (import BOMs win on precedence),
+  stamped `versionSource={via:"parent",…}` → report "version managed by … (parent POM)".
+  It runs in the **mainline** flow (not just `--transitive`), so the warmed cache always
+  captures the parent POMs for **offline/air-gapped** reuse. **Child property overrides are
+  honored** (Maven semantics): a project that redefines `<log4j2.version>2.17.1</log4j2.version>`
+  to patch a CVE resolves the managed coord to `2.17.1`, not the framework default
+  (`collectPropertyOverrides()` → `effectivePom`'s new `propertyOverrides`; import-BOM-managed
+  coords are correctly left un-overridden). The "missing parent POM — potentially private"
+  warning now **partitions** parents fad resolves from Maven Central/cache (public) from the
+  truly-unresolvable ones (private), instead of flagging every external parent as suspect.
+- **Anonymized descriptor closes the versionless-Spring-Boot round-trip in one exchange.**
+  The `fad-deps/1` descriptor now carries a `maven` hints block (`externalParents[]` +
+  `importBoms[]` coords + version `propertyOverrides{}`) so a no-source-tree online
+  `--import-anonymized` run can resolve the versionless deps' versions and warm their
+  `coord+version`-keyed CVE caches — previously that needed a second air-gapped exchange.
+  Only public coords + version strings travel (a private parent listed is a harmless online
+  no-op); the source tree never leaves the enclave.
+- **CVE-index recall: real-world pre-2023 records were dropped (incl. Log4Shell).**
+  `isMavenRelevant()` only accepted CVE 5.x records carrying machine-readable Maven
+  metadata (`packageName`/`collectionURL`/`versionType:"maven"`) or an EXACT-match
+  known vendor — but CNAs publish legal-entity vendors ("Apache Software Foundation")
+  and display products ("Apache Log4j2"), so **CVE-2021-44228 was absent from the
+  index** and an offline scan of `log4j-core:2.14.0` reported no Log4Shell. The filter
+  now tokenises vendors, strips leading vendor words from products, and consults the
+  curated `data/cpe-coord-map.json` — which also **backfills `packageName`** on
+  product-only records so they match at tier-1. `versions[].changes[]` timelines
+  (how 44228 encodes its affected windows) are expanded into plain affected windows,
+  placeholder bounds (`lessThan:"log4j-core*"`, `"*"`, `"unspecified"`) no longer
+  poison comparisons (fail-closed preserved), and `fixVersion` picks the **highest**
+  version-like upper bound instead of the first (multi-branch advisories suggested a
+  downgrade). Rebuilt index: **6 589 → 15 236 CVE (+131 %)**. Regression-tested against
+  the real cvelistV5 record (`test/fixtures/cve-samples/cve-2021-44228-real.json`).
+- **OSV offline: warmed cache older than the 12 h TTL was silently discarded.**
+  `--offline` now bypasses the OSV cache TTL (same rule as the NVD cache): on an
+  air-gapped box the warmed cache is the only source, and expiring it reported
+  "0 OSV vulns" for every ecosystem. Online behaviour is unchanged.
+- **Go: `replace` directives are now applied** (module→module replaces rewrite the
+  scanned coordinate — a `replace` downgrade was invisible; directory replaces are
+  dropped with a chapter-0 `local-replace` warning), and **pre-1.17 modules merge the
+  `go.sum` graph** (their `go.mod` lists direct deps only — transitives were skipped).
+- **PyPI: `pip-compile --generate-hashes` output parsed correctly.** The trailing
+  `\` of hash-pinned lines (and inline ` --hash=…` options) made every dep of such a
+  requirements file silently skipped. `uv.lock` no longer inventories the project's
+  own virtual/editable package. Same-name deps pinned to different versions across
+  files now ALL land in `versions[]` (every distinct version scanned, as Maven does).
+- **NuGet: `Directory.Packages.props` is resolved by walking UP the tree** (MSBuild
+  semantics — nearest wins). Before, only the csproj's own directory was searched, so
+  a root-level CPM solution collected **zero** deps. Also: `VersionOverride` support,
+  exact-range pins `[1.2.3]` accepted as concrete, distinct resolved versions across
+  projects/TFMs all scanned, and **paged registration indexes** (Newtonsoft.Json-class
+  packages) have the needed pages fetched instead of returning empty findings.
+- **Registry caches (go/pypi/nuget): offline runs no longer re-stamp cache freshness**
+  (a stale cache would then look fresh to the next online run and skip its refetch).
+
 ### Changed
 - **Report chapters reorganised into a two-level hierarchy.** Related chapters are now
   grouped under six **root chapters**, each whose header carries a breakdown count:
@@ -18,6 +81,20 @@ This project adheres to [Semantic Versioning](https://semver.org/).
   (roots + indented sub-chapters).
 
 ### Added
+- **Certificate & key-material scanner (report chapter 2.4).** A new standalone scanner
+  (`lib/certs/`, on by default, `--no-certs` to disable) walks the source tree for
+  committed cryptographic material and surfaces it in a dedicated report chapter, the
+  JSON export (`certificates` array + `summary.certificates`/`certPrivateKeys`) and SARIF
+  (`FAD-*` rules). It detects **X.509 certificates** (PEM/DER, parsed with Node's built-in
+  `crypto.X509Certificate`) and flags **expired**, **expiring** (within `--cert-expiry-days`,
+  default 90), **weak key** (RSA<2048 / weak EC curve), **weak signature** (MD5/SHA1) and
+  **self-signed**; **private & public keys** — every key explicitly labelled **private**
+  (a committed secret → critical) or **public** (low) — across PEM (PKCS#1/8/SEC1),
+  **OpenSSH of every algorithm** (RSA/DSA/ECDSA/Ed25519 incl. FIDO `-sk`), PuTTY `.ppk`,
+  PGP and one-line SSH (`*.pub`, `authorized_keys`, `known_hosts`); and **keystores**
+  (JKS/JCEKS by magic byte, PKCS#12 by extension). Detection is by extension **and**
+  conventional SSH filename. **100% offline** — no network, no decryption — inventory-only
+  (does not affect the `--fail-on` gate).
 - **Scan-provenance manifest + Methodology chapter (audit reproducibility).** Every
   report now carries a provenance manifest — tool version, run mode (offline/online),
   the findings-affecting configuration, and the **freshness of every data source**

package/README.md

@@ -8,7 +8,7 @@
 > **F**abulous **A**utonomous **D**ependency **C**hecker<br>
 > AKA **F**uckin' **A**utonomous **D**ependency **C**hecker<br>
 
-`fad-checker` audits **Maven · Gradle · npm · Yarn · pnpm · Composer · PyPI · NuGet · Go · Ruby**, vendored JavaScript and committed native binaries in any source tree — multi-module, monorepo, polyglot — and produces a self-contained **HTML + Word report** (CVE prioritised by EPSS + CISA KEV, EOL, obsolete, outdated, licenses) plus **CycloneDX SBOM / CSAF VEX / SARIF / JSON** exports. **No build tools, no Docker, no network needed** — it reads lockfiles and manifests straight off disk.
+`fad-checker` audits **Maven · Gradle · npm · Yarn · pnpm · Composer · PyPI · NuGet · Go · Ruby**, vendored JavaScript, committed native binaries and cryptographic material (certificates & private/public keys) in any source tree — multi-module, monorepo, polyglot — and produces a self-contained **HTML + Word report** (CVE prioritised by EPSS + CISA KEV, EOL, obsolete, outdated, licenses) plus **CycloneDX SBOM / CSAF VEX / SARIF / JSON** exports. **No build tools, no Docker, no network needed** — it reads lockfiles and manifests straight off disk.
 
 🌐 **[Project site & docs →](https://9pings.github.io/fad-checker/)**
 
@@ -20,6 +20,7 @@
 ## Features
 
 - **10 ecosystems in one pass** — Maven, **Gradle**, npm/Yarn/pnpm, Composer (PHP), PyPI, NuGet, Go, Ruby; plus **vendored JS** (retire.js), committed **native binaries** (`.dll`/`.exe`/`.so`/`.dylib`, identified by checksum via deps.dev + CIRCL) and **embedded JARs** (fat-jars/war/ear, unzipped in-memory).
+- **Crypto material** — committed **certificates** (X.509, PEM/DER), **private &amp; public keys** (PEM / OpenSSH every algorithm / PuTTY / PGP / one-line SSH) and **keystores** (JKS/JCEKS/PKCS#12). Each key is labelled **private** (a committed secret → critical) or **public**; certs are checked for **expiry, weak key (RSA<2048), weak signature (MD5/SHA1) and self-signed** — all parsed offline with the built-in X.509 parser, no network. `--no-certs` to disable.
 - **No build tools** — reads `pom.xml`, `build.gradle(.kts)`/`gradle.lockfile`/`libs.versions.toml`, `package-lock`/`yarn.lock`/`pnpm-lock`, `composer.lock`, `poetry`/`Pipfile`/`uv`/`pdm` locks, `packages.lock.json`/`*.csproj`, `go.mod`, `Gemfile.lock` directly. No `mvn`/`gradle`/`npm install`/`pip`/`dotnet restore`/`go build`/`bundle`, no `node_modules/`. → [how it stays build-free](docs/COMPARISON.md#how-its-autonomous-no-build-tools)
 - **CVE, merged & prioritised** — CVEProject + OSV.dev + NVD, CPE/version cross-checked to cut false positives, ranked **CISA KEV → EPSS → CVSS**.
 - **Per-module Maven version mediation** — recovers vulnerable transitive versions that a global `<dependencyManagement>` pin hides in another module (lifted Snyk-corroborated coverage **156 → 181** on a real 25-module reactor, finding CVEs a single Snyk scan missed).
@@ -62,7 +63,7 @@ The report is organised into **root chapters** (each grouping related sub-chapte
 | **0. Warnings** *(top)* | local heuristics | Missing lockfiles, unresolved Maven versions (BOM-managed), private libs not on Maven Central |
 | **Δ. Changes since baseline** *(top, with `--baseline`)* | diff vs prior JSON | New / fixed / unchanged findings per category + the list of **new production CVEs** — for repeat audits and `--fail-on-new` CI gating |
 | **1. CVE** *(X direct, Y indirect, Z dev)* | CVEProject + OSV.dev + NVD + CPE | **1.1 Production** — public CVE / GHSA in prod deps, per ecosystem, per manifest, **prioritised** by CISA KEV + EPSS + CVSS · **1.2 Vendored JS vulns** ([retire.js](https://retirejs.github.io/)) · **1.3 Dev** (`test`/`provided`, `dev`/`optional`/`peer`) · **1.4 Likely false positives** (CPE-filtered) |
-| **2. Unmanaged / unversioned components** | deps.dev + CIRCL (by checksum), retire.js | **2.1 Embedded binaries** — CVEs in libs shipped inside committed `.jar`/`.war`/`.ear` (fat-jars, shaded uber-jars) · **2.2 Native binaries** (`.dll`/`.exe`/`.so`/`.dylib`) identified by hash, flagged should-be-managed / name≠checksum / unknown / malicious · **2.3 Vendored JavaScript** inventory (jQuery, Bootstrap, …) vulnerable *or not* |
+| **2. Unmanaged / unversioned components** | deps.dev + CIRCL (by checksum), retire.js, built-in X.509 | **2.1 Embedded binaries** — CVEs in libs shipped inside committed `.jar`/`.war`/`.ear` (fat-jars, shaded uber-jars) · **2.2 Native binaries** (`.dll`/`.exe`/`.so`/`.dylib`) identified by hash, flagged should-be-managed / name≠checksum / unknown / malicious · **2.3 Vendored JavaScript** inventory (jQuery, Bootstrap, …) vulnerable *or not* · **2.4 Certificates &amp; key material** — committed certs (expiry / weak key / weak signature / self-signed), **private vs public keys** (PEM/OpenSSH/PuTTY/PGP/SSH) and keystores, all parsed offline |
 | **3. Maintenance / lifecycle** *(X EOL, Y obsolete, Z outdated)* | endoflife.date · curated + registry flags · Maven Central / npm / Packagist / PyPI / NuGet | **3.1 End-of-Life** frameworks · **3.2 Obsolete / deprecated / abandoned / yanked** · **3.3 Outdated** (newer version available, with release dates) |
 | **4. Licenses** *(opt-in: `--licenses`)* | registry metadata + Maven POMs → SPDX policy | Each dep's license normalised to SPDX and classified; copyleft (GPL/AGPL/LGPL/MPL), proprietary and unknown flagged for review |
 | **5. Fix Recommendations** | computed | Per-ecosystem pin recipes: Maven `<dependencyManagement>`, Gradle `constraints { }`, npm `overrides`, yarn `resolutions`, `composer require`, `pip install`, `dotnet add package` |

package/completions/fad-checker.bash

@@ -6,7 +6,7 @@ _fad_check_complete() {
 	COMPREPLY=()
 	cur="${COMP_WORDS[COMP_CWORD]}"
 	prev="${COMP_WORDS[COMP_CWORD-1]}"
-	opts="--src --target --exclude --verbose --no-report --no-transitive --no-all-libs --no-osv --no-nvd --no-epss --no-kev --licenses --no-retire --retire-refresh --report-output --report-html --report-doc --report-sbom --report-csaf --report-json --report-sarif --fail-on --fail-on-new --baseline --no-checksums --ignore --vex --ignore-test --cve-refresh --cve-offline --snyk --transitive-depth --offline --ecosystem --no-maven --no-npm --no-yarn --no-nuget --no-composer --no-pypi --no-go --no-ruby --no-jars --no-js --set-nvd-key --show-config --completion --help --version -s -t -e -v"
+	opts="--src --target --exclude --verbose --no-report --no-transitive --no-all-libs --no-osv --no-nvd --no-epss --no-kev --licenses --no-retire --retire-refresh --report-output --report-html --report-doc --report-sbom --report-csaf --report-json --report-sarif --fail-on --fail-on-new --baseline --no-checksums --ignore --vex --ignore-test --cve-refresh --cve-offline --snyk --transitive-depth --offline --ecosystem --no-maven --no-npm --no-yarn --no-nuget --no-composer --no-pypi --no-go --no-ruby --no-jars --no-binaries --no-certs --cert-expiry-days --no-js --set-nvd-key --show-config --completion --help --version -s -t -e -v"
 	case "$prev" in
 		--src|-s|--target|-t|--report-output)
 			COMPREPLY=( $(compgen -d -- "$cur") )

package/completions/fad-checker.zsh

@@ -24,6 +24,9 @@ _fad_check() {
 		'--report-sarif[write SARIF 2.1.0 log]::file:_files'
 		'--no-report[write no output files (gate-only)]'
 		'--no-jars[skip embedded .jar/.war/.ear scanning]'
+		'--no-binaries[skip committed native-binary scanning]'
+		'--no-certs[skip certificate / key-material scanning]'
+		'--cert-expiry-days[warn on certs expiring within N days (default 90)]:days:'
 		'--no-go[skip the Go codec]'
 		'--no-ruby[skip the Ruby codec]'
 		'--fail-on[CI gate level]:level:(none low medium high critical kev)'

package/data/cpe-coord-map.json

@@ -3,6 +3,7 @@
 
 	"byVendorProduct": {
 		"apache:log4j":                   ["log4j:log4j", "org.apache.logging.log4j:log4j-core", "org.apache.logging.log4j:log4j-api"],
+		"apache:log4j2":                  ["org.apache.logging.log4j:log4j-core"],
 		"apache:log4j-core":              ["org.apache.logging.log4j:log4j-core"],
 		"apache:log4j-api":               ["org.apache.logging.log4j:log4j-api"],
 		"apache:struts":                  ["org.apache.struts:struts2-core"],

package/fad-checker.js

@@ -301,6 +301,8 @@ program
 	.option("--no-ruby", "skip the Ruby (Bundler) codec")
 	.option("--no-binaries", "skip scanning committed native binaries (.dll/.exe/.so/.dylib)")
 	.option("--no-jars", "skip scanning embedded .jar/.war/.ear binaries for Maven coordinates")
+	.option("--no-certs", "skip scanning committed certificates, private/public keys (PEM/SSH/PuTTY/PGP) and keystores")
+	.option("--cert-expiry-days <n>", "warn on certificates expiring within N days", "90")
 	.option("--no-js", "alias: skip JS/npm/yarn manifests even if present (Maven-only)")
 	.option("--repo <eco=url...>", "extra registry as <ecosystem>=<url> (e.g. npm=https://npm.acme/) tried before the public one. Repeatable. Supports https://user:pass@host/.")
 	.option("--add-repo <eco>", "persist a registry: --add-repo <ecosystem> <name> <url> [--auth user:pass] [--token TOK]")
@@ -524,11 +526,24 @@ async function timedPhase(label, fn) {
 		let imported;
 		try { imported = deserializeDeps(descriptor); }
 		catch (e) { console.error(chalk.red(`❌  invalid descriptor: ${e.message}`)); process.exit(1); }
-		const { resolved, activeIds, runMaven, runNpm } = imported;
+		const { resolved, activeIds, runMaven, runNpm, externalParents = [], importBoms = [], propertyOverrides = {} } = imported;
 		ui.section("Anonymized descriptor");
 		ui.ok(`imported ${chalk.bold(resolved.size)} dep(s) across ${activeIds.join(", ") || "—"}`);
 		if (options.offline) ui.warn("--offline: caches won't warm; only useful to re-render from an already-warm cache");
 		if (!resolved.size) { ui.warn("descriptor has no dependencies — nothing to scan"); process.exit(0); }
+		// Replay the external-parent / import-BOM backfill from the descriptor's carried hints.
+		// Workflow B has no source tree here, so the mainline store-based backfill can't run —
+		// without this, versionless deps (spring-boot-starter-*) stay unresolved and their CVE
+		// caches never warm, forcing a SECOND air-gapped exchange. Online only (needs the POMs).
+		if (runMaven && !options.offline && (externalParents.length || importBoms.length)) {
+			const { resolveBomManagedVersions, backfillVersions } = require("./lib/maven-bom");
+			const base = { repos: mavenRepos, offline: options.offline, verbose, effCache: new Map() };
+			const mgmt = await resolveBomManagedVersions(importBoms, base);
+			const parentMgmt = await resolveBomManagedVersions(externalParents, { ...base, via: "parent", propertyOverrides });
+			for (const [k, v] of parentMgmt) if (!mgmt.has(k)) mgmt.set(k, v);
+			const filled = backfillVersions(resolved, mgmt);
+			if (filled) ui.ok(`backfilled ${chalk.bold(filled)} version(s) from ${externalParents.length} parent(s) + ${importBoms.length} BOM(s) in the descriptor`);
+		}
 		// Warm retire signatures (online) so --export-cache carries them for offline JS scanning.
 		if (runNpm && !options.offline && options.retire !== false) {
 			const { warmRetireSignatures } = require("./lib/retire");
@@ -623,8 +638,14 @@ async function timedPhase(label, fn) {
 	// --- Anonymized phase 1: export a descriptor and exit (no network, no report) ---
 	if (options.exportAnonymized) {
 		const { serializeDeps } = require("./lib/deps-descriptor");
+		const { collectExternalParents, collectImportBoms, collectPropertyOverrides } = require("./lib/maven-bom");
 		const pkgVersion = require("./package.json").version;
-		const descriptor = serializeDeps(resolved, { generator: `fad-checker ${pkgVersion}` });
+		// Carry the Maven resolution hints so a no-source-tree online warm run (Phase 2) can
+		// resolve the versionless deps' versions and warm their CVE caches in ONE exchange.
+		const externalParents = mavenCtx?.store ? collectExternalParents(mavenCtx.store) : [];
+		const importBoms = mavenCtx?.propsByPom ? collectImportBoms(mavenCtx.propsByPom) : [];
+		const propertyOverrides = mavenCtx?.store ? collectPropertyOverrides(mavenCtx.store) : {};
+		const descriptor = serializeDeps(resolved, { generator: `fad-checker ${pkgVersion}`, externalParents, importBoms, propertyOverrides });
 		try { fs.writeFileSync(options.exportAnonymized, JSON.stringify(descriptor, null, 2) + "\n"); }
 		catch (e) { console.error(chalk.red(`❌  could not write --export-anonymized file: ${e.message}`)); process.exit(1); }
 		const ecoSummary = Object.entries(descriptor.summary.byEcosystem).map(([k, v]) => `${k}:${v}`).join(", ");
@@ -689,9 +710,29 @@ async function timedPhase(label, fn) {
 				return !(allPomMetadata.byId[id] || allPomMetadata.byId[`${parts[0]}:${parts[1]}`]);
 			});
 		if (missingParents.length) {
-			ui.warn(`${missingParents.length} missing parent POM(s) — Snyk will fail if these are private:`);
-			for (const id of missingParents.slice(0, 10)) ui.info(chalk.yellow(id));
-			if (missingParents.length > 10) ui.info(chalk.dim(`…and ${missingParents.length - 10} more`));
+			// A parent absent from the source tree is EXTERNAL, not necessarily private. fad
+			// resolves a PUBLIC one (spring-boot-starter-parent, …) from Maven Central / warmed
+			// cache and backfills its managed versions — so only classify as "likely private"
+			// the ones it genuinely can't resolve. effectivePom is cache-first + offline-aware,
+			// and warms the cache the BOM/parent backfill reuses later in the report flow.
+			const { effectivePom } = require("./lib/transitive");
+			const resolvable = [], unresolved = [];
+			await Promise.all(missingParents.map(async id => {
+				const [g, a, v] = id.split(":");
+				let eff = null;
+				if (g && a && v) { try { eff = await effectivePom(g, a, v, { repos: mavenRepos, offline: options.offline }); } catch { eff = null; } }
+				(eff && eff.depMgmt && eff.depMgmt.length ? resolvable : unresolved).push(id);
+			}));
+			if (resolvable.length) {
+				ui.ok(`${resolvable.length} external parent POM(s) resolved from Maven Central${options.offline ? " (cache)" : ""} — managed versions backfilled`);
+				for (const id of resolvable.slice(0, 10)) ui.info(chalk.green(id));
+				if (resolvable.length > 10) ui.info(chalk.dim(`…and ${resolvable.length - 10} more`));
+			}
+			if (unresolved.length) {
+				ui.warn(`${unresolved.length} parent POM(s) not resolvable — likely private${options.offline ? " (or not in the warmed cache)" : ""}; Snyk will fail on these:`);
+				for (const id of unresolved.slice(0, 10)) ui.info(chalk.yellow(id));
+				if (unresolved.length > 10) ui.info(chalk.dim(`…and ${unresolved.length - 10} more`));
+			}
 		} else {
 			ui.ok("no missing Maven parent POMs");
 		}
@@ -826,7 +867,14 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		.map(b => ({ groupId: b.group, artifactId: b.name, version: b.version }))
 		.filter(b => b.groupId && b.artifactId && b.version);
 	const allBoms = importBoms.concat(gradleBoms);
-	const willBom = allBoms.length > 0;
+	// External <parent> POMs (e.g. spring-boot-starter-parent) manage versionless declared
+	// deps via their own inherited depMgmt (spring-boot-dependencies). core.js only follows
+	// LOCAL parents, so feed the external ones through the SAME backfill as import BOMs. This
+	// runs in the MAINLINE flow (not just the --transitive overlay) so the warmed cache always
+	// captures the parent POMs for offline reuse.
+	const externalParents = (runMaven && mavenStore)
+		? require("./lib/maven-bom").collectExternalParents(mavenStore) : [];
+	const willBom = allBoms.length > 0 || externalParents.length > 0;
 	const willOsv = !!options.osv;
 	// Local OSV DB import (Maven): offline-complete OSV recall, independent of the per-dep
 	// OSV.dev cache. Opt-in (downloads ~9 MB once); then matches online or offline.
@@ -837,20 +885,35 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	const willKev = !!options.kev;
 	const willLicenses = !!options.licenses;
 	const willRetire = !!options.retire;
+	// Committed crypto material (certs / keys / keystores) — local file scan, no network.
+	const willCerts = options.certs !== false && !!options.src;
+	const certExpiryDays = parseInt(options.certExpiryDays, 10) || 90;
 	// Identify committed native binaries by checksum (deps.dev + CIRCL) when present.
 	const willBinaryId = [...resolved.values()].some(d => d.provenance === "binary");
 	// License detection piggybacks on the registry passes (same fetched metadata),
 	// so it adds no progress step of its own.
-	const totalSteps = [willBom, willTransitive, willOverlay, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willOsvDb, willNvd, willEpss, willKev, willRetire, willBinaryId].filter(Boolean).length;
+	const totalSteps = [willBom, willTransitive, willOverlay, willCve, /*EOL*/ true, willOutdated, /*npm reg*/ true, ...otherRegistryIds.map(() => true), willOsv, willOsvDb, willNvd, willEpss, willKev, willRetire, willCerts, willBinaryId].filter(Boolean).length;
 	const progress = new ui.Progress(totalSteps);
 
 	if (willBom) {
-		const st = progress.start("BOM version resolution (Maven Central)");
+		const st = progress.start("BOM / parent version resolution (Maven Central)");
 		try {
 			const { resolveBomManagedVersions, backfillVersions } = require("./lib/maven-bom");
-			const mgmt = await resolveBomManagedVersions(allBoms, { repos: mavenRepos, offline, verbose });
+			const effCache = new Map();
+			const base = { repos: mavenRepos, offline, verbose, effCache };
+			// Import BOMs first: a local <scope>import</scope> declaration wins over the
+			// versions inherited from an external parent (Maven precedence). Import BOMs
+			// resolve in their own context — the project's property overrides do NOT reach
+			// them (Maven), so they get no propertyOverrides.
+			const mgmt = await resolveBomManagedVersions(allBoms, base);
+			// External parents second: fill only coords the BOMs didn't already manage, and
+			// honor the project's own <properties> overrides (e.g. a patched <log4j2.version>)
+			// so the version reflects the classpath, not the framework default.
+			const propertyOverrides = require("./lib/maven-bom").collectPropertyOverrides(mavenStore);
+			const parentMgmt = await resolveBomManagedVersions(externalParents, { ...base, via: "parent", propertyOverrides });
+			for (const [k, v] of parentMgmt) if (!mgmt.has(k)) mgmt.set(k, v);
 			const filled = backfillVersions(resolved, mgmt);
-			st.done(`${filled} dep version(s) from ${allBoms.length} import BOM(s)`);
+			st.done(`${filled} dep version(s) from ${allBoms.length} BOM(s) + ${externalParents.length} parent(s)`);
 		} catch (err) { st.fail(err.message); }
 	}
 
@@ -1107,6 +1170,21 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	// 5b. Certificate / key-material scan — committed certs, private/public keys
+	// (PEM, OpenSSH every algorithm, PuTTY, PGP, SSH one-liners) and keystores.
+	// Pure local file walk: no network, so it runs the same online or offline.
+	let certFindings = [];
+	if (willCerts) {
+		const st = progress.start("Certificates & keys");
+		try {
+			const { scanCertificates } = require("./lib/certs");
+			certFindings = scanCertificates(options.src, { srcRoot: options.src, excludePath, defaultExcludes, expiryDays: certExpiryDays });
+			const priv = certFindings.filter(c => c.kind === "private-key").length;
+			const expired = certFindings.filter(c => c.issues.some(i => i.type === "cert-expired")).length;
+			st.done(`${certFindings.length} item(s)${priv ? ` · ${priv} private key(s)` : ""}${expired ? ` · ${expired} expired` : ""}`);
+		} catch (err) { st.fail(err.message); }
+	}
+
 	// 6. Snyk (optional)
 	let snykMatches = [];
 	if (options.snyk) {
@@ -1235,6 +1313,18 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		}
 	}
 
+	if (certFindings.length) {
+		const privN = certFindings.filter(c => c.kind === "private-key").length;
+		const expiredN = certFindings.filter(c => c.issues.some(i => i.type === "cert-expired")).length;
+		heading("Certificates & keys", certFindings.length, [privN ? chalk.red(`${privN} private key`) : null, expiredN ? chalk.yellow(`${expiredN} expired`) : null].filter(Boolean).join("  "));
+		for (const c of certFindings.slice(0, 10)) {
+			const vis = c.keyVisibility ? chalk.dim(`[${c.keyVisibility}]`) : "";
+			const label = c.kind === "certificate" ? `${c.subject || "?"}` : `${c.algorithm || ""} ${c.kind}`.trim();
+			console.log("    " + sev(c.severity.toUpperCase())((c.severity || "?").padEnd(8)) + " " + chalk.white(path.basename(String(c.path))) + " " + vis + " " + chalk.dim(label));
+		}
+		if (certFindings.length > 10) console.log(chalk.dim(`    …and ${certFindings.length - 10} more (see report ch.2.4)`));
+	}
+
 	heading("EOL frameworks", eolResults.length);
 	for (const e of eolResults.slice(0, 8)) console.log("    " + chalk.yellow(e.product.padEnd(18)) + " " + chalk.dim(`${coordOf(e.dep)}:${e.dep.version}`) + " " + chalk.dim(e.eol === true ? "EOL" : String(e.eol)) + definedInOf(e.dep));
 	if (eolResults.length > 8) console.log(chalk.dim(`    …and ${eolResults.length - 8} more`));
@@ -1379,7 +1469,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 	if (out.html || out.doc) {
 		await ensureDir(out.html); await ensureDir(out.doc);
 		const { htmlPath, docPath } = await writeReports({
-			cveMatches: prodMatches, devCveMatches: devMatches, embeddedMatches, retireMatches, vendoredJsInventory,
+			cveMatches: prodMatches, devCveMatches: devMatches, embeddedMatches, retireMatches, vendoredJsInventory, certFindings,
 			eolResults, obsoleteResults, outdatedResults, licenseResults, excludedDirs,
 			resolvedDeps: resolved, projectInfo, warnings: reportWarnings, parsedManifests, diff,
 			htmlPath: out.html, docPath: out.doc,
@@ -1410,7 +1500,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		try {
 			const { writeFindings } = require("./lib/json-export");
 			await ensureDir(out.json);
-			writeFindings({ cveMatches, retireMatches, vendoredJsInventory, eolResults, obsoleteResults, outdatedResults, licenseResults, excludedDirs, resolvedDeps: resolved, projectInfo, toolVersion: pkg.version, typosquats, diff: jsonDiff }, out.json);
+			writeFindings({ cveMatches, retireMatches, vendoredJsInventory, certFindings, eolResults, obsoleteResults, outdatedResults, licenseResults, excludedDirs, resolvedDeps: resolved, projectInfo, toolVersion: pkg.version, typosquats, diff: jsonDiff }, out.json);
 			wrote.push(["Findings JSON", out.json]);
 		} catch (err) { ui.warn(`JSON export failed: ${err.message}`); }
 	}
@@ -1418,7 +1508,7 @@ async function runReportFlow(resolved, ecoFlags = {}) {
 		try {
 			const { writeSarif } = require("./lib/sarif-export");
 			await ensureDir(out.sarif);
-			writeSarif(cveMatches.filter(m => !m.suppressed), out.sarif, { projectInfo, toolVersion: pkg.version });
+			writeSarif(cveMatches.filter(m => !m.suppressed), out.sarif, { projectInfo, toolVersion: pkg.version, certFindings });
 			wrote.push(["SARIF", out.sarif]);
 		} catch (err) { ui.warn(`SARIF export failed: ${err.message}`); }
 	}