@trustify-da/trustify-da-javascript-client 0.3.0-ea.6645ba5 → 0.3.0-ea.68905d3

package/dist/src/providers/base_java.d.ts

@@ -1,4 +1,4 @@
-export type ecosystem_maven = import("../provider").Provider;
+export type ecosystem_maven = any;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -10,6 +10,13 @@ export type ecosystem_maven = import("../provider").Provider;
 export const ecosystem_maven: string;
 export const ecosystem_gradle: "gradle";
 export default class Base_Java {
+    /**
+     * Maven dependency scopes. Used to detect whether the trailing column of a
+     * dependency-tree line is a scope keyword — which in turn signals that an
+     * optional classifier column is present between the packaging and version.
+     * @type {string[]}
+     */
+    static MAVEN_SCOPES: string[];
     /**
      *
      * @param {string} globalBinary name of the global binary
@@ -40,6 +47,52 @@ export default class Base_Java {
      * @protected
      */
     protected _getDepth(line: string): number;
+    /**
+     * Parse a single dependency-tree line into its Maven coordinate parts.
+     *
+     * This is the single source of truth for interpreting a dependency-tree
+     * line. Both {@link parseDep} (used to build SBOM component PURLs) and the
+     * Maven hash-map builder rely on it, so the PURL key and the artifact file
+     * path can never drift from one another.
+     *
+     * A line has the shape `groupId:artifactId:packaging[:classifier]:version[:scope]`.
+     * The classifier column is only present when a sixth column holds a known
+     * Maven scope keyword; otherwise the fourth column is the version.
+     *
+     * @param {string} line - line to parse from a dependency tree
+     * @returns {{groupId: string, artifactId: string, packaging: string, classifier: (string|null), version: string, scope: (string|null), overridden: boolean}}
+     *   Parsed coordinate. `version` is the resolved concrete version — when the
+     *   line carries a conflict override the override version replaces it and
+     *   `overridden` is set, mirroring how Maven records the winning version.
+     */
+    parseCoordinate(line: string): {
+        groupId: string;
+        artifactId: string;
+        packaging: string;
+        classifier: (string | null);
+        version: string;
+        scope: (string | null);
+        overridden: boolean;
+    };
+    /**
+     * Build the canonical PackageURL for a parsed coordinate.
+     *
+     * The classifier is folded into the version component (e.g.
+     * `4.1.0-linux-x86_64`) except when the version came from a conflict
+     * override, in which case the override version stands alone — matching the
+     * historical behavior of {@link parseDep}.
+     *
+     * @param {{groupId: string, artifactId: string, classifier: (string|null), version: string, overridden: boolean}} coord
+     * @returns {PackageURL} The canonical packageURL for the coordinate
+     * @protected
+     */
+    protected _coordinateToPurl(coord: {
+        groupId: string;
+        artifactId: string;
+        classifier: (string | null);
+        version: string;
+        overridden: boolean;
+    }): PackageURL;
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file
@@ -70,7 +123,7 @@ export default class Base_Java {
      */
     selectToolBinary(manifestPath: string, opts: {}): string | null;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;

package/dist/src/providers/base_java.js

@@ -14,6 +14,13 @@ export const ecosystem_gradle = 'gradle';
 export default class Base_Java {
     DEP_REGEX = /(([-a-zA-Z0-9._]{2,})|[0-9])/g;
     CONFLICT_REGEX = /.*omitted for conflict with (\S+)\)/;
+    /**
+     * Maven dependency scopes. Used to detect whether the trailing column of a
+     * dependency-tree line is a scope keyword — which in turn signals that an
+     * optional classifier column is present between the packaging and version.
+     * @type {string[]}
+     */
+    static MAVEN_SCOPES = ['compile', 'provided', 'runtime', 'test', 'system', 'import'];
     globalBinary;
     localWrapper;
     /**
@@ -82,31 +89,71 @@ export default class Base_Java {
         }
         return ((line.indexOf('-') - 1) / 3) + 1;
     }
+    /**
+     * Parse a single dependency-tree line into its Maven coordinate parts.
+     *
+     * This is the single source of truth for interpreting a dependency-tree
+     * line. Both {@link parseDep} (used to build SBOM component PURLs) and the
+     * Maven hash-map builder rely on it, so the PURL key and the artifact file
+     * path can never drift from one another.
+     *
+     * A line has the shape `groupId:artifactId:packaging[:classifier]:version[:scope]`.
+     * The classifier column is only present when a sixth column holds a known
+     * Maven scope keyword; otherwise the fourth column is the version.
+     *
+     * @param {string} line - line to parse from a dependency tree
+     * @returns {{groupId: string, artifactId: string, packaging: string, classifier: (string|null), version: string, scope: (string|null), overridden: boolean}}
+     *   Parsed coordinate. `version` is the resolved concrete version — when the
+     *   line carries a conflict override the override version replaces it and
+     *   `overridden` is set, mirroring how Maven records the winning version.
+     */
+    parseCoordinate(line) {
+        const parts = line.split(':').map(part => part ? part.match(this.DEP_REGEX)?.[0] ?? '' : '');
+        const groupId = parts[0] ?? '';
+        const artifactId = parts[1] ?? '';
+        const packaging = parts[2] ?? '';
+        // A classifier column exists only when a sixth column holds a scope keyword.
+        const hasClassifier = parts.length >= 6 && Base_Java.MAVEN_SCOPES.includes(parts[5]);
+        const classifier = hasClassifier ? parts[3] : null;
+        let version = (hasClassifier ? parts[4] : parts[3]) ?? '';
+        const scope = hasClassifier ? parts[5] : (parts.length >= 5 ? parts[4] : null);
+        // A conflict override replaces the resolved version entirely.
+        const override = line.match(this.CONFLICT_REGEX);
+        const overridden = Boolean(override);
+        if (overridden) {
+            version = override[1];
+        }
+        return { groupId, artifactId, packaging, classifier, version, scope, overridden };
+    }
+    /**
+     * Build the canonical PackageURL for a parsed coordinate.
+     *
+     * The classifier is folded into the version component (e.g.
+     * `4.1.0-linux-x86_64`) except when the version came from a conflict
+     * override, in which case the override version stands alone — matching the
+     * historical behavior of {@link parseDep}.
+     *
+     * @param {{groupId: string, artifactId: string, classifier: (string|null), version: string, overridden: boolean}} coord
+     * @returns {PackageURL} The canonical packageURL for the coordinate
+     * @protected
+     */
+    _coordinateToPurl(coord) {
+        const purlVersion = (coord.classifier && !coord.overridden)
+            ? `${coord.version}-${coord.classifier}`
+            : coord.version;
+        return this.toPurl(coord.groupId, coord.artifactId, purlVersion);
+    }
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file
      * @returns {PackageURL} The parsed packageURL
      */
     parseDep(line) {
-        let match = line.split(':').map(part => part ? part.match(this.DEP_REGEX)[0] : '');
-        if (!match) {
-            throw new Error(`Unable generate SBOM from dependency tree. Line: ${line} cannot be parsed into a PackageURL`);
-        }
-        let version;
-        if (match.length >= 5 && ['compile', 'provided', 'runtime'].includes(match[5])) {
-            version = `${match[4]}-${match[3]}`;
-        }
-        else {
-            version = match[3];
-        }
-        let override = line.match(this.CONFLICT_REGEX);
-        if (override) {
-            version = override[1];
-        }
-        if (match[0].trim() === '') {
+        const coord = this.parseCoordinate(line);
+        if (coord.groupId.trim() === '') {
             throw new Error(`Artifact coordinates should have a non-empty group ID: ${line}`);
         }
-        return this.toPurl(match[0], match[1], version);
+        return this._coordinateToPurl(coord);
     }
     /**
      * Returns a PackageUrl For Java maven dependencies

package/dist/src/providers/base_javascript.d.ts

@@ -1,4 +1,17 @@
-export type purlType = import("../provider").Provider;
+/**
+ * Converts a Subresource Integrity (SRI) string to a CycloneDX hash object.
+ * SRI is formatted as `<alg>-<base64>` (e.g. `sha512-Ab3d...`). CycloneDX
+ * expects an uppercased algorithm label (e.g. `SHA-512`) and a hex-encoded
+ * digest. When the SRI string contains multiple space-separated hashes, only
+ * the first is used.
+ * @param {string} integrity - SRI string from a lock file
+ * @returns {{alg: string, content: string}|null} CycloneDX hash, or null when unparseable
+ */
+export function sriToHash(integrity: string): {
+    alg: string;
+    content: string;
+} | null;
+export type purlType = any;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /**
@@ -19,7 +32,7 @@ export default class Base_javascript {
    * @param {Object} opts - Configuration options for the provider
    * @protected
    */
-    protected _setUp(manifestPath: string, opts: any): void;
+    protected _setUp(manifestPath: string, opts: Object): void;
     /**
      * Gets the current manifest object
      * @returns {Manifest} The manifest object
@@ -65,6 +78,47 @@ export default class Base_javascript {
    * @protected
    */
     protected _updateLockFileCmdArgs(): Array<string>;
+    /**
+     * Parses the provider's lock file into a hash map keyed by `name@version`.
+     * Subclasses override this (accepting the lock directory) to support their
+     * lock file format. The default implementation returns an empty map so
+     * providers without lock parsing (or without a lock file present) gracefully
+     * omit hashes.
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    protected _parseLockFileHashes(): Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>;
+    /**
+     * Loads lock-file hashes for the given directory into internal state.
+     * Parsing failures degrade gracefully to an empty map (no hashes emitted).
+     * @param {string} lockDir - Directory containing the lock file
+     * @protected
+     */
+    protected _loadHashes(lockDir: string): void;
+    /**
+     * Looks up CycloneDX hashes for a package by name and resolved version.
+     * @param {string} name - The package name (including scope, e.g. `@hapi/joi`)
+     * @param {string} version - The resolved package version
+     * @returns {Array<{alg: string, content: string}>|undefined} Hashes, or undefined
+     * @protected
+     */
+    protected _hashesFor(name: string, version: string): Array<{
+        alg: string;
+        content: string;
+    }> | undefined;
+    /**
+     * Looks up CycloneDX hashes for a package described by a PackageURL.
+     * @param {PackageURL} purl - The package URL
+     * @returns {Array<{alg: string, content: string}>|undefined} Hashes, or undefined
+     * @protected
+     */
+    protected _hashesForPurl(purl: PackageURL): Array<{
+        alg: string;
+        content: string;
+    }> | undefined;
     /**
    * Checks if the provider supports the given manifest name
    * @param {string} manifestName - The manifest name to check
@@ -91,21 +145,21 @@ export default class Base_javascript {
    * @param {Object} [opts={}] - optional; may contain TRUSTIFY_DA_WORKSPACE_DIR
    * @returns {boolean} True if the lock file exists
    */
-    validateLockFile(manifestDir: string, opts?: any): boolean;
+    validateLockFile(manifestDir: string, opts?: Object): boolean;
     /**
    * Provides content and content type for stack analysis
    * @param {string} manifestPath - The manifest path or name
    * @param {Object} [opts={}] - Optional configuration options
    * @returns {Provided} The provided data for stack analysis
    */
-    provideStack(manifestPath: string, opts?: any): Provided;
+    provideStack(manifestPath: string, opts?: Object): Provided;
     /**
    * Provides content and content type for component analysis
    * @param {string} manifestPath - Path to package.json for component report
    * @param {Object} [opts={}] - Optional configuration options
    * @returns {Provided} The provided data for component analysis
    */
-    provideComponent(manifestPath: string, opts?: any): Provided;
+    provideComponent(manifestPath: string, opts?: Object): Provided;
     /**
      * Read license from manifest (package.json). Reused by npm, pnpm, yarn.
      * @param {string} manifestPath - path to package.json
@@ -119,21 +173,21 @@ export default class Base_javascript {
    * @returns {Object} The dependency tree
    * @protected
    */
-    protected _buildDependencyTree(includeTransitive: boolean, opts?: any): any;
+    protected _buildDependencyTree(includeTransitive: boolean, opts?: Object): Object;
     /**
    * Recursively builds the Sbom from the JSON that npm listing returns
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The current dependency tree
    * @protected
    */
-    protected _addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    protected _addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
     /**
    * Extracts root dependencies from the dependency tree
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    * @protected
    */
-    protected _getRootDependencies(depTree: any): Map<string, PackageURL>;
+    protected _getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Gets the version of the package manager
    * @returns {string} The version string of the package manager
@@ -155,6 +209,6 @@ export default class Base_javascript {
     protected _parseDepTreeOutput(output: string): string;
     #private;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 import Manifest from './manifest.js';
 import Sbom from '../sbom.js';

package/dist/src/providers/base_javascript.js

@@ -12,6 +12,49 @@ import Manifest from './manifest.js';
  * @type {string}
  */
 export const purlType = 'npm';
+/**
+ * Maps a Subresource Integrity (SRI) algorithm token to its CycloneDX label.
+ * @type {Object<string, string>}
+ */
+const SRI_ALG_LABELS = {
+    sha1: 'SHA-1',
+    sha256: 'SHA-256',
+    sha384: 'SHA-384',
+    sha512: 'SHA-512',
+};
+/**
+ * Converts a Subresource Integrity (SRI) string to a CycloneDX hash object.
+ * SRI is formatted as `<alg>-<base64>` (e.g. `sha512-Ab3d...`). CycloneDX
+ * expects an uppercased algorithm label (e.g. `SHA-512`) and a hex-encoded
+ * digest. When the SRI string contains multiple space-separated hashes, only
+ * the first is used.
+ * @param {string} integrity - SRI string from a lock file
+ * @returns {{alg: string, content: string}|null} CycloneDX hash, or null when unparseable
+ */
+export function sriToHash(integrity) {
+    if (typeof integrity !== 'string') {
+        return null;
+    }
+    const first = integrity.trim().split(/\s+/)[0];
+    if (!first) {
+        return null;
+    }
+    const dash = first.indexOf('-');
+    if (dash < 0) {
+        return null;
+    }
+    const alg = SRI_ALG_LABELS[first.slice(0, dash).toLowerCase()];
+    // Strip any SRI options (e.g. "?foo") that may follow the base64 payload
+    const base64 = first.slice(dash + 1).split('?')[0];
+    if (!alg || !base64) {
+        return null;
+    }
+    const content = Buffer.from(base64, 'base64').toString('hex');
+    if (!content) {
+        return null;
+    }
+    return { alg, content };
+}
 /**
  * Base class for JavaScript package manager providers.
  * This class provides common functionality for different JavaScript package managers
@@ -25,6 +68,11 @@ export default class Base_javascript {
     #cmd;
     /** @type {string} */
     #ecosystem;
+    /**
+     * Lock-file hashes keyed by `name@version`.
+     * @type {Map<string, Array<{alg: string, content: string}>>}
+     */
+    #hashes = new Map();
     /**
    * Sets up the provider with the manifest path and options
    * @param {string} manifestPath - Path to the package.json manifest file
@@ -95,6 +143,58 @@ export default class Base_javascript {
     _updateLockFileCmdArgs() {
         throw new TypeError("_updateLockFileCmdArgs must be implemented");
     }
+    /**
+     * Parses the provider's lock file into a hash map keyed by `name@version`.
+     * Subclasses override this (accepting the lock directory) to support their
+     * lock file format. The default implementation returns an empty map so
+     * providers without lock parsing (or without a lock file present) gracefully
+     * omit hashes.
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    _parseLockFileHashes() {
+        return new Map();
+    }
+    /**
+     * Loads lock-file hashes for the given directory into internal state.
+     * Parsing failures degrade gracefully to an empty map (no hashes emitted).
+     * @param {string} lockDir - Directory containing the lock file
+     * @protected
+     */
+    _loadHashes(lockDir) {
+        try {
+            this.#hashes = this._parseLockFileHashes(lockDir) || new Map();
+        }
+        catch (_) {
+            this.#hashes = new Map();
+        }
+    }
+    /**
+     * Looks up CycloneDX hashes for a package by name and resolved version.
+     * @param {string} name - The package name (including scope, e.g. `@hapi/joi`)
+     * @param {string} version - The resolved package version
+     * @returns {Array<{alg: string, content: string}>|undefined} Hashes, or undefined
+     * @protected
+     */
+    _hashesFor(name, version) {
+        if (!name || !version) {
+            return undefined;
+        }
+        return this.#hashes.get(`${name}@${version}`);
+    }
+    /**
+     * Looks up CycloneDX hashes for a package described by a PackageURL.
+     * @param {PackageURL} purl - The package URL
+     * @returns {Array<{alg: string, content: string}>|undefined} Hashes, or undefined
+     * @protected
+     */
+    _hashesForPurl(purl) {
+        if (!purl) {
+            return undefined;
+        }
+        const name = purl.namespace ? `${purl.namespace}/${purl.name}` : purl.name;
+        return this._hashesFor(name, purl.version);
+    }
     /**
    * Checks if the provider supports the given manifest name
    * @param {string} manifestName - The manifest name to check
@@ -225,6 +325,7 @@ export default class Base_javascript {
         const manifestDir = path.dirname(this.#manifest.manifestPath);
         const cmdDir = this._findLockFileDir(manifestDir, opts) || manifestDir;
         this._createLockFile(cmdDir);
+        this._loadHashes(cmdDir);
         let output = this.#executeListCmd(includeTransitive, cmdDir);
         output = this._parseDepTreeOutput(output);
         return JSON.parse(output);
@@ -284,7 +385,7 @@ export default class Base_javascript {
             const [name, artifact] = entry;
             const target = toPurl(purlType, name, artifact.version);
             const rootPurl = toPurl(purlType, this.#manifest.name, this.#manifest.version);
-            sbom.addDependency(rootPurl, target);
+            sbom.addDependency(rootPurl, target, undefined, this._hashesFor(name, artifact.version));
             this.#addDependenciesOf(sbom, target, artifact);
         });
     }
@@ -302,7 +403,7 @@ export default class Base_javascript {
             const [name, depArtifact] = entry;
             if (depArtifact.version !== undefined) {
                 const target = toPurl(purlType, name, depArtifact.version);
-                sbom.addDependency(from, target);
+                sbom.addDependency(from, target, undefined, this._hashesFor(name, depArtifact.version));
                 this.#addDependenciesOf(sbom, target, depArtifact);
             }
         });
@@ -326,7 +427,8 @@ export default class Base_javascript {
             .sort();
         for (const key of sortedDepsKeys) {
             const rootPurl = toPurlFromString(sbom.getRoot().purl);
-            sbom.addDependency(rootPurl, rootDeps.get(key));
+            const targetPurl = rootDeps.get(key);
+            sbom.addDependency(rootPurl, targetPurl, undefined, this._hashesForPurl(targetPurl));
         }
         this.#ensurePeerAndOptionalDeps(sbom);
         sbom.filterIgnoredDeps(this.#manifest.ignored);

package/dist/src/providers/base_pyproject.d.ts

@@ -13,7 +13,7 @@ export default class Base_pyproject {
      * @param {Object} [opts={}]
      * @returns {boolean}
      */
-    validateLockFile(manifestDir: string, opts?: any): boolean;
+    validateLockFile(manifestDir: string, opts?: Object): boolean;
     /**
      * Walk up from manifestDir to find the directory containing the lock file.
      * Follows the same pattern as Base_javascript._findLockFileDir().
@@ -22,7 +22,7 @@ export default class Base_pyproject {
      * @returns {string|null}
      * @protected
      */
-    protected _findLockFileDir(manifestDir: string, opts?: any): string | null;
+    protected _findLockFileDir(manifestDir: string, opts?: Object): string | null;
     /**
      * Detect workspace root boundaries.
      * Currently only uv has native workspace support ([tool.uv.workspace] in pyproject.toml).
@@ -44,13 +44,13 @@ export default class Base_pyproject {
      * @param {Object} [opts={}]
      * @returns {Promise<Provided>}
      */
-    provideStack(manifest: string, opts?: any): Promise<Provided>;
+    provideStack(manifest: string, opts?: Object): Promise<Provided>;
     /**
      * @param {string} manifest - path to pyproject.toml
      * @param {Object} [opts={}]
      * @returns {Promise<Provided>}
      */
-    provideComponent(manifest: string, opts?: any): Promise<Provided>;
+    provideComponent(manifest: string, opts?: Object): Promise<Provided>;
     /**
      * @returns {string}
      * @protected
@@ -77,7 +77,7 @@ export default class Base_pyproject {
      * @returns {Promise<DependencyData>}
      * @protected
      */
-    protected _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: any): Promise<DependencyData>;
+    protected _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: Object): Promise<DependencyData>;
     /**
      * Canonicalize a Python package name per PEP 503.
      * @param {string} name

package/dist/src/providers/containerfile_parser.d.ts

@@ -0,0 +1,5 @@
+export function getParser(): Promise<Parser>;
+export function getFromQuery(): Promise<Query>;
+export function getArgQuery(): Promise<Query>;
+import { Parser } from 'web-tree-sitter';
+import { Query } from 'web-tree-sitter';

package/dist/src/providers/containerfile_parser.js

@@ -0,0 +1,20 @@
+import { readFile } from 'node:fs/promises';
+import { Language, Parser, Query } from 'web-tree-sitter';
+const wasmUrl = new URL('./tree-sitter-containerfile.wasm', import.meta.url);
+async function init() {
+    await Parser.init();
+    const wasmBytes = new Uint8Array(await readFile(wasmUrl));
+    return await Language.load(wasmBytes);
+}
+export async function getParser() {
+    const language = await init();
+    return new Parser().setLanguage(language);
+}
+export async function getFromQuery() {
+    const language = await init();
+    return new Query(language, '(from_instruction (image_spec) @image)');
+}
+export async function getArgQuery() {
+    const language = await init();
+    return new Query(language, '(arg_instruction (arg_pair name: (_) @name default: (_) @default))');
+}

package/dist/src/providers/golang_gomodules.d.ts

@@ -16,7 +16,7 @@ declare namespace _default {
     export function packageManagerName(): string;
 }
 export default _default;
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;

package/dist/src/providers/golang_gomodules.js

@@ -78,9 +78,10 @@ function getChildVertexFromEdge(edge) {
     return edge.split(" ")[1];
 }
 /**
- * Check whether a require_spec has a valid exhortignore marker.
- * For direct dependencies: `//exhortignore` or `// exhortignore`
- * For indirect dependencies: `// indirect; exhortignore` (semicolon-separated)
+ * Check whether a require_spec has a valid ignore marker.
+ * Supports both the legacy `exhortignore` marker and the new `trustify-da-ignore` marker.
+ * For direct dependencies: `//exhortignore` or `// trustify-da-ignore`
+ * For indirect dependencies: `// indirect; exhortignore` or `// indirect; trustify-da-ignore` (semicolon-separated)
  * @param {import('web-tree-sitter').SyntaxNode} specNode
  * @return {boolean}
  */
@@ -92,10 +93,10 @@ function hasExhortIgnore(specNode) {
     let comments = specNode.children.filter(c => c.type === 'comment');
     for (let comment of comments) {
         let text = comment.text;
-        if (/^\/\/\s*indirect;\s*exhortignore/.test(text)) {
+        if (/^\/\/\s*indirect;\s*(exhortignore|trustify-da-ignore)(?![\w-])/.test(text)) {
             return true;
         }
-        if (/^\/\/\s*exhortignore/.test(text)) {
+        if (/^\/\/\s*(exhortignore|trustify-da-ignore)(?![\w-])/.test(text)) {
             return true;
         }
     }
@@ -187,6 +188,36 @@ function performManifestVersionsCheck(rootElementName, goModGraphOutputRows, man
         throw error;
     }
 }
+/** Parses go.sum to build a hash map of module@version to CycloneDX hashes. */
+function parseGoSumHashes(manifestDir) {
+    let goSumPath = path.join(manifestDir, 'go.sum');
+    if (!fs.existsSync(goSumPath)) {
+        return new Map();
+    }
+    let hashMap = new Map();
+    let content = fs.readFileSync(goSumPath, 'utf-8');
+    for (let line of content.split('\n')) {
+        line = line.trim();
+        if (!line) {
+            continue;
+        }
+        let parts = line.split(/\s+/);
+        if (parts.length < 3) {
+            continue;
+        }
+        let [mod, version, hash] = parts;
+        if (version.endsWith('/go.mod')) {
+            continue;
+        }
+        if (!hash.startsWith('h1:')) {
+            continue;
+        }
+        let base64Part = hash.slice(3);
+        let hexDigest = Buffer.from(base64Part, 'base64').toString('hex');
+        hashMap.set(`${mod}@${version}`, [{ alg: "SHA-256", content: hexDigest }]);
+    }
+    return hashMap;
+}
 /**
  * Create SBOM json string for go Module.
  * @param {string} manifest - path for go.mod
@@ -241,6 +272,7 @@ async function getSBOM(manifest, opts = {}, includeTransitive) {
     if (matchManifestVersions === "true") {
         performManifestVersionsCheck(root, rows, manifestContent, parser, requireQuery);
     }
+    let goSumHashes = parseGoSumHashes(manifestDir);
     const mainModule = toPurl(root, "@");
     const license = readLicenseFromManifest(manifest);
     sbom.addRoot(mainModule, license);
@@ -262,7 +294,7 @@ async function getSBOM(manifest, opts = {}, includeTransitive) {
             if (getParentVertexFromEdge(row) === root && !directDepPaths.has(getPackageName(child))) {
                 return;
             }
-            sbom.addDependency(source, target);
+            sbom.addDependency(source, target, undefined, goSumHashes.get(child));
         });
         // at the end, filter out all ignored dependencies including versions.
         sbom.filterIgnoredDepsIncludingVersion(allIgnoredDeps);
@@ -275,12 +307,22 @@ async function getSBOM(manifest, opts = {}, includeTransitive) {
             let target = toPurl(child, "@");
             if (dependencyNotIgnored(ignoredDeps, target)) {
                 if (directDepPaths.has(getPackageName(child))) {
-                    sbom.addDependency(mainModule, target);
+                    sbom.addDependency(mainModule, target, undefined, goSumHashes.get(child));
                 }
             }
         });
         enforceRemovingIgnoredDepsInCaseOfAutomaticVersionUpdate(ignoredDeps, sbom);
     }
+    // Backfill hashes for components that were only seen as dependency sources
+    for (const comp of sbom.sbomModel.components) {
+        if (!comp.hashes && comp.purl) {
+            let key = decodeURIComponent(comp.purl.replace('pkg:golang/', ''));
+            let hashes = goSumHashes.get(key);
+            if (hashes) {
+                comp.hashes = hashes;
+            }
+        }
+    }
     return sbom.getAsJsonString(opts);
 }
 /**