feat(spdx): add SHA-512 hash algorithm support to SPDX serializer #9130

DicksenT · 2025-07-03T10:59:19Z

Description

This PR adds SHA-512 hash algorithm support to the SPDX SBOM serializer.

Specifically, it updates spdxChecksums() in marshal.go to handle the digest.SHA512 case, so Trivy can correctly include SHA-512 checksums in the SPDX output (used in tools like npm sbom). This complements #9126, which already added digest and CycloneDX support.

A unit test was also added to ensure SHA-512 is handled correctly in SPDX.

Related issues

Closes feat: add SHA-512 hash support for SBOM formats (CycloneDX and SPDX) #9094

Related PRs

feat(sbom): add SHA-512 hash support for CycloneDX SBOM #9126

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

CLAassistant · 2025-07-03T10:59:27Z

All committers have signed the CLA.

CLAassistant · 2025-07-03T10:59:27Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

knqyf263

I think we also need to update unmarshaling. #9126 will probably help your understanding.

knqyf263 · 2025-07-03T12:19:59Z

pkg/sbom/spdx/marshal_test.go

@@ -37,6 +38,38 @@ func annotation(t *testing.T, comment string) spdx.Annotation {
 	}
 }

+func Test_spdxChecksums_SHA512(t *testing.T) {


This test doesn't appear to make sense. You can refer to other tests.

you are right, i will remove the additional function

- Added SHA512 case to marshal.go - Added new test case for SHA512 digest in marshal_test.go - Fixed typo in SHA512 algorithm switch

DicksenT · 2025-07-04T15:17:30Z

Hi @knqyf263 ,

I’ve addressed the following:

Fixed the digest.SHA512 typo (was mistakenly written as spdx.SHA512)

Removed the incorrect test case and added the correct one for SHA512 support in SPDX

however, I looked into unmarshal.go as suggested, but I couldn’t find explicit handling for SHA1 or SHA256 there.
Should I add new logic specifically for SHA512, or is the current unmarshal logic expected to cover it already?

knqyf263 · 2025-07-07T06:58:07Z

@DicksenT Could you fix the lint error?
https://trivy.dev/latest/community/contribute/pr/#lint

DicksenT · 2025-07-07T11:01:26Z

on it

DicksenT · 2025-07-08T02:23:17Z

@knqyf263 I've fixed the lint issues. Let me know if there's anything else I should address. Thanks again!

knqyf263 · 2025-07-08T05:33:25Z

Do you mind signing our CLA?
#9130 (comment)

DicksenT · 2025-07-08T05:54:21Z

signed, but somehow there 2 cla in here, one is signed, another one still pending despite i already agreed

knqyf263 · 2025-07-08T06:00:11Z

signed, but somehow there 2 cla in here, one is signed, another one still pending despite i already agreed

No worries. It's correctly recognized that you signed.

knqyf263 · 2025-07-08T12:03:17Z

pkg/sbom/spdx/marshal_test.go

@@ -1448,6 +1448,125 @@ func TestMarshaler_Marshal(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "happy path for SHA512 digest",


Adding a test case specifically for SHA-512 may be excessive. Can we merge this case into the existing case somehow?

i think it's possible, but maybe i need to tweak marshal.go abit(?), or should i create the test in testdata/happy just like how it done in cycloneDx implementation?

but maybe i need to tweak marshal.go a bit(?)

I don't think so. You can just modify the existing case. For example:

trivy/pkg/sbom/spdx/marshal_test.go

Line 441 in b42e7fc

Digest: "md5:483792b8b5f9eb8be7dc4407733118d0",

I’ve added a sha512: Digest to the input report and also updated the PackageChecksums in the expected wantSBOM(both in "happy path for local container scan" test case), but the test fails, is there anything i've missed in the test case implementation?

Why is it failing? What does it say?

hello, is there any update on the issue?

I don't have time to debug it right now.

understandable, should we keep using spesific sha512 test case or you want me keep trying to merge the testcase?

@DmitriyLewen Do you have time to take a look?

simplified the test example for sha512 - 6ee1bc9

DmitriyLewen · 2025-07-17T09:20:51Z

Hello @DicksenT
you also need update unmarshal logic:

trivy/pkg/sbom/spdx/unmarshal.go

Lines 186 to 196 in 72ea4b0

    
           // Files 
        
           // TODO: handle checksums as well 
        
           if path, ok := s.pkgFilePaths[spdxPkg.PackageSPDXIdentifier]; ok { 
        
           	component.Files = []core.File{ 
        
           		{Path: path}, 
        
           	} 
        
           } else if len(spdxPkg.Files) > 0 { 
        
           	component.Files = []core.File{ 
        
           		{Path: spdxPkg.Files[0].FileName}, // Take the first file name 
        
           	} 
        
           }

You need to add testcase (as in https://github.com/aquasecurity/trivy/pull/9126/files#diff-b17fc40bdfbe923285c5951b6ff7243b43dddedfa22eb0a5967d695268096a87).
This test case will help you to update logic.

DicksenT requested review from knqyf263 and DmitriyLewen as code owners July 3, 2025 10:59

knqyf263 reviewed Jul 3, 2025

View reviewed changes

DicksenT force-pushed the feat/add-spdx-sha512 branch 2 times, most recently from c14561b to ca2c4df Compare July 4, 2025 11:09

feat(spdx): add SHA-512 hash algorithm support to SPDX serializer

204a126

- Added SHA512 case to marshal.go - Added new test case for SHA512 digest in marshal_test.go - Fixed typo in SHA512 algorithm switch

DicksenT force-pushed the feat/add-spdx-sha512 branch from ca2c4df to 204a126 Compare July 4, 2025 15:01

DicksenT requested a review from knqyf263 July 4, 2025 17:35

fix(spdx): resolve lint error in marshal_test.go

b42e7fc

knqyf263 reviewed Jul 8, 2025

View reviewed changes

debug: merge testcase for SHA-512 SBOM coverage

360f127

DicksenT requested a review from knqyf263 July 15, 2025 16:03

test: refactor testdata with sha512

6ee1bc9

feat(spdx): add SHA-512 hash algorithm support to SPDX serializer #9130

Are you sure you want to change the base?

feat(spdx): add SHA-512 hash algorithm support to SPDX serializer #9130

Uh oh!

Conversation

DicksenT commented Jul 3, 2025

Description

Related issues

Related PRs

Checklist

Uh oh!

CLAassistant commented Jul 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CLAassistant commented Jul 3, 2025

Uh oh!

knqyf263 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DicksenT commented Jul 4, 2025

Uh oh!

knqyf263 commented Jul 7, 2025

Uh oh!

DicksenT commented Jul 7, 2025

Uh oh!

DicksenT commented Jul 8, 2025

Uh oh!

knqyf263 commented Jul 8, 2025

Uh oh!

DicksenT commented Jul 8, 2025

Uh oh!

knqyf263 commented Jul 8, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen commented Jul 17, 2025

Uh oh!

Uh oh!

CLAassistant commented Jul 3, 2025 •

edited

Loading