sbom-tool icon indicating copy to clipboard operation
sbom-tool copied to clipboard

FileHasher.HashAlgorithmNames is wrong when generating aggregated SBOM

Open DaveTryon opened this issue 4 months ago • 0 comments

The code in FileHasher.HashAlgorithmNames seems to be incorrect when aggregating. The current code mimics that we do when validating, which uses IConfiguration.HashAlgorithm.Value. That's great when validating incoming SBOMs, but is likely incorrect when we're generating the aggregated SBOM.

My suggestion would be to add a new property to IConfiguration to indicate not just the action mode, but also the action phase. The action mode would be constant throughout the process, but the action phase would change as aggregation moves from validating to generating. The code that currently switches on the action mode would then be updated to switch on the action phase where appropriate.

DaveTryon avatar Aug 15 '25 17:08 DaveTryon