feat(spdx): add SHA-512 hash algorithm support to SPDX serializer (aquasecurity#10719)

Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>

Author: DicksenT

pkg/sbom/core/bom.go

@@ -199,6 +199,10 @@ type File struct {
 	Digests []digest.Digest
 }
 
+func (f File) IsEmpty() bool {
+	return f.Path == "" && len(f.Digests) == 0
+}
+
 type Property struct {
 	Name      string
 	Value     string

pkg/sbom/cyclonedx/unmarshal.go

@@ -273,6 +273,7 @@ func (b *BOM) unmarshalHashes(hashes *[]cdx.Hash) []digest.Digest {
 			alg = digest.MD5
 		default:
 			log.Warn("Unsupported hash algorithm", log.String("algorithm", string(h.Algorithm)))
+			continue
 		}
 		digests = append(digests, digest.NewDigestFromString(alg, h.Value))
 	}

pkg/sbom/io/decode.go

@@ -218,7 +218,7 @@ func (m *Decoder) decodePackage(ctx context.Context, c *core.Component) (*ftypes
 			pkg.FilePath = f.Path
 		}
 		// An empty path represents a package digest
-		if f.Path == "" && len(f.Digests) > 0 {
+		if len(f.Digests) > 0 {
 			pkg.Digest = f.Digests[0]
 		}
 	}

pkg/sbom/spdx/marshal.go

@@ -507,10 +507,13 @@ func (m *Marshaler) spdxChecksums(digests []digest.Digest) []common.Checksum {
 			alg = spdx.SHA1
 		case digest.SHA256:
 			alg = spdx.SHA256
+		case digest.SHA512:
+			alg = spdx.SHA512
 		case digest.MD5:
 			alg = spdx.MD5
 		default:
-			return nil
+			m.logger.Warn("Unsupported hash algorithm", log.String("algorithm", string(alg)))
+			continue
 		}
 		checksums = append(checksums, spdx.Checksum{
 			Algorithm: alg,

pkg/sbom/spdx/marshal_test.go

@@ -488,7 +488,7 @@ func TestMarshaler_Marshal(t *testing.T) {
 									DiffID: "sha256:ccb64cf0b7ba2e50741d0b64cae324eb5de3b1e2f580bbf177e721b67df38488",
 								},
 								FilePath: "tools/project-doe/specifications/actionpack.gemspec",
-								Digest:   "sha1:413f98442c83808042b5d1d2611a346b999bdca5",
+								Digest:   "sha512:bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a", // Changed for tests
 							},
 						},
 					},
@@ -577,7 +577,7 @@ func TestMarshaler_Marshal(t *testing.T) {
 						PackageSupplier:       &spdx.Supplier{Supplier: tspdx.PackageSupplierNoAssertion},
 						FilesAnalyzed:         true,
 						PackageVerificationCode: &spdx.PackageVerificationCode{
-							Value: "688d98e7e5660b879fd1fc548af8c0df3b7d785a",
+							Value: "da39a3ee5e6b4b0d3255bfef95601890afd80709",
 						},
 					},
 					{
@@ -625,8 +625,8 @@ func TestMarshaler_Marshal(t *testing.T) {
 						FileName:           "tools/project-doe/specifications/actionpack.gemspec",
 						Checksums: []spdx.Checksum{
 							{
-								Algorithm: spdx.SHA1,
-								Value:     "413f98442c83808042b5d1d2611a346b999bdca5",
+								Algorithm: spdx.SHA512,
+								Value:     "bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a",
 							},
 						},
 					},
@@ -678,7 +678,6 @@ func TestMarshaler_Marshal(t *testing.T) {
 						Relationship: "CONTAINS",
 					},
 				},
-
 				OtherLicenses: nil,
 				Annotations:   nil,
 				Reviews:       nil,

pkg/sbom/spdx/testdata/happy/package-hashes.json

@@ -0,0 +1,37 @@
+{
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "creationInfo": {
+    "created": "2022-09-12T17:02:46.826609Z",
+    "creators": [
+      "Tool: trivy-dev",
+      "Organization: aquasecurity"
+    ]
+  },
+  "dataLicense": "CC0-1.0",
+  "documentNamespace": "http://trivy.dev/container/meven-test-project-eb7a0384-b04a-4fc6-8afb-1662fe59ca79",
+  "name": "maven-test-projecct",
+  "packages": [
+    {
+      "SPDXID": "SPDXRef-Package-lodash-4.17.21",
+      "name": "lodash",
+      "versionInfo": "4.17.21",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceLocator": "pkg:npm/lodash@4.17.21",
+          "referenceType": "purl"
+        }
+      ],
+      "filesAnalyzed": false,
+      "licenseConcluded": "MIT",
+      "licenseDeclared": "MIT",
+      "checksums": [
+        {
+          "algorithm": "SHA512",
+          "checksumValue": "bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a"
+        }
+      ]
+    }
+  ],
+  "spdxVersion": "SPDX-2.3"
+}

pkg/sbom/spdx/unmarshal.go

@@ -14,14 +14,16 @@ import (
 	"github.com/spdx/tools-golang/tagvalue"
 	"golang.org/x/xerrors"
 
+	"github.com/aquasecurity/trivy/pkg/digest"
+	"github.com/aquasecurity/trivy/pkg/log"
 	"github.com/aquasecurity/trivy/pkg/sbom/core"
 )
 
 type SPDX struct {
 	*core.BOM
 
-	trivySBOM    bool
-	pkgFilePaths map[common.ElementID]string
+	trivySBOM bool
+	pkgFiles  map[common.ElementID]core.File
 }
 
 func NewTVDecoder(r io.Reader) *TVDecoder {
@@ -68,8 +70,8 @@ func (s *SPDX) UnmarshalJSON(b []byte) error {
 func (s *SPDX) unmarshal(spdxDocument *spdx.Document) error {
 	s.trivySBOM = s.isTrivySBOM(spdxDocument)
 
-	if s.pkgFilePaths == nil {
-		s.pkgFilePaths = make(map[common.ElementID]string)
+	if s.pkgFiles == nil {
+		s.pkgFiles = make(map[common.ElementID]core.File)
 	}
 
 	// Parse files and find file paths for packages
@@ -125,7 +127,10 @@ func (s *SPDX) parseFiles(spdxDocument *spdx.Document) {
 			if ok {
 				// Save filePaths for packages
 				// Insert filepath will be later
-				s.pkgFilePaths[rel.RefA.ElementRefID] = file.FileName
+				s.pkgFiles[rel.RefA.ElementRefID] = core.File{
+					Path:    file.FileName,
+					Digests: s.unmarshalChecksums(file.Checksums),
+				}
 			}
 			continue
 		}
@@ -184,15 +189,24 @@ func (s *SPDX) parsePackage(spdxPkg spdx.Package) (*core.Component, error) {
 	}
 
 	// Files
-	// TODO: handle checksums as well
-	if path, ok := s.pkgFilePaths[spdxPkg.PackageSPDXIdentifier]; ok {
-		component.Files = []core.File{
-			{Path: path},
-		}
+	var file core.File
+	// Take filePath + digest from Files components
+	if f, ok := s.pkgFiles[spdxPkg.PackageSPDXIdentifier]; ok {
+		file = f
+		// Take filePath + digest from Package.Files (old format)
 	} else if len(spdxPkg.Files) > 0 {
-		component.Files = []core.File{
-			{Path: spdxPkg.Files[0].FileName}, // Take the first file name
+		spdxFile := spdxPkg.Files[0] // Take the first file name
+		file = core.File{
+			Path:    spdxFile.FileName,
+			Digests: s.unmarshalChecksums(spdxFile.Checksums),
 		}
+		// Take digest from Package.Checksums
+	} else if len(spdxPkg.PackageChecksums) > 0 {
+		file.Digests = s.unmarshalChecksums(spdxPkg.PackageChecksums)
+	}
+
+	if !file.IsEmpty() {
+		component.Files = append(component.Files, file)
 	}
 
 	// Trivy stores properties in Annotations
@@ -232,6 +246,31 @@ func (s *SPDX) parsePackage(spdxPkg spdx.Package) (*core.Component, error) {
 	return component, nil
 }
 
+func (s *SPDX) unmarshalChecksums(checksums []spdx.Checksum) []digest.Digest {
+	if checksums == nil {
+		return nil
+	}
+	var digests []digest.Digest
+	for _, h := range checksums {
+		var alg digest.Algorithm
+		switch h.Algorithm {
+		case common.SHA1:
+			alg = digest.SHA1
+		case common.SHA256:
+			alg = digest.SHA256
+		case common.SHA512:
+			alg = digest.SHA512
+		case common.MD5:
+			alg = digest.MD5
+		default:
+			log.Warn("Unsupported hash algorithm", log.String("algorithm", string(h.Algorithm)))
+			continue
+		}
+		digests = append(digests, digest.NewDigestFromString(alg, h.Value))
+	}
+	return digests
+}
+
 func (s *SPDX) parseType(pkg spdx.Package) core.ComponentType {
 	id := string(pkg.PackageSPDXIdentifier)
 	switch {

pkg/sbom/spdx/unmarshal_test.go

@@ -200,6 +200,7 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
 									},
 								},
 								FilePath: "node_modules/yargs-parser/package.json",
+								Digest:   "sha1:69e70ec702f9df4ff64024b5fdea4644f1ce6c97",
 							},
 						},
 					},
@@ -227,6 +228,7 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
 									},
 								},
 								FilePath: "node_modules/yargs-parser/package.json",
+								Digest:   "sha1:69e70ec702f9df4ff64024b5fdea4644f1ce6c97",
 							},
 						},
 					},
@@ -286,6 +288,7 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
 								Name:     "co.elastic.apm:apm-agent",
 								Version:  "1.36.0",
 								FilePath: "modules/apm/elastic-apm-agent-1.36.0.jar",
+								Digest:   "sha1:d2a9ad9b159eb650d25add9395c4f4198f200066",
 								Identifier: ftypes.PkgIdentifier{
 									PURL: &packageurl.PackageURL{
 										Type:      packageurl.TypeMaven,
@@ -300,6 +303,7 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
 								Name:     "co.elastic.apm:apm-agent-cached-lookup-key",
 								Version:  "1.36.0",
 								FilePath: "modules/apm/elastic-apm-agent-1.36.0.jar",
+								Digest:   "sha1:d2a9ad9b159eb650d25add9395c4f4198f200066",
 								Identifier: ftypes.PkgIdentifier{
 									PURL: &packageurl.PackageURL{
 										Type:      packageurl.TypeMaven,
@@ -341,6 +345,33 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
 			inputFile: "testdata/sad/invalid-purl.json",
 			wantErr:   "purl is missing type or name",
 		},
+		{
+			name:      "happy path package with hash",
+			inputFile: "testdata/happy/package-hashes.json",
+			want: types.SBOM{
+				Applications: []ftypes.Application{
+					{
+						Type: ftypes.NodePkg,
+						Packages: ftypes.Packages{
+							{
+								ID:       "lodash@4.17.21",
+								Name:     "lodash",
+								Version:  "4.17.21",
+								Licenses: []string{"MIT"},
+								Identifier: ftypes.PkgIdentifier{
+									PURL: &packageurl.PackageURL{
+										Type:    packageurl.TypeNPM,
+										Name:    "lodash",
+										Version: "4.17.21",
+									},
+								},
+								Digest: "sha512:bf690311ee7b95e713ba568322e3533f2dd1cb880b189e99d4edef13592b81764daec43e2c54c61d5c558dc5cfb35ecb85b65519e74026ff17675b6f8f916f4a",
+							},
+						},
+					},
+				},
+			},
+		},
 	}
 
 	for _, tt := range tests {