@trustify-da/trustify-da-javascript-client 0.3.0-ea.61444d4 → 0.3.0-ea.62b88e5

package/dist/src/providers/java_gradle.js

@@ -12,8 +12,8 @@ import Base_java, { ecosystem_gradle } from "./base_java.js";
 /** @typedef {import('../provider.js').Provider} */
 /** @typedef {import('../provider.js').Provided} Provided */
 const ROOT_PROJECT_KEY_NAME = "root-project";
-const TRUSTIFY_DA_IGNORE_REGEX_LINE = /.*\s?exhortignore\s*$/g;
-const TRUSTIFY_DA_IGNORE_REGEX = /\/\/\s?exhortignore/;
+const TRUSTIFY_DA_IGNORE_REGEX_LINE = /.*\s?(exhortignore|trustify-da-ignore)\s*$/g;
+const TRUSTIFY_DA_IGNORE_REGEX = /\/\/\s?(exhortignore|trustify-da-ignore)/;
 /**
  * Check if the dependency marked for exclusion has libs notation , so if it's true the rest of coordinates( GAV) should be fetched from TOML file.
  * @param {string} depToBeIgnored
@@ -59,7 +59,6 @@ export default class Java_gradle extends Base_java {
      * @param {string} manifestPath - path to manifest
      * @returns {null}
      */
-    // eslint-disable-next-line no-unused-vars
     readLicenseFromManifest(manifestPath) { return readLicenseFile(manifestPath); }
     /**
      * Provide content and content type for stack analysis.
@@ -67,10 +66,10 @@ export default class Java_gradle extends Base_java {
      * @param {{}} [opts={}] - optional various options to pass along the application
      * @returns {Provided}
      */
-    provideStack(manifest, opts = {}) {
+    async provideStack(manifest, opts = {}) {
         return {
             ecosystem: ecosystem_gradle,
-            content: this.#createSbomStackAnalysis(manifest, opts),
+            content: await this.#createSbomStackAnalysis(manifest, opts),
             contentType: 'application/vnd.cyclonedx+json'
         };
     }
@@ -80,10 +79,10 @@ export default class Java_gradle extends Base_java {
      * @param {{}} [opts={}] - optional various options to pass along the application
      * @returns {Provided}
      */
-    provideComponent(manifest, opts = {}) {
+    async provideComponent(manifest, opts = {}) {
         return {
             ecosystem: ecosystem_gradle,
-            content: this.#getSbomForComponentAnalysis(manifest, opts),
+            content: await this.#getSbomForComponentAnalysis(manifest, opts),
             contentType: 'application/vnd.cyclonedx+json'
         };
     }
@@ -133,9 +132,10 @@ export default class Java_gradle extends Base_java {
      * @param {Sbom} sbom - the SBOM object to add dependencies to
      * @param {Set} processedDeps - set of already processed dependencies
      * @param {string} scope - the dependency scope
+     * @param {Map<string, Array<{alg: string, content: string}>>} [hashMap] - map of "group:name@version" to CycloneDX hashes
      * @private
      */
-    #processDependencyTree(config, parentPurl, sbom, processedDeps, scope) {
+    #processDependencyTree(config, parentPurl, sbom, processedDeps, scope, hashMap) {
         const processedLines = this.#prepareLinesForParsingDependencyTree(config);
         let parentStack = [parentPurl];
         for (const { line, depth } of processedLines) {
@@ -153,12 +153,18 @@ export default class Java_gradle extends Base_java {
                 // Add dependency to SBOM if not already processed
                 if (!processedDeps.has(depKey)) {
                     processedDeps.add(depKey);
-                    sbom.addDependency(currentParent, purl, scope);
+                    sbom.addDependency(currentParent, purl, scope, hashMap?.get(purl.toString()));
                 }
                 parentStack.push(purl);
             }
         }
     }
+    #buildRootCoordinate(properties) {
+        const group = properties.group || 'unknown';
+        const version = properties.version || '0.0.0';
+        const rootName = properties[ROOT_PROJECT_KEY_NAME]?.match(/Root project '(.+)'/)?.[1] || 'unknown';
+        return `${group}:${rootName}:jar:${version}`;
+    }
     /**
      * Create a Dot Graph dependency tree for a manifest path.
      * @param {string} manifest - path for pom.xml
@@ -166,17 +172,17 @@ export default class Java_gradle extends Base_java {
      * @returns {string} the Dot Graph content
      * @private
      */
-    #buildSbom(content, properties, manifestPath, opts = {}) {
+    #buildSbom(content, properties, manifestPath, opts = {}, hashMap) {
         let sbom = new Sbom();
-        let root = `${properties.group}:${properties[ROOT_PROJECT_KEY_NAME].match(/Root project '(.+)'/)[1]}:jar:${properties.version}`;
+        let root = this.#buildRootCoordinate(properties);
         let rootPurl = this.parseDep(root);
         const license = this.readLicenseFromManifest(manifestPath);
         sbom.addRoot(rootPurl, license);
         let ignoredDeps = this.#getIgnoredDeps(manifestPath);
         const [runtimeConfig, compileConfig] = this.#extractConfigurations(content);
         const processedDeps = new Set();
-        this.#processDependencyTree(runtimeConfig, rootPurl, sbom, processedDeps, 'required');
-        this.#processDependencyTree(compileConfig, rootPurl, sbom, processedDeps, 'optional');
+        this.#processDependencyTree(runtimeConfig, rootPurl, sbom, processedDeps, 'required', hashMap);
+        this.#processDependencyTree(compileConfig, rootPurl, sbom, processedDeps, 'optional', hashMap);
         return sbom.filterIgnoredDepsIncludingVersion(ignoredDeps).getAsJsonString(opts);
     }
     /**
@@ -186,14 +192,15 @@ export default class Java_gradle extends Base_java {
      * @returns {string} the Dot Graph content
      * @private
      */
-    #createSbomStackAnalysis(manifest, opts = {}) {
+    async #createSbomStackAnalysis(manifest, opts = {}) {
         let content = this.#getDependencies(manifest, opts);
         let properties = this.#extractProperties(manifest, opts);
+        let hashMap = await this.parseGradleHashes(manifest, opts);
         // read dependency tree from temp file
         if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
             console.log("Dependency tree that will be used as input for creating the BOM =>" + EOL + EOL + content);
         }
-        let sbom = this.#buildSbom(content, properties, manifest, opts);
+        let sbom = this.#buildSbom(content, properties, manifest, opts, hashMap);
         return sbom;
     }
     /**
@@ -238,10 +245,11 @@ export default class Java_gradle extends Base_java {
      * @returns {string} - sbom string of the direct dependencies of build.gradle
      * @private
      */
-    #getSbomForComponentAnalysis(manifestPath, opts = {}) {
+    async #getSbomForComponentAnalysis(manifestPath, opts = {}) {
         let content = this.#getDependencies(manifestPath, opts);
         let properties = this.#extractProperties(manifestPath, opts);
-        let sbom = this.#buildDirectDependenciesSbom(content, properties, manifestPath, opts);
+        let hashMap = await this.parseGradleHashes(manifestPath, opts);
+        let sbom = this.#buildDirectDependenciesSbom(content, properties, manifestPath, opts, hashMap);
         return sbom;
     }
     /**
@@ -260,6 +268,112 @@ export default class Java_gradle extends Base_java {
             throw new Error(`Couldn't run gradle dependencies command, error message returned from gradle binary => ${EOL} ${error.message}`);
         }
     }
+    /**
+     * Hash a file using SHA-256 with streaming to handle large files efficiently.
+     * @param {string} filePath - path to the file to hash
+     * @returns {Promise<string>} hex-encoded SHA-256 digest
+     * @private
+     */
+    #hashFileStream(filePath) {
+        return new Promise((resolve, reject) => {
+            const hash = crypto.createHash('sha256');
+            const stream = fs.createReadStream(filePath);
+            stream.on('data', chunk => hash.update(chunk));
+            stream.on('end', () => resolve(hash.digest('hex')));
+            stream.on('error', reject);
+        });
+    }
+    /**
+     * Compute SHA-256 hashes for the resolved artifacts of a Gradle manifest.
+     *
+     * Rather than scanning the local Gradle cache, this asks Gradle itself for
+     * the resolved artifact files via an init script (mirroring the pattern used
+     * by {@link discoverGradleSubprojects}), then hashes each file with the
+     * Node.js `crypto` module. The result is keyed by the canonical PURL string
+     * built via {@link Base_java#toPurl} — the same builder {@link parseDep} uses
+     * for the lookup — so the stored key and the lookup key cannot drift.
+     *
+     * Degrades gracefully: if Gradle cannot be invoked, the init script fails, or
+     * an artifact has no readable file (e.g. BOM/`platform()` dependencies), the
+     * hash for that component is omitted rather than throwing. A warning is emitted
+     * on every degradation path so incomplete hash coverage is visible even without
+     * `TRUSTIFY_DA_DEBUG` (mirroring the pip/cargo providers).
+     *
+     * @param {string} manifest - path to build.gradle[.kts]
+     * @param {{}} [opts={}] - optional various options to pass along the application
+     * @returns {Promise<Map<string, Array<{alg: string, content: string}>>>} map of canonical PURL string to CycloneDX hashes
+     */
+    async parseGradleHashes(manifest, opts = {}) {
+        const hashMap = new Map();
+        const debug = process.env["TRUSTIFY_DA_DEBUG"] === "true";
+        let gradle;
+        try {
+            gradle = this.selectToolBinary(manifest, opts);
+        }
+        catch (error) {
+            console.warn(`Gradle could not be invoked to compute artifact hashes, SBOM will be generated without hashes: ${error.stack || error.message}`);
+            return hashMap;
+        }
+        const initScriptPath = path.join(os.tmpdir(), `da-list-hashes-${crypto.randomUUID()}.gradle`);
+        try {
+            fs.writeFileSync(initScriptPath, GRADLE_HASH_INIT_SCRIPT);
+            let output;
+            try {
+                output = this._invokeCommand(gradle, [
+                    '-q', '--no-daemon',
+                    '--init-script', initScriptPath,
+                    'daListHashes',
+                ], { cwd: path.dirname(manifest) });
+            }
+            catch (error) {
+                console.warn(`Gradle hash init script failed, SBOM will be generated without hashes: ${error.stack || error.message}`);
+                return hashMap;
+            }
+            let attempted = 0;
+            let missed = 0;
+            for (const { id, file } of parseGradleHashScriptOutput(output.toString())) {
+                const coord = parseComponentId(id);
+                if (!coord) {
+                    continue;
+                }
+                // Build the key with the same canonical PURL builder parseDep uses for
+                // the lookup, so the stored key and the lookup key cannot drift.
+                const key = this.toPurl(coord.group, coord.name, coord.version).toString();
+                if (hashMap.has(key)) {
+                    continue;
+                }
+                attempted++;
+                try {
+                    const digest = await this.#hashFileStream(file);
+                    hashMap.set(key, [{ alg: 'SHA-256', content: digest }]);
+                }
+                catch (error) {
+                    // artifact file missing/unreadable — omit the hash for this component
+                    missed++;
+                    if (debug) {
+                        console.error(`Gradle hash: could not read artifact ${file} => ${error.message}`);
+                    }
+                }
+            }
+            if (missed > 0) {
+                console.warn(`Gradle hash: ${missed} of ${attempted} resolved artifacts could not be read, SBOM will be generated without hashes for those components`);
+            }
+        }
+        catch (error) {
+            // Unexpected failure (e.g. a programming error) is degraded to keep SBOM
+            // generation working, but the error is surfaced so it is not mistaken
+            // for ordinary graceful degradation.
+            console.warn(`Gradle artifact hashing failed, SBOM will be generated without hashes: ${error.stack || error.message}`);
+            return hashMap;
+        }
+        finally {
+            try {
+                fs.unlinkSync(initScriptPath);
+            }
+            catch { /* ignore */ }
+        }
+        return hashMap;
+    }
     /**
      * Extracts runtime and compile configurations from the dependency tree
      * @param {string} content - the dependency tree content
@@ -307,9 +421,9 @@ export default class Java_gradle extends Base_java {
      * @param properties {Object} - properties of the gradle project.
      * @return {string} return sbom json string of the build.gradle manifest file
      */
-    #buildDirectDependenciesSbom(content, properties, manifestPath, opts = {}) {
+    #buildDirectDependenciesSbom(content, properties, manifestPath, opts = {}, hashMap) {
         let sbom = new Sbom();
-        let root = `${properties.group}:${properties[ROOT_PROJECT_KEY_NAME].match(/Root project '(.+)'/)[1]}:jar:${properties.version}`;
+        let root = this.#buildRootCoordinate(properties);
         let rootPurl = this.parseDep(root);
         const license = this.readLicenseFromManifest(manifestPath);
         sbom.addRoot(rootPurl, license);
@@ -321,7 +435,7 @@ export default class Java_gradle extends Base_java {
         directDependencies.forEach((scope, dep) => {
             const purl = this.parseDep(dep);
             purl.scope = scope;
-            sbom.addDependency(rootPurl, purl, scope);
+            sbom.addDependency(rootPurl, purl, scope, hashMap?.get(purl.toString()));
         });
         return sbom.filterIgnoredDepsIncludingVersion(ignoredDeps).getAsJsonString(opts);
     }
@@ -424,6 +538,29 @@ const GRADLE_INIT_SCRIPT = `allprojects {
     }
 }
 `;
+/**
+ * Gradle init script that emits, per resolved module artifact, a structured line
+ * of the form `::DA_HASH::group:name:version::/absolute/file/path`. It obtains
+ * files from Gradle's resolution API (the same approach as the CycloneDX Gradle
+ * plugin) so it is robust to cache-layout changes and correctly reports
+ * classifiers and non-jar artifacts. Uses a lenient artifact view so
+ * unresolved/fileless artifacts are skipped rather than failing the build.
+ */
+const GRADLE_HASH_INIT_SCRIPT = `allprojects {
+    task daListHashes {
+        doLast {
+            configurations.findAll { it.canBeResolved }.each { cfg ->
+                cfg.incoming.artifactView { lenient = true }.artifacts.each { artifact ->
+                    def cid = artifact.id.componentIdentifier
+                    if (cid instanceof org.gradle.api.artifacts.component.ModuleComponentIdentifier) {
+                        println "::DA_HASH::\${cid.group}:\${cid.module}:\${cid.version}::\${artifact.file.absolutePath}"
+                    }
+                }
+            }
+        }
+    }
+}
+`;
 /**
  * Discover all build.gradle[.kts] manifest paths in a Gradle multi-project build.
  * Uses a custom init script to get structured project listing.
@@ -521,3 +658,50 @@ export function parseGradleInitScriptOutput(raw) {
     }
     return projects;
 }
+/**
+ * Parse the structured output from the Gradle hash init script.
+ * Each recognised line has the form `::DA_HASH::group:name:version::<file-path>`.
+ *
+ * @param {string} raw - Raw stdout from gradle
+ * @returns {{ id: string, file: string }[]} component id (`group:name:version`) and absolute artifact file path
+ */
+export function parseGradleHashScriptOutput(raw) {
+    const artifacts = [];
+    for (const rawLine of raw.split('\n')) {
+        const line = rawLine.trimEnd();
+        if (!line.startsWith('::DA_HASH::')) {
+            continue;
+        }
+        const prefix = '::DA_HASH::';
+        const remainder = line.substring(prefix.length);
+        const lastSep = remainder.lastIndexOf('::');
+        if (lastSep < 0) {
+            continue;
+        }
+        const id = remainder.substring(0, lastSep);
+        const file = remainder.substring(lastSep + 2);
+        if (id && file) {
+            artifacts.push({ id, file });
+        }
+    }
+    return artifacts;
+}
+/**
+ * Parse a Gradle module component id (`group:name:version`) into its coordinate
+ * parts. The caller builds the canonical PURL key from these parts using the same
+ * builder {@link parseDep} uses, so the stored key and the lookup key cannot drift.
+ *
+ * @param {string} id - the Gradle component id
+ * @returns {{group: string, name: string, version: string}|null} the parsed coordinate, or null when the id is malformed
+ */
+export function parseComponentId(id) {
+    const parts = id.split(':');
+    if (parts.length < 3) {
+        return null;
+    }
+    const [group, name, version] = parts;
+    if (!group || !name || !version) {
+        return null;
+    }
+    return { group, name, version };
+}

package/dist/src/providers/java_maven.d.ts

@@ -6,11 +6,11 @@
  * @returns {Promise<string[]>} Paths to pom.xml files (absolute)
  */
 export function discoverMavenModules(workspaceRoot: string, opts?: object): Promise<string[]>;
-/** @typedef {import('../provider').Provider} */
-/** @typedef {import('../provider').Provided} Provided */
-/** @typedef {{name: string, version: string}} Package */
-/** @typedef {{groupId: string, artifactId: string, version: string, scope: string, ignore: boolean}} Dependency */
 export default class Java_maven extends Base_java {
+    /** @type {Object<string, string>} Packaging types that produce .jar files despite non-jar packaging names. */
+    static PACKAGING_TO_JAR: {
+        [x: string]: string;
+    };
     constructor();
     /**
      * @param {string} manifestName - the subject manifest name-type
@@ -25,9 +25,9 @@ export default class Java_maven extends Base_java {
      * Provide content and content type for maven-maven stack analysis.
      * @param {string} manifest - the manifest path or name
      * @param {{}} [opts={}] - optional various options to pass along the application
-     * @returns {Provided}
+     * @returns {Promise<Provided>}
      */
-    provideStack(manifest: string, opts?: {}): Provided;
+    provideStack(manifest: string, opts?: {}): Promise<Provided>;
     /**
      * Provide content and content type for maven-maven component analysis.
      * @param {string} manifest - path to the manifest file
@@ -42,16 +42,36 @@ export default class Java_maven extends Base_java {
      */
     readLicenseFromManifest(manifestPath: string): string | null;
     /**
+     * Build a Map of PURL string → CycloneDX hash entries by reading artifact files from the local Maven repository.
+     *
+     * Both the artifact file path and the hash-map key are derived from the
+     * shared {@link Base_java#parseCoordinate} parser: the file path uses the
+     * resolved version and raw classifier, while the key uses the same canonical
+     * PURL builder as {@link Base_java#parseDep}. This guarantees the key always
+     * matches the PURL that {@link Base_java#parseDependencyTree} looks up.
      *
+     * @param {string} depTreeText Raw dependency tree text from mvn dependency:tree
+     * @param {{}} [opts={}] Options bag (may contain TRUSTIFY_DA_MVN_REPO)
+     * @returns {Promise<Map<string, Array<{alg: string, content: string}>>>}
+     */
+    _buildMavenHashMap(depTreeText: string, opts?: {}): Promise<Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>>;
+    /**
      * @param {String} textGraphList Text graph String of the manifest
      * @param {[String]} ignoredDeps List of ignored dependencies to be omitted from sbom
+     * @param {{}} opts Options
      * @param {String} manifestPath Path to the pom.xml manifest
+     * @param {Map<string, Array<{alg: string, content: string}>>} [hashMap] PURL→hashes map
      * @return {String} formatted sbom Json String with all dependencies
      */
-    createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: any, manifestPath: string): string;
+    createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: {}, manifestPath: string, hashMap?: Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>): string;
     #private;
 }
-export type Java_maven = any;
 export type Provided = any;
 export type Package = {
     name: string;

package/dist/src/providers/java_maven.js

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -12,6 +13,10 @@ import Base_java, { ecosystem_maven } from "./base_java.js";
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
 /** @typedef {{groupId: string, artifactId: string, version: string, scope: string, ignore: boolean}} Dependency */
+// Matches the legacy `exhortignore` and new `trustify-da-ignore` markers as whole
+// tokens. The trailing `(?![\w-])` boundary prevents lookalikes such as
+// `trustify-da-ignore-disabled` from being treated as ignore directives.
+const IGNORE_MARKER_REGEX = /(exhortignore|trustify-da-ignore)(?![\w-])/;
 export default class Java_maven extends Base_java {
     constructor() {
         super('mvn', 'mvnw' + (process.platform === 'win32' ? '.cmd' : ''));
@@ -31,12 +36,12 @@ export default class Java_maven extends Base_java {
      * Provide content and content type for maven-maven stack analysis.
      * @param {string} manifest - the manifest path or name
      * @param {{}} [opts={}] - optional various options to pass along the application
-     * @returns {Provided}
+     * @returns {Promise<Provided>}
      */
-    provideStack(manifest, opts = {}) {
+    async provideStack(manifest, opts = {}) {
         return {
             ecosystem: ecosystem_maven,
-            content: this.#createSbomStackAnalysis(manifest, opts),
+            content: await this.#createSbomStackAnalysis(manifest, opts),
             contentType: 'application/vnd.cyclonedx+json'
         };
     }
@@ -81,10 +86,10 @@ export default class Java_maven extends Base_java {
      * Create a Dot Graph dependency tree for a manifest path.
      * @param {string} manifest - path for pom.xml
      * @param {{}} [opts={}] - optional various options to pass along the application
-     * @returns {string} the Dot Graph content
+     * @returns {Promise<string>} the Dot Graph content
      * @private
      */
-    #createSbomStackAnalysis(manifest, opts = {}) {
+    async #createSbomStackAnalysis(manifest, opts = {}) {
         const manifestDir = path.dirname(manifest);
         const mvn = this.selectToolBinary(manifest, opts);
         const mvnArgs = JSON.parse(getCustom('TRUSTIFY_DA_MVN_ARGS', '[]', opts));
@@ -131,20 +136,105 @@ export default class Java_maven extends Base_java {
         if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
             console.error("Dependency tree that will be used as input for creating the BOM =>" + EOL + EOL + content.toString());
         }
-        let sbom = this.createSbomFileFromTextFormat(content.toString(), ignoredDeps, opts, manifest);
+        const depTreeContent = content.toString();
+        const hashMap = await this._buildMavenHashMap(depTreeContent, opts);
+        let sbom = this.createSbomFileFromTextFormat(depTreeContent, ignoredDeps, opts, manifest, hashMap);
         // delete temp file and directory
         fs.rmSync(tmpDir, { recursive: true, force: true });
         // return dependency graph as string
         return sbom;
     }
+    /** @type {Object<string, string>} Packaging types that produce .jar files despite non-jar packaging names. */
+    static PACKAGING_TO_JAR = { 'bundle': 'jar', 'eclipse-plugin': 'jar' };
     /**
+     * Build a Map of PURL string → CycloneDX hash entries by reading artifact files from the local Maven repository.
+     *
+     * Both the artifact file path and the hash-map key are derived from the
+     * shared {@link Base_java#parseCoordinate} parser: the file path uses the
+     * resolved version and raw classifier, while the key uses the same canonical
+     * PURL builder as {@link Base_java#parseDep}. This guarantees the key always
+     * matches the PURL that {@link Base_java#parseDependencyTree} looks up.
      *
+     * @param {string} depTreeText Raw dependency tree text from mvn dependency:tree
+     * @param {{}} [opts={}] Options bag (may contain TRUSTIFY_DA_MVN_REPO)
+     * @returns {Promise<Map<string, Array<{alg: string, content: string}>>>}
+     */
+    async _buildMavenHashMap(depTreeText, opts = {}) {
+        const m2Repo = getCustom('TRUSTIFY_DA_MVN_REPO', path.join(os.homedir(), '.m2', 'repository'), opts);
+        const hashMap = new Map();
+        const lines = depTreeText.split(EOL);
+        // Track hash coverage so an incomplete .m2 cache (e.g. ephemeral CI
+        // containers or resolve-only phases) surfaces a summary warning instead
+        // of silently producing an SBOM with missing hashes.
+        let attempted = 0;
+        let missed = 0;
+        for (const rawLine of lines) {
+            const trimmed = rawLine.trim();
+            // Strip leading tree-drawing characters (e.g. "\-", "+-", "|") so the
+            // parenthesized-line check sees the coordinate itself. Omitted
+            // duplicate/conflict lines start with these characters after trim(),
+            // then an opening "(" — without stripping, the "(" check never fires.
+            const cleaned = trimmed.replace(/^[|+\\\- ]+/, '');
+            if (!cleaned || cleaned.startsWith('(')) {
+                continue;
+            }
+            const coord = this.parseCoordinate(rawLine);
+            if (!coord.groupId || !coord.artifactId || !coord.packaging) {
+                continue;
+            }
+            if (coord.packaging === 'pom') {
+                continue;
+            }
+            // Key by the exact PURL parseDep() produces, so the lookup in
+            // parseDependencyTree (hashMap.get(to.toString())) always hits.
+            const purl = this._coordinateToPurl(coord).toString();
+            // The same artifact recurs across dependency-tree branches — notably in
+            // multi-module reactor builds, where every module re-lists shared deps.
+            // The digest is deterministic per PURL, so skip the redundant file read
+            // and SHA-256 computation once this PURL is already hashed.
+            if (hashMap.has(purl)) {
+                continue;
+            }
+            const ext = Java_maven.PACKAGING_TO_JAR[coord.packaging] || coord.packaging;
+            const groupPath = coord.groupId.replaceAll('.', path.sep);
+            const fileName = coord.classifier
+                ? `${coord.artifactId}-${coord.version}-${coord.classifier}.${ext}`
+                : `${coord.artifactId}-${coord.version}.${ext}`;
+            const artifactPath = path.join(m2Repo, groupPath, coord.artifactId, coord.version, fileName);
+            attempted++;
+            try {
+                const stream = fs.createReadStream(artifactPath);
+                const hash = crypto.createHash('sha256');
+                for await (const chunk of stream) {
+                    hash.update(chunk);
+                }
+                const digest = hash.digest('hex');
+                hashMap.set(purl, [{ alg: 'SHA-256', content: digest }]);
+            }
+            catch {
+                missed++;
+                if (process.env['TRUSTIFY_DA_DEBUG'] === 'true') {
+                    console.error(`Maven hash: artifact not found at ${artifactPath}, omitting hash`);
+                }
+            }
+        }
+        // Mirror the pip provider's convention (python_controller.js): surface an
+        // unconditional warning when hashes could not be computed, so incomplete
+        // hash coverage is visible even without TRUSTIFY_DA_DEBUG.
+        if (missed > 0) {
+            console.warn(`Maven hash: ${missed} of ${attempted} artifacts could not be read from the local .m2 cache; SBOM will be generated without hashes for those components.`);
+        }
+        return hashMap;
+    }
+    /**
      * @param {String} textGraphList Text graph String of the manifest
      * @param {[String]} ignoredDeps List of ignored dependencies to be omitted from sbom
+     * @param {{}} opts Options
      * @param {String} manifestPath Path to the pom.xml manifest
+     * @param {Map<string, Array<{alg: string, content: string}>>} [hashMap] PURL→hashes map
      * @return {String} formatted sbom Json String with all dependencies
      */
-    createSbomFileFromTextFormat(textGraphList, ignoredDeps, opts, manifestPath) {
+    createSbomFileFromTextFormat(textGraphList, ignoredDeps, opts, manifestPath, hashMap) {
         let lines = textGraphList.split(EOL);
         // get root component
         let root = lines[0];
@@ -153,6 +243,9 @@ export default class Java_maven extends Base_java {
         let sbom = new Sbom();
         sbom.addRoot(rootPurl, license);
         this.parseDependencyTree(root, 0, lines.slice(1), sbom);
+        // Attach Maven artifact hashes as a post-processing step, keeping this
+        // Maven-specific concern out of the shared dependency-tree parser.
+        sbom.attachHashes(hashMap);
         return sbom.filterIgnoredDeps(ignoredDeps).getAsJsonString(opts);
     }
     /**
@@ -229,7 +322,8 @@ export default class Java_maven extends Base_java {
         return rootDependency;
     }
     /**
-     * Get a list of dependencies with marking of dependencies commented with <!--exhortignore-->.
+     * Get a list of dependencies with marking of dependencies commented with
+     * <!--exhortignore--> or <!--trustify-da-ignore-->.
      * @param {string} manifest - path for pom.xml
      * @returns {[Dependency]} an array of dependencies
      * @private
@@ -247,7 +341,7 @@ export default class Java_maven extends Base_java {
         let buf = fs.readFileSync(manifest);
         // parse manifest pom.xml to json
         let pomJson = parser.parse(buf.toString());
-        // iterate over all dependencies and chery pick dependencies with a exhortignore comment
+        // iterate over all dependencies and chery pick dependencies with an ignore comment
         let pomXml;
         // project without modules
         if (pomJson['project']) {
@@ -263,7 +357,7 @@ export default class Java_maven extends Base_java {
         }
         pomXml.forEach(dep => {
             let ignore = false;
-            if (dep['#comment'] && dep['#comment'].includes('exhortignore')) { // #comment is an array or a string
+            if (dep['#comment'] && [].concat(dep['#comment']).some(comment => IGNORE_MARKER_REGEX.test(comment))) { // #comment is an array or a string
                 ignore = true;
             }
             if (dep['scope'] !== 'test') {

package/dist/src/providers/javascript_bun.d.ts

@@ -1,4 +1,16 @@
 export default class Javascript_bun extends Base_javascript {
+    /**
+     * Parses `bun.lock` into a hash map keyed by `name@version`. Each entry in
+     * the `packages` section is an array whose first element is the resolved id
+     * (`name@version`) and whose fourth element is the SRI integrity string.
+     * @param {string} lockDir - Directory containing bun.lock
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    protected _parseLockFileHashes(lockDir: string): Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>;
     _listCmdArgs(): void;
     _buildDependencyTree(includeTransitive: any, opts?: {}): {
         name: any;