From 04b311ef2b9a8ccd17f0db77854e0397188ca980 Mon Sep 17 00:00:00 2001 From: Matt Brown Date: Thu, 22 Oct 2026 14:07:58 -0400 Subject: [PATCH] docs(cli): document -C output set and distinguish it from moria's -C The -C/--outdir man entry only mentioned mithril-report.json, but -C also writes sbom.cdx.json and sbom.spdx.json when the SBOM pass runs, and those standard-format SBOMs are reachable only through -C (the JSON report carries components inline, but not the CycloneDX/SPDX documents). Spell that out in the man page and README, and note that moria(1) also has a -C that means something different (its extraction output directory) so a moria user is not surprised. Docs only; no behavior change. --- README.md | 2 +- mithril.1 | 19 +++++++++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 0074ba8..50d697d 100644 --- a/README.md +++ b/README.md @@ -76,7 +76,7 @@ Build it once either way; every scan after that is offline. See `docs/cve-join.m ## Scope - **secrets**: credential and key material in file content (cloud keys, tokens, JWTs, private keys, high-entropy `KEY=…` values). `/etc/shadow` and `htpasswd` hashes are classified with weak-algorithm and empty-password flags, and credential/crypto/config files are flagged by path. -- **sbom**: components and versions from package databases, language manifests, binary version strings, libc filenames, and the kernel banner, keyed on purl (with CPE co-derived), emitted as CycloneDX and SPDX. +- **sbom**: components and versions from package databases, language manifests, binary version strings, libc filenames, and the kernel banner, keyed on purl (with CPE co-derived). The JSON report always carries the components inline; the standard-format bills of materials (CycloneDX and SPDX) are written as `sbom.cdx.json` and `sbom.spdx.json` when you pass `-C/--outdir`. - **cve**: the SBOM joined against the local OSV + NVD/CPE mirror, plus the curated kernel-CVE checklist, annotated with KEV and EPSS. The default human view shows only foothold-worthy component CVEs (on CISA KEV, or Critical, or a hard High/Critical floor of CVSS >= 7.0 with EPSS traction, low attack complexity, and real impact or a trending remote DoS), sorted worst-first; it drops Mediums, local DoS, and the high-complexity crypto class. `--component-cves-full` lists them all. JSON always carries the complete set plus a `component_cve_scan` summary. - **licenses**: SPDX identification from `SPDX-License-Identifier` tags and LICENSE/COPYING/NOTICE text. Human output summarizes by id and count; `--license-paths` lists each license's file locations, and JSON always carries the full `paths` array. diff --git a/mithril.1 b/mithril.1 index b32bfd1..e22860f 100644 --- a/mithril.1 +++ b/mithril.1 @@ -166,8 +166,23 @@ nonzero, as in a non-interactive run. Use it in scripts and CI. Add user-defined detection rules from a JSON file. .TP .BR \-C ", " \-\-outdir " " \fIDIR\fR -Write the JSON report to -.IR DIR /mithril\-report.json . +Also write the report to +.IR DIR , +regardless of the stdout format: +.I mithril\-report.json +(the complete JSON result set) and, when the SBOM pass runs, +.I sbom.cdx.json +and +.I sbom.spdx.json +(the CycloneDX and SPDX bills of materials). These standard-format SBOMs are +produced only through +.BR \-C . +Note that +.BR moria (1) +also has a +.B \-C +but means its extraction output directory; here it is the report output +directory. .TP .BI \-\-threads " N" Worker threads for tree scans. Default: automatic.