fix: detect integrity hashes sha256 sha384

.github/workflows/npm-ls_demo-results.yml

@@ -19,21 +19,21 @@ jobs:
       fail-fast: false # gather all the results !
       matrix:
         subject:
-          - bundled-dependencies
-          - dev-dependencies
-          - juice-shop
-          - local-dependencies
-          - local-workspaces
+          # - bundled-dependencies
+          # - dev-dependencies
+          # - juice-shop
+          # - local-dependencies
+          # - local-workspaces
           - package-integrity
-          - package-with-build-id
+          # - package-with-build-id
         npm-version:
           ## see https://www.npmjs.com/package/npm?activeTab=versions
           ## see also: https://github.com/npm/cli/releases
           - '10' # https://github.com/npm/cli/releases/tag/v10.0.0-pre.0
-          # - '9'      # Current
-          # - '8'      # Latest
-          # - '7'      # Legacy
-          # - '6'      # Legacy
+          - '9'      # Current
+          - '8'      # Latest
+          - '7'      # Legacy
+          - '6'      # Legacy
         node-version:
           ## action based on https://github.com/actions/node-versions/releases
           ## see also: https://nodejs.org/en/about/releases/

HISTORY.md

@@ -7,11 +7,14 @@ All notable changes to this project will be documented in this file.
 * Fixed
   * SBOM results might have the `externalReferences[].hashes` populated ([#1118] via [#1120])  
     The hashes might have wrongly appeared as `components[].hashes` before.
+  * Components' distribution integrity hash of "sha256" is properly detected and populated in the SBOM result ([#699] via [#1121])
+  * Components' distribution integrity hash of "sha384" is properly detected and populated in the SBOM result ([#699] via [#1121])
 * Misc
   * Raised dependency `@cyclonedx/cyclonedx-library@^6.1.0`, was `@^3||^4||^5||^6` (via [#1120])
 
 [#1118]: https://github.com/CycloneDX/cyclonedx-node-npm/issues/1118
 [#1120]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1120
+[#1121]: https://github.com/CycloneDX/cyclonedx-node-npm/pull/1121
 
 ## 1.14.1 - 2023-09-18
 

demo/package-integrity/README.md

@@ -6,10 +6,21 @@ See [the docs](https://docs.npmjs.com/cli/v9/configuring-npm/package-lock-json#p
 for "integrity":
 > A _sha512_ or _sha1_ [Standard Subresource Integrity](https://w3c.github.io/webappsec/specs/subresourceintegrity/) string for the artifact that was unpacked in this location.
 
+Actually, according to [SSRI spec](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity),
+other algorithms are also possible.
+
+Supported algorithms according to the [SSRI library](https://www.npmjs.com/package/ssri) used by npm:
+- `sha1`
+- `sha256`
+- `sha384`
+- `sha512`
+
 ## remarks
 
-`base64-js` has a _sha1_ integrity in the shipped lock file.
-others have _sha512_ integrity in the lock file.
+`base64-js` has a _sha1_   integrity in the shipped lock file.
+`buffer`    has a _sha384_ integrity in the shipped lock file.
+`ieee754`   has a _sha256_ integrity in the shipped lock file.
+any other   have  _sha512_ integrity in the lock file.
 
 ## output
 
@@ -30,7 +41,7 @@ Output of `npm6 ls --json -a -l` look like this:
     },
     "buffer": {
       "name": "buffer",
-      "_integrity": "sha512-zvj65TkFeIt3i6aj5bIvJDzjjQQGs4o/sNoezg1F1kYap9Nu2jcUdpwzRSJTHMMzG0H7bZkn4rNQpImhuxWX2A==",
+      "_integrity": "sha384-5h1Ji04NR2cbjiY1Shby16SPB3BEtCSWxVGdwPX+AOeweYK1SAjyLLgbJ4mXAAVU",
       // other properties
     }
   }
@@ -52,9 +63,15 @@ Output of `npm7 ls --json -a -l` look like this:
     },
     "buffer": {
       "name": "buffer",
-      "integrity": "sha512-zvj65TkFeIt3i6aj5bIvJDzjjQQGs4o/sNoezg1F1kYap9Nu2jcUdpwzRSJTHMMzG0H7bZkn4rNQpImhuxWX2A==",
+      "integrity": "sha384-5h1Ji04NR2cbjiY1Shby16SPB3BEtCSWxVGdwPX+AOeweYK1SAjyLLgbJ4mXAAVU",
       // other properties
     }
   }
 }
 ```
+
+## notes
+
+calc the hashes
+- online tool: <https://www.srihash.org/>
+- shell: `curl '$URL' |  openssl dgst -binary -sha512 | openssl base64 -A`