feat: generate hashes for other than sha-512

[eviler007]

Describe the bug

This tool can only generate hashes whose integrity is encrypted using sha-512.

To Reproduce

When some dependency is encrypted by sha-1，The SBOM generated by the tool does not contain hashes.

Expected behavior

When some dependency is encrypted by sha-1 or other encryption algorithm，the SBOM generated by the tool can have the correct hashes.

Screenshots or output-paste

Environment

• @cyclonedx/cyclonedx-npm version: 1.11.0
• NPM version: 8.5.5
• Node version: 16.15.0
• OS: windows 10

[eviler007]

@jkowalleck help me!!!

[jkowalleck]

not a bug, but a lack of feature. changed issue type.

@eviler007
could you upload a package.json and a lock file, so I could add them to test scenarios?
Or link a reproducible example project?

I will then add the needed teests.

[eviler007]

not a bug, but a lack of feature. changed issue type.

@eviler007 could you upload a package.json and a lock file, so I could add them to test scenarios? Or link a reproducible example project?

I will then add the needed feature.

package.json

{
  "scripts": {
    "gen": "cyclonedx-bom -l -o ./bom-purl.json",
    "gen:4": "cyclonedx-npm --package-lock-only --omit dev --omit peer --short-PURLs --spec-version 1.3 --mc-type library --output-file ./bom.json"
  },
  "dependencies": {
    "buffer": "^5.4.3",
    "ignore": "^5.1.4",
    "base64-js": "1.0.1"
  }
}

package-lock.json

{
  "name": "cyclonedx-node-test",
  "version": "1.0.0",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
    "": {
      "dependencies": {
        "base64-js": "1.0.1",
        "buffer": "^5.4.3",
        "ignore": "^5.1.4"
      }
    },
    "node_modules/base64-js": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.0.1.tgz",
      "integrity": "sha1-aSbRsZT7xze47tUTdW3i/Np+pAg=",
      "license": "MIT",
      "engines": {
        "node": ">= 0.4"
      }
    },
    "node_modules/buffer": {
      "version": "5.4.3",
      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.4.3.tgz",
      "integrity": "sha512-zvj65TkFeIt3i6aj5bIvJDzjjQQGs4o/sNoezg1F1kYap9Nu2jcUdpwzRSJTHMMzG0H7bZkn4rNQpImhuxWX2A==",
      "license": "MIT",
      "dependencies": {
        "base64-js": "^1.0.2",
        "ieee754": "^1.1.4"
      }
    },
    "node_modules/buffer/node_modules/base64-js": {
      "version": "1.3.1",
      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.3.1.tgz",
      "integrity": "sha512-mLQ4i2QO1ytvGWFWmcngKO//JXAQueZvwEKtjgQFM4jIK0kU+ytMfplL8j+n5mspOfjHwoAg+9yhb7BwAHm36g==",
      "license": "MIT"
    },
    "node_modules/ieee754": {
      "version": "1.1.13",
      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.1.13.tgz",
      "integrity": "sha512-4vf7I2LYV/HaWerSo3XmlMkp5eZ83i+/CDluXi/IGTs/O1sejBNhTtnxzmRZfvOUqj7lZjqHkeTvpgSFDlWZTg==",
      "license": "BSD-3-Clause"
    },
    "node_modules/ignore": {
      "version": "5.1.4",
      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.1.4.tgz",
      "integrity": "sha512-MzbUSahkTW1u7JpKKjY7LCARd1fU5W2rLdxlM4kdkayuCwZImjkpluF9CM1aLewYJguPDqewLam18Y6AU69A8A==",
      "license": "MIT",
      "engines": {
        "node": ">= 4"
      }
    }
  },
  "dependencies": {
    "base64-js": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.0.1.tgz",
      "integrity": "sha1-aSbRsZT7xze47tUTdW3i/Np+pAg="
    },
    "buffer": {
      "version": "5.4.3",
      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.4.3.tgz",
      "integrity": "sha512-zvj65TkFeIt3i6aj5bIvJDzjjQQGs4o/sNoezg1F1kYap9Nu2jcUdpwzRSJTHMMzG0H7bZkn4rNQpImhuxWX2A==",
      "requires": {
        "base64-js": "^1.0.2",
        "ieee754": "^1.1.4"
      },
      "dependencies": {
        "base64-js": {
          "version": "1.3.1",
          "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.3.1.tgz",
          "integrity": "sha512-mLQ4i2QO1ytvGWFWmcngKO//JXAQueZvwEKtjgQFM4jIK0kU+ytMfplL8j+n5mspOfjHwoAg+9yhb7BwAHm36g=="
        }
      }
    },
    "ieee754": {
      "version": "1.1.13",
      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.1.13.tgz",
      "integrity": "sha512-4vf7I2LYV/HaWerSo3XmlMkp5eZ83i+/CDluXi/IGTs/O1sejBNhTtnxzmRZfvOUqj7lZjqHkeTvpgSFDlWZTg=="
    },
    "ignore": {
      "version": "5.1.4",
      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.1.4.tgz",
      "integrity": "sha512-MzbUSahkTW1u7JpKKjY7LCARd1fU5W2rLdxlM4kdkayuCwZImjkpluF9CM1aLewYJguPDqewLam18Y6AU69A8A=="
    }
  }
}

[jkowalleck]

current hash detection:

cyclonedx-node-npm/src/builders.ts

Lines 348 to 356 in eed046b

	/**
	* base64 over 512 bit => 86 chars + 2 chars padding.
	* base64 alphabet: `A-Za-a+/` and `=` for padding
	* examples:
	* - sha512-EYuhVinaPQ2QMvF+SXUOxKpwmMp5rZxHQVHhuMfwhdSIjkwX+F8f+R/b0gyvZXc7eGu5qJJgOOmtR2likwgcFg==
	* - sha512-DXUS22Y57/LAFSg3x7Vi6RNAuLpTXwxB9S2nIA7msBb/Zt8p7XqMwdpdc1IU7CkOQUPgAqR5fWvxuKCbneKGmA==
	* - sha512-5BejraMXMC+2UjefDvrH0Fo/eLwZRV6859SXRg+FgbhA0R0l6lDqDGAQYhKbXhPN2ofk2kY5sgGyLNL907UXpA==
	*/
	private readonly hashRE_sha512_base64 = /^sha512-([a-z0-9+/]{86}==)$/i

@eviler007 are you interested in developing the missing feature?
PullRequests are welcome, please follow https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/CONTRIBUTING.md
If so, please let me know, so I could add the needed test scenarios for you - see #725

[jkowalleck]

some docs: https://docs.npmjs.com/cli/v9/configuring-npm/package-lock-json#packages

integrity: A sha512 or sha1 Standard Subresource Integrity string for the artifact that was unpacked in this location.

see https://github.com/CycloneDX/cyclonedx-node-npm/tree/main/demo/package-integrity#readme

[jkowalleck]

I will implement a solution for this.