Address CodeRabbit review feedback

- main.rs: Use clap ValueEnum for --format to reject invalid values
  at parse time instead of silently defaulting to cyclonedx
- scanner.rs: Dedup keeps highest-confidence finding per location
  using HashMap instead of first-seen HashSet
- scanner.rs: pattern_applies now checks extensionless manifest
  filenames (Gemfile, Podfile, etc.) not just file extensions
- Analyze.hs: Distinguish scanner failure from empty results in
  CBOM output and FIPS report (log warning on failure instead of
  misleading "no findings" message)
- ScanSummary.hs: Pass warnings through on successful crypto scan
  instead of always showing plain success
- FipsReport.hs: Dedupe by (name, parameter_set) instead of name
  only, so RSA-2048 and RSA-1024 are counted separately

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: CortezFrazierJr

extlib/cryptoscan/src/main.rs

@@ -4,9 +4,15 @@ mod fips;
 mod patterns;
 mod scanner;
 
-use clap::Parser;
+use clap::{Parser, ValueEnum};
 use std::path::PathBuf;
 
+#[derive(Copy, Clone, Debug, ValueEnum)]
+enum OutputFormat {
+    Json,
+    Cyclonedx,
+}
+
 #[derive(Parser, Debug)]
 #[command(name = "cryptoscan", about = "Detect cryptographic algorithm usage in source code")]
 struct Cli {
@@ -19,8 +25,8 @@ struct Cli {
     ecosystem: String,
 
     /// Output format (json, cyclonedx)
-    #[arg(short, long, default_value = "cyclonedx")]
-    format: String,
+    #[arg(short, long, value_enum, default_value_t = OutputFormat::Cyclonedx)]
+    format: OutputFormat,
 
     /// Only show non-FIPS-compliant findings
     #[arg(long, default_value_t = false)]
@@ -47,9 +53,9 @@ fn main() {
         findings
     };
 
-    let output = match cli.format.as_str() {
-        "json" => serde_json::to_string_pretty(&findings).expect("Failed to serialize findings"),
-        "cyclonedx" | _ => {
+    let output = match cli.format {
+        OutputFormat::Json => serde_json::to_string_pretty(&findings).expect("Failed to serialize findings"),
+        OutputFormat::Cyclonedx => {
             let bom = cyclonedx::to_cyclonedx_bom(&findings);
             serde_json::to_string_pretty(&bom).expect("Failed to serialize CBOM")
         }

extlib/cryptoscan/src/scanner.rs

@@ -1,10 +1,10 @@
-use std::collections::HashSet;
+use std::collections::{HashMap, HashSet};
 use std::fs;
 use std::path::Path;
 
 use walkdir::WalkDir;
 
-use crate::crypto_algorithm::{CryptoAlgorithm, CryptoFinding, Primitive};
+use crate::crypto_algorithm::{Confidence, CryptoAlgorithm, CryptoFinding, Primitive};
 use crate::fips;
 use crate::patterns::{self, CryptoPattern};
 
@@ -106,6 +106,11 @@ pub fn scan_project(project_path: &Path, ecosystems: &[String]) -> Vec<CryptoFin
             .and_then(|e| e.to_str())
             .unwrap_or("");
 
+        let file_name = path
+            .file_name()
+            .and_then(|n| n.to_str())
+            .unwrap_or("");
+
         // Read file content
         let content = match fs::read_to_string(path) {
             Ok(c) => c,
@@ -121,7 +126,7 @@ pub fn scan_project(project_path: &Path, ecosystems: &[String]) -> Vec<CryptoFin
         // Match against all applicable patterns
         for pattern in &all_patterns {
             // Check if this pattern applies to the current ecosystem and file extension
-            if !pattern_applies(pattern, ecosystems, extension) {
+            if !pattern_applies(pattern, ecosystems, extension, file_name) {
                 continue;
             }
 
@@ -181,7 +186,7 @@ fn should_skip_path(path: &Path) -> bool {
     skip_dirs.iter().any(|d| path_str.contains(d))
 }
 
-fn pattern_applies(pattern: &CryptoPattern, ecosystems: &[String], file_ext: &str) -> bool {
+fn pattern_applies(pattern: &CryptoPattern, ecosystems: &[String], file_ext: &str, file_name: &str) -> bool {
     // Check ecosystem match
     let ecosystem_match = pattern.ecosystem == "any"
         || ecosystems.iter().any(|e| {
@@ -194,7 +199,18 @@ fn pattern_applies(pattern: &CryptoPattern, ecosystems: &[String], file_ext: &st
     }
 
     // Check file extension match
-    pattern.file_extensions.iter().any(|ext| *ext == file_ext)
+    if pattern.file_extensions.iter().any(|ext| *ext == file_ext) {
+        return true;
+    }
+
+    // For extensionless files (Gemfile, Podfile, Pipfile, etc.), check manifest names
+    if file_ext.is_empty() {
+        return patterns::ecosystem_manifests(pattern.ecosystem)
+            .iter()
+            .any(|m| !m.contains('*') && *m == file_name);
+    }
+
+    false
 }
 
 fn resolve_algorithm(name: &str, _matched_text: &str) -> CryptoAlgorithm {
@@ -277,20 +293,30 @@ fn resolve_algorithm(name: &str, _matched_text: &str) -> CryptoAlgorithm {
     }
 }
 
+fn confidence_rank(c: &Confidence) -> u8 {
+    match c {
+        Confidence::High => 3,
+        Confidence::Medium => 2,
+        Confidence::Low => 1,
+    }
+}
+
 fn deduplicate_findings(findings: Vec<CryptoFinding>) -> Vec<CryptoFinding> {
-    let mut seen: HashSet<String> = HashSet::new();
-    let mut result = Vec::new();
+    let mut best: HashMap<String, CryptoFinding> = HashMap::new();
 
     for finding in findings {
         let key = format!(
             "{}:{}:{}",
             finding.algorithm.name, finding.file_path, finding.line_number
         );
-        if !seen.contains(&key) {
-            seen.insert(key);
-            result.push(finding);
-        }
+        best.entry(key)
+            .and_modify(|existing| {
+                if confidence_rank(&finding.confidence) > confidence_rank(&existing.confidence) {
+                    *existing = finding.clone();
+                }
+            })
+            .or_insert(finding);
     }
 
-    result
+    best.into_values().collect()
 }

src/App/Fossa/Analyze.hs

@@ -132,7 +132,7 @@ import Data.String.Conversion (decodeUtf8, toText)
 import Data.Text.Extra (showT)
 import Data.Traversable (for)
 import Diag.Diagnostic as DI
-import Diag.Result (resultToMaybe)
+import Diag.Result (Result (Failure, Success), resultToMaybe)
 import Discovery.Archive qualified as Archive
 import Discovery.Filters (AllFilters, MavenScopeFilters, applyFilters, filterIsVSIOnly, ignoredPaths, isDefaultNonProductionPath)
 import Discovery.Projects (withDiscoveredProjects)
@@ -143,6 +143,7 @@ import Effect.Logger (
   logDebug,
   logInfo,
   logStdout,
+  logWarn,
   renderIt,
  )
 import Effect.ReadFS (ReadFS)
@@ -420,11 +421,12 @@ analyze cfg = Diag.context "fossa-analyze" $ do
       maybeCbomBytes <-
         Diag.errorBoundaryIO . diagToDebug $
           Diag.context "crypto-cbom-output" . runStickyLogger SevInfo $ analyzeCryptoScanCBOM basedir
-      case join (resultToMaybe maybeCbomBytes) of
-        Just bytes -> do
+      case maybeCbomBytes of
+        Success _ (Just bytes) -> do
           sendIO $ BL.writeFile cbomPath bytes
           logInfo $ "CycloneDX 1.7 CBOM written to: " <> pretty cbomPath
-        Nothing -> logInfo "No crypto findings to write to CBOM file"
+        Success _ Nothing -> logInfo "No crypto findings to write to CBOM file"
+        Failure _ _ -> logWarn "Crypto CBOM generation failed; see diagnostics above"
     Nothing -> pure ()
 
   let -- This makes nice with additionalSourceUnits below, but throws out additional Result data.
@@ -520,11 +522,12 @@ analyze cfg = Diag.context "fossa-analyze" $ do
 
   -- Render FIPS compliance report if requested
   when (Config.cryptoFipsReport cfg) $
-    case join (resultToMaybe maybeCryptoScanResults) of
-      Just cryptoResults -> do
+    case maybeCryptoScanResults of
+      Success _ (Just cryptoResults) -> do
         logInfo ""
         logInfo . renderIt $ renderFipsReport cryptoResults
-      Nothing -> logInfo "No crypto findings for FIPS report"
+      Success _ Nothing -> logInfo "No crypto findings for FIPS report"
+      Failure _ _ -> logWarn "Crypto scan failed; skipping FIPS report"
 
   -- Need to check if vendored is empty as well, even if its a boolean that vendoredDeps exist
   let licenseSourceUnits =

src/App/Fossa/Analyze/ScanSummary.hs

@@ -332,9 +332,9 @@ summarizeProjectScan (SkippedDueToProvidedFilter dpi) = renderDiscoveredProjectI
 summarizeProjectScan (SkippedDueToDefaultFilter dpi) = renderDiscoveredProjectIdentifier dpi <> skippedDueDefaultFilter
 
 summarizeCryptoScan :: Result (Maybe CryptoScanResults) -> [Doc AnsiStyle]
-summarizeCryptoScan (Success _ (Just (CryptoScanResults findings)))
+summarizeCryptoScan (Success wg (Just (CryptoScanResults findings)))
   | not (null findings) =
-      [successColorCoded [] $ listSymbol <> "Crypto Scan" <> ": succeeded"]
+      [successColorCoded wg $ listSymbol <> "Crypto Scan" <> renderSucceeded wg]
         <> itemize ("  " <> listSymbol) renderCryptoFinding findings
   | otherwise = []
 summarizeCryptoScan (Failure _ _) = [failColorCoded $ annotate bold $ listSymbol <> "Crypto Scan" <> renderFailed]

src/App/Fossa/CryptoScan/FipsReport.hs

@@ -47,9 +47,16 @@ compliancePercentage FipsReportStats{..}
   | totalAlgorithms == 0 = 100
   | otherwise = (approvedCount * 100) `div` totalAlgorithms
 
+-- | Dedupe key for algorithm variants — includes parameter set so that
+-- e.g. RSA-2048 and RSA-1024 are counted separately.
+dedupeKey :: CryptoFinding -> (Text, Maybe Text)
+dedupeKey finding =
+  let algo = cryptoFindingAlgorithm finding
+   in (Text.toCaseFold (cryptoAlgorithmName algo), cryptoAlgorithmParameterSet algo)
+
 computeFipsStats :: CryptoScanResults -> FipsReportStats
 computeFipsStats (CryptoScanResults findings) =
-  let uniqueAlgos = nubBy (\a b -> cryptoAlgorithmName (cryptoFindingAlgorithm a) == cryptoAlgorithmName (cryptoFindingAlgorithm b)) findings
+  let uniqueAlgos = nubBy (\a b -> dedupeKey a == dedupeKey b) findings
       statuses = map (cryptoAlgorithmFipsStatus . cryptoFindingAlgorithm) uniqueAlgos
    in FipsReportStats
         { totalAlgorithms = length uniqueAlgos
@@ -62,7 +69,7 @@ computeFipsStats (CryptoScanResults findings) =
 renderFipsReport :: CryptoScanResults -> Doc AnsiStyle
 renderFipsReport results@(CryptoScanResults findings) =
   let stats = computeFipsStats results
-      uniqueFindings = nubBy (\a b -> cryptoAlgorithmName (cryptoFindingAlgorithm a) == cryptoAlgorithmName (cryptoFindingAlgorithm b)) findings
+      uniqueFindings = nubBy (\a b -> dedupeKey a == dedupeKey b) findings
       categorized = categorizeFindings uniqueFindings
    in vsep
         [ annotate bold "FIPS Compliance Report"