Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[BUG] hashes on wrong element #430

Closed
jkowalleck opened this issue Nov 4, 2023 · 0 comments · Fixed by #432
Closed

[BUG] hashes on wrong element #430

jkowalleck opened this issue Nov 4, 2023 · 0 comments · Fixed by #432
Labels
bug Something isn't working good first issue Good for newcomers help wanted Extra attention is needed

Comments

@jkowalleck
Copy link
Member

composer's integrity hash is for the resolved file, not the component in general.

see

cyclonedx-php-composer/src/_internal/MakeBom/Builder.php

Lines 217 to 220 in 09c83c6

$component->getHashes()->set(Enums\HashAlgorithm::SHA_1, $package->getDistSha1Checksum());
$component->getExternalReferences()->addItems(
...self::createExternalReferencesFromPackage($package)
);

solution: to not put the hash on the component,
but on the externalReference that is build from resolved.
@jkowalleck jkowalleck added bug Something isn't working help wanted Extra attention is needed good first issue Good for newcomers labels Nov 4, 2023
@jkowalleck jkowalleck mentioned this issue Nov 5, 2023
Merged
jkowalleck added a commit that referenced this issue Nov 5, 2023
@jkowalleck
fix: component hash scope (#432)
03d69ec 
fixes #430

---------

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working good first issue Good for newcomers help wanted Extra attention is needed
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: component hash scope CycloneDX/cyclonedx-php-composer
1 participant
@jkowalleck