retire 5.5.0 → 5.7.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [5.7.0]
+
+### Improvements
+
+- Added CycloneDX 1.7 output: `--outputformat cyclonedxJSON1_7` and `cyclonedxJSON1_7_VEX`.
+- CycloneDX 1.7 reports every resolved license, each as its own SPDX expression. Earlier spec versions only allow a single expression per component, so 1.4/1.6 output still reports the first license only.
+- The CycloneDX 1.6 and 1.7 reports now include:
+  - `$schema`, pointing at the schema for the emitted spec version.
+  - `metadata.tools` in the object form introduced in 1.5, replacing the deprecated legacy array.
+  - `metadata.component`, describing the scanned path as the subject of the BOM.
+  - `dependencies`, linking the scan target to every detected component.
+  - `evidence.identity`, reporting how the version was detected (`filecontent`, `filename`, `hash`, `ast`, ...) as a CycloneDX identity technique and confidence.
+  - `vulnerabilities[].detail`, when the repository supplies `details` (VEX variants only).
+
+### Bugfixes
+
+- CycloneDX 1.6 output threw when a vulnerability in a custom `--jsrepo` had no `cwe`, and could throw on a vulnerability with no `identifiers`.
+
+## [5.6.0]
+
+### Improvements
+
+- Report when repository certificate errors are ignored (`--insecure`): as `ignoreRepositoryCertificateErrors` in the JSON report, and as a `retirejs:ignore-repository-certificate-errors` entry under `metadata.properties` in all CycloneDX reports. The entry is only present when the option is set.
+
 ## [5.5.0]
 
 ### Improvements

package/README.md

@@ -18,7 +18,8 @@ Options:
   --jsrepo <path|url>      Local or internal version of repo. Can be multiple comma separated. Default: 'central')
   --cachedir <path>        Path to use for local cache instead of /tmp/.retire-cache
   --proxy <url>            Proxy url (http://some.host:8080)
-  --outputformat <format>  Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx and cyclonedxJSON
+  --outputformat <format>  Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON, cyclonedxJSON1_6,
+                           cyclonedxJSON1_6_VEX, cyclonedxJSON1_7 and cyclonedxJSON1_7_VEX
   --outputpath <path>      File to which output should be written
   --ignore <paths>         Comma delimited list of paths to ignore
   --ignorefile <path>      Custom ignore file, defaults to .retireignore / .retireignore.json
@@ -35,7 +36,9 @@ Options:
 ```
 
 The `depcheck` output format mimics the output of OWASP Dependency Check, but lacks some information compared to OWASP Dependency Check, because that information is not in the repo.
-The `cyclonedx` output format is based on based on the https://github.com/CycloneDX spec.
+The `cyclonedx` output format is based on the https://github.com/CycloneDX spec. `cyclonedx` and `cyclonedxJSON` emit CycloneDX 1.4
+(XML and JSON respectively). `cyclonedxJSON1_6` and `cyclonedxJSON1_7` emit JSON for the corresponding spec versions, and the
+`_VEX` variants of those additionally include a `vulnerabilities` section.
 
 ## .retireignore
 

package/lib/cli.js

@@ -70,7 +70,7 @@ const prg = commander_1.program
     .option('--jsrepo <path|url>', "Local or internal version of repo. Can be multiple comma separated. Default: 'central')")
     .option('--cachedir <path>', 'Path to use for local cache instead of /tmp/.retire-cache')
     .option('--proxy <url>', 'Proxy url (http://some.host:8080)')
-    .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON, cyclonedxJSON1_6, cyclonedxJSON1_6_VEX')
+    .option('--outputformat <format>', 'Valid formats: text, json, jsonsimple, depcheck (experimental), cyclonedx, cyclonedxJSON, cyclonedxJSON1_6, cyclonedxJSON1_6_VEX, cyclonedxJSON1_7, cyclonedxJSON1_7_VEX')
     .option('--outputpath <path>', 'File to which output should be written')
     .option('--ignore <paths>', 'Comma delimited list of paths to ignore')
     .option('--ignorefile <path>', 'Custom ignore file, defaults to .retireignore / .retireignore.json')
@@ -96,6 +96,7 @@ const log = reporting.open({
     colors: !!prg.colors,
     colorwarn,
     jsRepo: jsrepolocation,
+    insecure: prg.insecure,
     outputformat: prg.outputformat,
     outputpath: prg.outputpath,
     path: scanpath,

package/lib/reporters/cyclonedx-1_6-json.d.ts

@@ -1,3 +1,2 @@
-import { ConfigurableLogger } from '../reporting';
-declare const _default: ConfigurableLogger;
+declare const _default: import("../reporting").ConfigurableLogger;
 export default _default;

package/lib/reporters/cyclonedx-1_6-json.js

@@ -1,210 +1,4 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
-const retire = __importStar(require("../retire"));
-const fs = __importStar(require("fs"));
-const utils_1 = require("./utils");
-const path = __importStar(require("path"));
-const crypto = __importStar(require("crypto"));
-function configureCycloneDXJSONLogger(logger, writer, config, hash) {
-    let vulnsFound = false;
-    const finalResults = {
-        version: retire.version,
-        start: new Date().toISOString(),
-        data: [],
-        messages: [],
-        errors: [],
-    };
-    logger.info = finalResults.messages.push;
-    logger.debug = config.verbose
-        ? finalResults.messages.push
-        : function () {
-            return;
-        };
-    logger.warn = logger.error = finalResults.errors.push;
-    logger.logVulnerableDependency = function (finding) {
-        vulnsFound = true;
-        finalResults.data.push(finding);
-    };
-    logger.logDependency = function (finding) {
-        if (finding.results.length > 0) {
-            finalResults.data.push(finding);
-        }
-    };
-    logger.close = function (callback) {
-        const write = vulnsFound ? writer.err : writer.out;
-        const seen = new Map();
-        const vulnerabilitiesCyclone = new Map();
-        const includeVEX = config.outputformat === 'cyclonedxJSON1_6_VEX';
-        const repositories = (0, utils_1.vulnerabilityRepositories)(config.jsRepo);
-        // Only attributable to a single URL when exactly one repository was used
-        const retireSource = {
-            name: 'Retire.js',
-            url: repositories.length === 1 ? repositories[0] : undefined,
-        };
-        const components = finalResults.data
-            .filter((d) => d.results)
-            .map((r) => r.results
-            .map((dep) => {
-            dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
-            let hashes;
-            const filepath = r.file;
-            const evidence = { occurrences: [] };
-            if (filepath) {
-                const file = fs.readFileSync(filepath);
-                const relativePath = path.relative(process.cwd(), filepath);
-                evidence.occurrences.push({ location: relativePath });
-                hashes = [
-                    { alg: 'MD5', content: hash.md5(file) },
-                    { alg: 'SHA-1', content: hash.sha1(file) },
-                    { alg: 'SHA-256', content: hash.sha256(file) },
-                    { alg: 'SHA-512', content: hash.sha512(file) },
-                ];
-            }
-            const purl = (0, utils_1.generatePURL)(dep);
-            const existing = seen.get(purl);
-            if (existing) {
-                const missing = evidence.occurrences.filter((x) => !existing.evidence.occurrences.some((y) => y.location == x.location));
-                existing.evidence.occurrences.push(...missing);
-                return undefined;
-            }
-            const nameParts = dep.component.split('/').reverse();
-            const bomRef = purl;
-            dep.vulnerabilities?.forEach((vuln) => {
-                // Pick valid identifiers for VEX
-                const ids = vuln.identifiers?.CVE ?? (vuln.identifiers?.githubID ? [vuln.identifiers.githubID] : undefined);
-                if (!ids)
-                    return;
-                ids.forEach((id) => {
-                    if (!vulnerabilitiesCyclone.has(id)) {
-                        const { references, advisories } = mapUrls(vuln);
-                        vulnerabilitiesCyclone.set(id, {
-                            id,
-                            source: retireSource,
-                            cwes: vuln.cwe.map((c) => parseInt(c.split("-")[1])),
-                            description: vuln.identifiers.summary,
-                            advisories: advisories,
-                            references: references,
-                            ratings: [
-                                {
-                                    source: retireSource,
-                                    severity: vuln.severity,
-                                },
-                            ],
-                            affects: [],
-                        });
-                    }
-                    vulnerabilitiesCyclone.get(id).affects.push({
-                        ref: bomRef,
-                        versions: [
-                            {
-                                // "vers:npm/1.2.3|>=2.0.0|<5.0.0"
-                                range: 'vers:npm/' + (vuln.atOrAbove ? '>=' + vuln.atOrAbove + '|' : '') + '<' + vuln.below,
-                                status: 'affected',
-                            },
-                        ],
-                    });
-                });
-            });
-            const result = {
-                "bom-ref": bomRef,
-                type: 'library',
-                name: nameParts[0],
-                group: nameParts[1],
-                version: dep.version,
-                purl: purl,
-                hashes: hashes,
-                evidence,
-                licenses: mapLicenses(dep.licenses),
-            };
-            seen.set(purl, result);
-            return result;
-        })
-            .filter((x) => x != undefined))
-            .reduce((a, b) => a.concat(b), []);
-        write(JSON.stringify({
-            bomFormat: 'CycloneDX',
-            specVersion: '1.6',
-            serialNumber: `urn:uuid:${crypto.randomUUID()}`,
-            version: 1,
-            metadata: {
-                timestamp: finalResults.start,
-                tools: [
-                    {
-                        vendor: 'RetireJS',
-                        name: 'retire',
-                        version: retire.version,
-                    },
-                ],
-                properties: repositories.length
-                    ? repositories.map((repo) => ({
-                        name: 'retirejs:vulnerability-repository',
-                        value: repo,
-                    }))
-                    : undefined,
-            },
-            components: components,
-            vulnerabilities: includeVEX ? Array.from(vulnerabilitiesCyclone.values()) : undefined,
-        }, undefined, 2));
-        writer.close(callback);
-    };
-}
-function mapLicenses(licenses) {
-    if (!licenses)
-        return [];
-    if (licenses.length == 0)
-        return [];
-    if (licenses[0] == 'commercial')
-        return [{ license: { name: 'Commercial' } }];
-    return [{ expression: licenses[0] }];
-}
-function mapUrls(vulnerability) {
-    const references = [];
-    if (vulnerability.identifiers.CVE) {
-        const nvdlink = `https://nvd.nist.gov/vuln/detail/${vulnerability.identifiers.CVE[0]}`;
-        references.push({ id: vulnerability.identifiers.CVE[0], source: { name: 'NVD', url: nvdlink } });
-    }
-    if (vulnerability.identifiers.githubID) {
-        const ghsa = `https://github.com/advisories/${vulnerability.identifiers.githubID}`;
-        references.push({ id: vulnerability.identifiers.githubID, source: { name: 'GitHub Advisories', url: ghsa } });
-    }
-    const advisories = vulnerability.info
-        .filter((url) => !url.startsWith('https://nvd.nist.gov/vuln/detail/') && !url.startsWith('https://github.com/advisories/'))
-        .map((u) => ({ url: u }));
-    return { references, advisories };
-}
-exports.default = {
-    configure: configureCycloneDXJSONLogger,
-};
+const cyclonedx_json_builder_1 = require("./cyclonedx-json-builder");
+exports.default = (0, cyclonedx_json_builder_1.cycloneDXJSONLogger)('1.6');

package/lib/reporters/cyclonedx-1_7-json.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("../reporting").ConfigurableLogger;
+export default _default;

package/lib/reporters/cyclonedx-1_7-json.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const cyclonedx_json_builder_1 = require("./cyclonedx-json-builder");
+exports.default = (0, cyclonedx_json_builder_1.cycloneDXJSONLogger)('1.7');

package/lib/reporters/cyclonedx-json-builder.d.ts

@@ -0,0 +1,7 @@
+import { ConfigurableLogger } from '../reporting';
+/**
+ * Spec versions sharing this implementation. The 1.4 reporters are kept separate, as the
+ * modern object form of metadata.tools was only introduced in 1.5.
+ */
+export type CycloneDXSpecVersion = '1.6' | '1.7';
+export declare function cycloneDXJSONLogger(specVersion: CycloneDXSpecVersion): ConfigurableLogger;

package/lib/reporters/cyclonedx-json-builder.js

@@ -0,0 +1,272 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cycloneDXJSONLogger = cycloneDXJSONLogger;
+const retire = __importStar(require("../retire"));
+const fs = __importStar(require("fs"));
+const utils_1 = require("./utils");
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const TOOL_BOM_REF = 'retirejs-tool';
+const SCAN_TARGET_BOM_REF = 'retirejs:scan-target';
+/**
+ * Retire.js has no native confidence score, so the mapping from the detection method to a
+ * CycloneDX identity technique and confidence is a heuristic. Both technique and confidence
+ * are required by the schema.
+ */
+const identityTechniques = {
+    hash: { technique: 'hash-comparison', confidence: 1 },
+    ast: { technique: 'ast-fingerprint', confidence: 0.9 },
+    filecontent: { technique: 'source-code-analysis', confidence: 0.8 },
+    filecontentreplace: { technique: 'source-code-analysis', confidence: 0.8 },
+    func: { technique: 'dynamic-analysis', confidence: 0.8 },
+    filename: { technique: 'filename', confidence: 0.5 },
+    uri: { technique: 'filename', confidence: 0.5 },
+};
+function configureCycloneDXJSONLogger(specVersion, logger, writer, config, hash) {
+    let vulnsFound = false;
+    const finalResults = {
+        version: retire.version,
+        start: new Date().toISOString(),
+        data: [],
+        messages: [],
+        errors: [],
+    };
+    logger.info = finalResults.messages.push;
+    logger.debug = config.verbose
+        ? finalResults.messages.push
+        : function () {
+            return;
+        };
+    logger.warn = logger.error = finalResults.errors.push;
+    logger.logVulnerableDependency = function (finding) {
+        vulnsFound = true;
+        finalResults.data.push(finding);
+    };
+    logger.logDependency = function (finding) {
+        if (finding.results.length > 0) {
+            finalResults.data.push(finding);
+        }
+    };
+    logger.close = function (callback) {
+        const write = vulnsFound ? writer.err : writer.out;
+        const seen = new Map();
+        const vulnerabilitiesCyclone = new Map();
+        const includeVEX = config.outputformat?.endsWith('_VEX') ?? false;
+        const vulnerabilityRepositoriesList = (0, utils_1.vulnerabilityRepositories)(config.jsRepo);
+        // Only attributable to a single URL when exactly one repository was used
+        const retireSource = {
+            name: 'Retire.js',
+            url: vulnerabilityRepositoriesList.length === 1 ? vulnerabilityRepositoriesList[0] : undefined,
+        };
+        const properties = vulnerabilityRepositoriesList.map((repo) => ({
+            name: 'retirejs:vulnerability-repository',
+            value: repo,
+        }));
+        if (config.insecure) {
+            properties.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
+        }
+        const components = finalResults.data
+            .filter((d) => d.results)
+            .map((r) => r.results
+            .map((dep) => {
+            dep.version = (dep.version.split('.').length >= 3 ? dep.version : dep.version + '.0').replace(/-/g, '.');
+            let hashes;
+            const filepath = r.file;
+            const evidence = { occurrences: [] };
+            if (filepath) {
+                const file = fs.readFileSync(filepath);
+                const relativePath = path.relative(process.cwd(), filepath);
+                evidence.occurrences.push({ location: relativePath });
+                hashes = [
+                    { alg: 'MD5', content: hash.md5(file) },
+                    { alg: 'SHA-1', content: hash.sha1(file) },
+                    { alg: 'SHA-256', content: hash.sha256(file) },
+                    { alg: 'SHA-512', content: hash.sha512(file) },
+                ];
+            }
+            const purl = (0, utils_1.generatePURL)(dep);
+            const existing = seen.get(purl);
+            if (existing) {
+                const missing = evidence.occurrences.filter((x) => !existing.evidence.occurrences.some((y) => y.location == x.location));
+                existing.evidence.occurrences.push(...missing);
+                return undefined;
+            }
+            const identity = mapIdentity(dep);
+            if (identity)
+                evidence.identity = [identity];
+            const nameParts = dep.component.split('/').reverse();
+            const bomRef = purl;
+            dep.vulnerabilities?.forEach((vuln) => {
+                // Pick valid identifiers for VEX
+                const ids = vuln.identifiers?.CVE ?? (vuln.identifiers?.githubID ? [vuln.identifiers.githubID] : undefined);
+                if (!ids)
+                    return;
+                ids.forEach((id) => {
+                    if (!vulnerabilitiesCyclone.has(id)) {
+                        const { references, advisories } = mapUrls(vuln);
+                        const cwes = vuln.cwe?.map((c) => parseInt(c.split('-')[1]));
+                        vulnerabilitiesCyclone.set(id, {
+                            id,
+                            source: retireSource,
+                            cwes: cwes?.length ? cwes : undefined,
+                            description: vuln.identifiers?.summary,
+                            detail: vuln.details,
+                            advisories: advisories,
+                            references: references,
+                            ratings: [
+                                {
+                                    source: retireSource,
+                                    severity: vuln.severity,
+                                },
+                            ],
+                            affects: [],
+                        });
+                    }
+                    vulnerabilitiesCyclone.get(id).affects.push({
+                        ref: bomRef,
+                        versions: [
+                            {
+                                // "vers:npm/1.2.3|>=2.0.0|<5.0.0"
+                                range: 'vers:npm/' + (vuln.atOrAbove ? '>=' + vuln.atOrAbove + '|' : '') + '<' + vuln.below,
+                                status: 'affected',
+                            },
+                        ],
+                    });
+                });
+            });
+            const result = {
+                'bom-ref': bomRef,
+                type: 'library',
+                name: nameParts[0],
+                group: nameParts[1],
+                version: dep.version,
+                purl: purl,
+                hashes: hashes,
+                evidence,
+                licenses: mapLicenses(dep.licenses, specVersion),
+            };
+            seen.set(purl, result);
+            return result;
+        })
+            .filter((x) => x != undefined))
+            .reduce((a, b) => a.concat(b), []);
+        const dependencies = [
+            { ref: SCAN_TARGET_BOM_REF, dependsOn: components.map((c) => c['bom-ref']) },
+            ...components.map((c) => ({ ref: c['bom-ref'], dependsOn: [] })),
+        ];
+        write(JSON.stringify({
+            $schema: `http://cyclonedx.org/schema/bom-${specVersion}.schema.json`,
+            bomFormat: 'CycloneDX',
+            specVersion,
+            serialNumber: `urn:uuid:${crypto.randomUUID()}`,
+            version: 1,
+            metadata: {
+                timestamp: finalResults.start,
+                tools: {
+                    components: [
+                        {
+                            type: 'application',
+                            'bom-ref': TOOL_BOM_REF,
+                            group: 'RetireJS',
+                            name: 'retire',
+                            version: retire.version,
+                        },
+                    ],
+                },
+                component: {
+                    type: 'application',
+                    'bom-ref': SCAN_TARGET_BOM_REF,
+                    name: scanTargetName(config.path),
+                },
+                properties: properties.length ? properties : undefined,
+            },
+            components: components,
+            dependencies,
+            vulnerabilities: includeVEX ? Array.from(vulnerabilitiesCyclone.values()) : undefined,
+        }, undefined, 2));
+        writer.close(callback);
+    };
+}
+function scanTargetName(scanPath) {
+    return path.basename(path.resolve(scanPath ?? '.'));
+}
+function mapIdentity(component) {
+    if (!component.detection)
+        return undefined;
+    const mapped = identityTechniques[component.detection];
+    if (!mapped)
+        return undefined;
+    return {
+        field: 'version',
+        confidence: mapped.confidence,
+        concludedValue: component.version,
+        methods: [{ technique: mapped.technique, confidence: mapped.confidence, value: component.detection }],
+    };
+}
+function mapLicense(license) {
+    return license == 'commercial' ? { license: { name: 'Commercial' } } : { expression: license };
+}
+function mapLicenses(licenses, specVersion) {
+    if (!licenses)
+        return [];
+    if (licenses.length == 0)
+        return [];
+    // Before 1.7, the licenses array could hold at most one SPDX expression, and expressions
+    // could not be mixed with named licenses.
+    if (specVersion === '1.6')
+        return [mapLicense(licenses[0])];
+    return licenses.map(mapLicense);
+}
+function mapUrls(vulnerability) {
+    const references = [];
+    if (vulnerability.identifiers?.CVE) {
+        const nvdlink = `https://nvd.nist.gov/vuln/detail/${vulnerability.identifiers.CVE[0]}`;
+        references.push({ id: vulnerability.identifiers.CVE[0], source: { name: 'NVD', url: nvdlink } });
+    }
+    if (vulnerability.identifiers?.githubID) {
+        const ghsa = `https://github.com/advisories/${vulnerability.identifiers.githubID}`;
+        references.push({ id: vulnerability.identifiers.githubID, source: { name: 'GitHub Advisories', url: ghsa } });
+    }
+    const advisories = vulnerability.info
+        .filter((url) => !url.startsWith('https://nvd.nist.gov/vuln/detail/') && !url.startsWith('https://github.com/advisories/'))
+        .map((u) => ({ url: u }));
+    return { references, advisories };
+}
+function cycloneDXJSONLogger(specVersion) {
+    return {
+        configure: (logger, writer, config, hash) => configureCycloneDXJSONLogger(specVersion, logger, writer, config, hash),
+    };
+}

package/lib/reporters/cyclonedx-json.js

@@ -65,7 +65,10 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
     };
     logger.close = function (callback) {
         const write = vulnsFound ? writer.err : writer.out;
-        const repositories = (0, utils_1.vulnerabilityRepositories)(config.jsRepo);
+        const properties = (0, utils_1.vulnerabilityRepositories)(config.jsRepo).map((repo) => ({ name: 'retirejs:vulnerability-repository', value: repo }));
+        if (config.insecure) {
+            properties.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
+        }
         const seen = new Map();
         const components = finalResults.data
             .filter((d) => d.results)
@@ -123,12 +126,7 @@ function configureCycloneDXJSONLogger(logger, writer, config, hash) {
                         version: retire.version,
                     },
                 ],
-                properties: repositories.length
-                    ? repositories.map((repo) => ({
-                        name: 'retirejs:vulnerability-repository',
-                        value: repo,
-                    }))
-                    : undefined,
+                properties: properties.length ? properties : undefined,
             },
             components: components,
         }, undefined, 2));

package/lib/reporters/cyclonedx.js

@@ -65,9 +65,16 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
     };
     logger.close = function (callback) {
         const write = vulnsFound ? writer.err : writer.out;
-        const repositories = (0, utils_1.vulnerabilityRepositories)(config.jsRepo)
-            .map((repo) => `
-      <property name="retirejs:vulnerability-repository">${escapeXml(repo)}</property>`)
+        const propertyList = (0, utils_1.vulnerabilityRepositories)(config.jsRepo).map((repo) => ({
+            name: 'retirejs:vulnerability-repository',
+            value: repo,
+        }));
+        if (config.insecure) {
+            propertyList.push({ name: 'retirejs:ignore-repository-certificate-errors', value: 'true' });
+        }
+        const properties = propertyList
+            .map((property) => `
+      <property name="${escapeXml(property.name)}">${escapeXml(property.value)}</property>`)
             .join('');
         const seen = new Set();
         const components = finalResults.data
@@ -113,8 +120,8 @@ function configureCycloneDXLogger(logger, writer, config, hash) {
             <name>retire.js</name>
             <version>${retire.version}</version>
         </tool>
-    </tools>${repositories ? `
-    <properties>${repositories}
+    </tools>${properties ? `
+    <properties>${properties}
     </properties>` : ''}
   </metadata>
   <components>${components}

package/lib/reporters/json.js

@@ -47,6 +47,7 @@ exports.default = {
             errors: [],
             time: undefined,
             vulnerabilityRepositories: (0, utils_1.vulnerabilityRepositories)(config.jsRepo),
+            ignoreRepositoryCertificateErrors: config.insecure,
         };
         logger.info = finalResults.messages.push;
         logger.debug = config.verbose

package/lib/reporting.d.ts

@@ -5,6 +5,7 @@ export type LoggerOptions = {
     colors: boolean;
     outputformat: string;
     jsRepo: string[];
+    insecure?: boolean;
     path: string;
     colorwarn: (s: string) => string;
 };

package/lib/reporting.js

@@ -46,6 +46,7 @@ const depcheck_1 = __importDefault(require("./reporters/depcheck"));
 const cyclonedx_1 = __importDefault(require("./reporters/cyclonedx"));
 const cyclonedx_json_1 = __importDefault(require("./reporters/cyclonedx-json"));
 const cyclonedx_1_6_json_1 = __importDefault(require("./reporters/cyclonedx-1_6-json"));
+const cyclonedx_1_7_json_1 = __importDefault(require("./reporters/cyclonedx-1_7-json"));
 const loggers = {
     console: console_1.default,
     text: console_1.default,
@@ -55,6 +56,8 @@ const loggers = {
     cyclonedxJSON: cyclonedx_json_1.default,
     cyclonedxJSON1_6: cyclonedx_1_6_json_1.default,
     cyclonedxJSON1_6_VEX: cyclonedx_1_6_json_1.default,
+    cyclonedxJSON1_7: cyclonedx_1_7_json_1.default,
+    cyclonedxJSON1_7_VEX: cyclonedx_1_7_json_1.default,
     clean: console_1.default,
     jsonsimple: json_1.default,
 };

package/lib/retire.js

@@ -4,7 +4,7 @@
  */
 
 var exports = exports || {};
-exports.version = '5.5.0';
+exports.version = '5.7.0';
 
 function isDefined(o) {
   return typeof o !== 'undefined';

package/package.json

@@ -2,7 +2,7 @@
   "author": "Erlend Oftedal <erlend@oftedal.no>",
   "name": "retire",
   "description": "Retire is a tool for detecting use of vulnerable libraries",
-  "version": "5.5.0",
+  "version": "5.7.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",