ndaal_public_SBOM_Auditor

Offline single-binary web app that ingests CycloneDX, SPDX and syft SBOMs, runs an ensemble of CVE scanners, enriches findings with EPSS, CISA-KEV and nuclei, and exports SARIF, CSAF and PDF.

Stored SBOMs dashboard

The home page (/) lists every stored SBOM and stays usable as the corpus grows:

• Paged — 25 rows per page, with a "Showing X–Y of N" caption and Previous / Page / Next controls.
• Sortable columns — click the Name, Format or Components header to sort by it; click the header again to reverse the direction.
• Format filter — narrow the list to one format (CycloneDX JSON/XML, SPDX JSON, SPDX 3.0 JSON, SPDX tag-value, Syft JSON or Unknown); a Reset button clears the filters while keeping the current sort.
• Severity column — a rightmost column, after Ingested, shows each SBOM's single highest finding severity (Critical, High, Medium, Low or Negligible), or "—" when it has no findings yet, with a matching severity filter.
• Full-text search — a search box, backed by a tantivy full-text index, matches an SBOM's name, format and spec version as well as the names and package URLs of the components it contains, so a query such as log4j or openssl finds every SBOM that ships that component. The query is length-capped and parsed leniently.

Analyzer ensemble

Each tool is optional at runtime and detected on PATH (override the binary with SBA_TOOL_<NAME>_BIN). Findings never depend on any single tool.

The first eight tools contribute CVE-shaped vulnerability findings; provenant is different — it reports licence, copyright, holder and author provenance, which the auditor stores and displays as its own finding shape (a "Licence & provenance" section per run, included in the Markdown export) rather than discarding it.

The scanners cannot read every format directly: bomber consumes only CycloneDX ≤ 1.6, and none of the scanners read SPDX 3.0 JSON-LD. In both cases the auditor normalises the input to CycloneDX via syft convert first, and skips with a documented reason when syft is unavailable rather than let a tool report zero packages. grype's vulnerability database is refreshed once per run (out of band) so a routine staleness is a fresh scan, not a failed one.

Vulnerability enrichment

After analysis, each CVE-shaped finding is enriched with three real signals pulled from a vulnlookup service (default https://vulnlookup.ndaal.eu):

• EPSS — the exploitation-probability score and its percentile.
• CISA-KEV — a flag marking the CVE as known-exploited.
• nuclei — whether a public exploit template exists, and its severity.

Each finding shows its KEV, Nuclei, EPSS and Source values, where Source links back to the vulnlookup record, and findings are ordered most-urgent-first: known-exploited (KEV) entries lead, then those with the higher EPSS percentile; findings with no enrichment keep the order the analyzer produced them in. The enrichment travels into every export format — SARIF 2.1 / 2.2, Markdown, ODT, DOCX, PDF and CSAF 2.1 / 2.2, where CSAF carries EPSS as a native metric and records CISA-KEV and nuclei as notes — and the export form now ticks every format by default.

Configure it under Settings → Vulnerability enrichment: an on/off toggle (enabled by default) and up to three vulnlookup sources, each with a base URL, a TCP port and a QUIC port (a blank port is treated as 443). Sources 1 and 2 default to the public https://vulnlookup.ndaal.eu on port 443; source 3 defaults to a loopback https://127.0.0.1 on this host's own 8680 (TCP) / 8681 (QUIC) ports, so a co-located vulnlookup is a working fallback out of the box. The sources are tried in order — the first is primary, the others are fallbacks.

Security posture

• Transport: HTTPS only, TLS 1.3 (rustls + aws-lc-rs) with post-quantum key exchange (X25519MLKEM768) offered first. Self-signed dev certificate, regenerated at start-up; operator PEM files supported.
• Memory safety: written in Rust with #![forbid(unsafe_code)]; the lint policy denies panicking shortcuts, unchecked arithmetic and unchecked indexing in production code.
• Filesystem confinement: all data / import / export I/O is confined by a cap-std capability handle (path-traversal, symlink and TOCTOU classes closed). Stored file names are server-derived, never client-supplied.
• Storage encryption (optional): XChaCha20-Poly1305 seals stored SBOM bytes and raw tool output while they sit on disk (--encryption-key-file).
• Web hardening: defence-in-depth response headers on every response, a hash-pinned Content-Security-Policy, same-origin checks on every POST, and a request-body size limit.
• No telemetry, no backdoors. Everything runs locally. Meets the TeleTrusT "IT Security made in Germany / Europe" criteria.

Hardening this cycle

• Multipart DoS cap — the upload parser rejects any multipart boundary longer than RFC 2046's 70 characters and locates it with a linear two-way search, closing an O(body×boundary) CPU-exhaustion path.
• Fail-closed stored-data decryption — an undecryptable encrypted blob (wrong key or tampering) now raises a hard error instead of being read as an empty document that reported "no findings".
• CVSS validation — analyzer CVSS base scores are clamped or rejected when non-finite or outside [0, 10] before they reach a generated CSAF or SARIF, and a cross-tool merge keeps the strongest score.
• TLS key hardening — --tls-key refuses a PKCS#1 RSA key (no-RSA policy) and, on Unix, a group- or world-readable key file.
• Export-download extension gate — GET /export/download serves only names with a recognised export or checksum-sidecar extension, so a misconfigured export directory cannot hand out a system file.
• h2 bump (RUSTSEC-2026-0258) — the bundled HTTP/2 stack is updated to 0.4.18 for unbounded empty DATA frames; cargo audit is clean.

Build and run

Install the published release from crates.io — cargo install builds it from source, cargo binstall fetches the prebuilt binary from the GitLab release:

Or build this checkout directly (a recent stable Rust toolchain is required):

Then open https://127.0.0.1:8680 (the browser will warn once about the self-signed certificate). The top navigation runs Home, Upload, Import, Export, Components, Tools, Settings, followed by the dark/light theme switch, language menu and info menu on the right. The interface ships in 49 languages — English, Deutsch and Français plus every European official language, Norwegian Nynorsk, the three Sámi languages official in Norway (Northern, Lule and Southern Sámi), and three Asian additions — Chinese (中文), Hindi (हिन्दी) and Urdu (اردو, right-to-left) — selectable from the language menu (and remembered per browser). The Supported GUI languages section below has the full breakdown.

Common options

Ports: 8680 serves the API and web UI over TLS 1.3 (HTTP/1.1 + HTTP/2); 8681 is reserved for a future QUIC / HTTP-3 listener (not yet implemented).

Supported GUI languages

The web UI ships in 49 languages. English, Deutsch and Français are the maintained, human-authored set and are pinned to the front of the language switcher; every other language follows in alphabetical order by its English name.

Three Asian languages joined this cycle: Chinese / 中文 (Mandarin, Simplified), Hindi / हिन्दी and Urdu / اردو. Urdu is right-to-left — the application renders <html dir="rtl"> while it is selected.

Every language beyond the pinned three is machine-translated and pending native review; any string missing from a translation falls back automatically to English. The in-page switcher lists each language by its own native-name endonym and is the authoritative list — consult it rather than an enumeration here.

This applies to the web UI only. The generated reports (SARIF, CSAF and the PDF export) and the HTTP API remain English-only.

Testing

Additional harnesses: loom-harness/ (concurrency permutation models), test/bruno/ (API collection), test/playwright/ (browser E2E), test/example-corpus/ (API + GUI upload→analyze→export over the bundled example/ SBOM corpus) and loadtest/ (Goose load scenarios). tests/scripts/test_examples_upload_via_api.sh (with a sister .bats) uploads every example/ SBOM against a running instance and asserts each yields a SARIF, a CSAF and a PDF via the streamed POST /export/download ZIP; TLS is verified for non-loopback hosts and skipped for localhost's self-signed certificate, and --base-url targets any instance (for example https://sbom.ndaal.eu/). The test/magnitude/ suite (Magnitude, *.mag.ts) adds AI-driven visual checks of the navbar order and the export defaults plus Start download; it complements the deterministic tests, needs an LLM to run and is not part of the blocking CI gate. The example/ directory carries 651 public test SBOMs (Git LFS); see example/PROVENANCE.md. See documentation/structure.md for the module map and the request flow.

Documentation

• REFERENCE.md — CLI, environment, routes, settings and export-format reference
• documentation/structure.md — architecture map
• documentation/User_Guide.md — end-user walkthrough
• documentation/Administrator_Guide.md — deployment and operations
• documentation/arc42/en/ — arc42 architecture views
• documentation/compliance/CSI_2026_cisa_sbom_minimum_elements_508c.md — conformance assessment against the CISA 2026 SBOM Minimum Elements
• CHANGELOG.md — release history

Licence

Code is licensed Apache-2.0. Bundled UI assets carry their own licences (Bootstrap MIT, htmx 0BSD, Roboto OFL-1.1); see the per-file .license sidecars under src/static/.