Fix incorrect package checksums for Bazel registry dependencies #16

Description

The SBOM generator copies hashes from MODULE.bazel.lock, registryFileHashes of source.json into package checksum(checksumValue) fields.

These values are hashes of the registry JSON files. The archive checksum is stored inside source.json, in its integrity field.

Example:

For boost.config@1.83.0.bcr.4:

• Current SBOM checksum starts with 0a5b… (source.json hash).
• The archive checksum starts with b927….

Analysis results

This affects 18 Boost entries in the inspected reference_integration SBOM. Checking the correct archive against the SBOM therefore gives a checksum mismatch. JSON schema validation does not detect this.

Solution

1. Download source.json and verify its hash against the module lockfile.

2. Read the archive SHA-256 from integrity and use it in SPDX and CycloneDX output. Include the archive download URL and support previously downloaded metadata for offline builds.

Error Occurrence Rate

Reproducible

How to reproduce

Run sbom tool in reference_integration repo.

Supporting Information

No response

Classification

Major

First Affected Release

not released (main)

Last Affected Release

not released (main)

Expected Fixed Release

before release (main)

Category

• Safety Relevant
• Security Relevant