Skip to content

FileHasher.HashAlgorithmNames is wrong when generating aggregated SBOM #1159

@DaveTryon

Description

@DaveTryon

The code in FileHasher.HashAlgorithmNames seems to be incorrect when aggregating. The current code mimics that we do when validating, which uses IConfiguration.HashAlgorithm.Value. That's great when validating incoming SBOMs, but is likely incorrect when we're generating the aggregated SBOM.

My suggestion would be to add a new property to IConfiguration to indicate not just the action mode, but also the action phase. The action mode would be constant throughout the process, but the action phase would change as aggregation moves from validating to generating. The code that currently switches on the action mode would then be updated to switch on the action phase where appropriate.

Metadata

Metadata

Assignees

No one assigned

    Labels

    acceptedWe are working on this and hope to release it into the product

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions