@trustify-da/trustify-da-javascript-client 0.3.0-ea.ec6824b → 0.3.0-ea.efdc87d

package/dist/src/providers/base_javascript.js

@@ -12,6 +12,49 @@ import Manifest from './manifest.js';
  * @type {string}
  */
 export const purlType = 'npm';
+/**
+ * Maps a Subresource Integrity (SRI) algorithm token to its CycloneDX label.
+ * @type {Object<string, string>}
+ */
+const SRI_ALG_LABELS = {
+    sha1: 'SHA-1',
+    sha256: 'SHA-256',
+    sha384: 'SHA-384',
+    sha512: 'SHA-512',
+};
+/**
+ * Converts a Subresource Integrity (SRI) string to a CycloneDX hash object.
+ * SRI is formatted as `<alg>-<base64>` (e.g. `sha512-Ab3d...`). CycloneDX
+ * expects an uppercased algorithm label (e.g. `SHA-512`) and a hex-encoded
+ * digest. When the SRI string contains multiple space-separated hashes, only
+ * the first is used.
+ * @param {string} integrity - SRI string from a lock file
+ * @returns {{alg: string, content: string}|null} CycloneDX hash, or null when unparseable
+ */
+export function sriToHash(integrity) {
+    if (typeof integrity !== 'string') {
+        return null;
+    }
+    const first = integrity.trim().split(/\s+/)[0];
+    if (!first) {
+        return null;
+    }
+    const dash = first.indexOf('-');
+    if (dash < 0) {
+        return null;
+    }
+    const alg = SRI_ALG_LABELS[first.slice(0, dash).toLowerCase()];
+    // Strip any SRI options (e.g. "?foo") that may follow the base64 payload
+    const base64 = first.slice(dash + 1).split('?')[0];
+    if (!alg || !base64) {
+        return null;
+    }
+    const content = Buffer.from(base64, 'base64').toString('hex');
+    if (!content) {
+        return null;
+    }
+    return { alg, content };
+}
 /**
  * Base class for JavaScript package manager providers.
  * This class provides common functionality for different JavaScript package managers
@@ -25,6 +68,11 @@ export default class Base_javascript {
     #cmd;
     /** @type {string} */
     #ecosystem;
+    /**
+     * Lock-file hashes keyed by `name@version`.
+     * @type {Map<string, Array<{alg: string, content: string}>>}
+     */
+    #hashes = new Map();
     /**
    * Sets up the provider with the manifest path and options
    * @param {string} manifestPath - Path to the package.json manifest file
@@ -95,6 +143,58 @@ export default class Base_javascript {
     _updateLockFileCmdArgs() {
         throw new TypeError("_updateLockFileCmdArgs must be implemented");
     }
+    /**
+     * Parses the provider's lock file into a hash map keyed by `name@version`.
+     * Subclasses override this (accepting the lock directory) to support their
+     * lock file format. The default implementation returns an empty map so
+     * providers without lock parsing (or without a lock file present) gracefully
+     * omit hashes.
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    _parseLockFileHashes() {
+        return new Map();
+    }
+    /**
+     * Loads lock-file hashes for the given directory into internal state.
+     * Parsing failures degrade gracefully to an empty map (no hashes emitted).
+     * @param {string} lockDir - Directory containing the lock file
+     * @protected
+     */
+    _loadHashes(lockDir) {
+        try {
+            this.#hashes = this._parseLockFileHashes(lockDir) || new Map();
+        }
+        catch (_) {
+            this.#hashes = new Map();
+        }
+    }
+    /**
+     * Looks up CycloneDX hashes for a package by name and resolved version.
+     * @param {string} name - The package name (including scope, e.g. `@hapi/joi`)
+     * @param {string} version - The resolved package version
+     * @returns {Array<{alg: string, content: string}>|undefined} Hashes, or undefined
+     * @protected
+     */
+    _hashesFor(name, version) {
+        if (!name || !version) {
+            return undefined;
+        }
+        return this.#hashes.get(`${name}@${version}`);
+    }
+    /**
+     * Looks up CycloneDX hashes for a package described by a PackageURL.
+     * @param {PackageURL} purl - The package URL
+     * @returns {Array<{alg: string, content: string}>|undefined} Hashes, or undefined
+     * @protected
+     */
+    _hashesForPurl(purl) {
+        if (!purl) {
+            return undefined;
+        }
+        const name = purl.namespace ? `${purl.namespace}/${purl.name}` : purl.name;
+        return this._hashesFor(name, purl.version);
+    }
     /**
    * Checks if the provider supports the given manifest name
    * @param {string} manifestName - The manifest name to check
@@ -225,6 +325,7 @@ export default class Base_javascript {
         const manifestDir = path.dirname(this.#manifest.manifestPath);
         const cmdDir = this._findLockFileDir(manifestDir, opts) || manifestDir;
         this._createLockFile(cmdDir);
+        this._loadHashes(cmdDir);
         let output = this.#executeListCmd(includeTransitive, cmdDir);
         output = this._parseDepTreeOutput(output);
         return JSON.parse(output);
@@ -284,7 +385,7 @@ export default class Base_javascript {
             const [name, artifact] = entry;
             const target = toPurl(purlType, name, artifact.version);
             const rootPurl = toPurl(purlType, this.#manifest.name, this.#manifest.version);
-            sbom.addDependency(rootPurl, target);
+            sbom.addDependency(rootPurl, target, undefined, this._hashesFor(name, artifact.version));
             this.#addDependenciesOf(sbom, target, artifact);
         });
     }
@@ -302,7 +403,7 @@ export default class Base_javascript {
             const [name, depArtifact] = entry;
             if (depArtifact.version !== undefined) {
                 const target = toPurl(purlType, name, depArtifact.version);
-                sbom.addDependency(from, target);
+                sbom.addDependency(from, target, undefined, this._hashesFor(name, depArtifact.version));
                 this.#addDependenciesOf(sbom, target, depArtifact);
             }
         });
@@ -326,7 +427,8 @@ export default class Base_javascript {
             .sort();
         for (const key of sortedDepsKeys) {
             const rootPurl = toPurlFromString(sbom.getRoot().purl);
-            sbom.addDependency(rootPurl, rootDeps.get(key));
+            const targetPurl = rootDeps.get(key);
+            sbom.addDependency(rootPurl, targetPurl, undefined, this._hashesForPurl(targetPurl));
         }
         this.#ensurePeerAndOptionalDeps(sbom);
         sbom.filterIgnoredDeps(this.#manifest.ignored);
@@ -430,7 +532,7 @@ export default class Base_javascript {
                 }
             }
             // Try to find the command in the following order:
-            // 1. Custom path from environment/opts (via getCustomPath)
+            // 1. Custom path from opts/environment (via getCustomPath)
             // 2. Local node_modules/.bin
             // 3. Global installation
             let cmd = this.#cmd;

package/dist/src/providers/containerfile_parser.d.ts

@@ -0,0 +1,5 @@
+export function getParser(): Promise<Parser>;
+export function getFromQuery(): Promise<Query>;
+export function getArgQuery(): Promise<Query>;
+import { Parser } from 'web-tree-sitter';
+import { Query } from 'web-tree-sitter';

package/dist/src/providers/containerfile_parser.js

@@ -0,0 +1,20 @@
+import { readFile } from 'node:fs/promises';
+import { Language, Parser, Query } from 'web-tree-sitter';
+const wasmUrl = new URL('./tree-sitter-containerfile.wasm', import.meta.url);
+async function init() {
+    await Parser.init();
+    const wasmBytes = new Uint8Array(await readFile(wasmUrl));
+    return await Language.load(wasmBytes);
+}
+export async function getParser() {
+    const language = await init();
+    return new Parser().setLanguage(language);
+}
+export async function getFromQuery() {
+    const language = await init();
+    return new Query(language, '(from_instruction (image_spec) @image)');
+}
+export async function getArgQuery() {
+    const language = await init();
+    return new Query(language, '(arg_instruction (arg_pair name: (_) @name default: (_) @default))');
+}

package/dist/src/providers/golang_gomodules.js

@@ -78,9 +78,10 @@ function getChildVertexFromEdge(edge) {
     return edge.split(" ")[1];
 }
 /**
- * Check whether a require_spec has a valid exhortignore marker.
- * For direct dependencies: `//exhortignore` or `// exhortignore`
- * For indirect dependencies: `// indirect; exhortignore` (semicolon-separated)
+ * Check whether a require_spec has a valid ignore marker.
+ * Supports both the legacy `exhortignore` marker and the new `trustify-da-ignore` marker.
+ * For direct dependencies: `//exhortignore` or `// trustify-da-ignore`
+ * For indirect dependencies: `// indirect; exhortignore` or `// indirect; trustify-da-ignore` (semicolon-separated)
  * @param {import('web-tree-sitter').SyntaxNode} specNode
  * @return {boolean}
  */
@@ -92,10 +93,10 @@ function hasExhortIgnore(specNode) {
     let comments = specNode.children.filter(c => c.type === 'comment');
     for (let comment of comments) {
         let text = comment.text;
-        if (/^\/\/\s*indirect;\s*exhortignore/.test(text)) {
+        if (/^\/\/\s*indirect;\s*(exhortignore|trustify-da-ignore)(?![\w-])/.test(text)) {
             return true;
         }
-        if (/^\/\/\s*exhortignore/.test(text)) {
+        if (/^\/\/\s*(exhortignore|trustify-da-ignore)(?![\w-])/.test(text)) {
             return true;
         }
     }
@@ -187,6 +188,36 @@ function performManifestVersionsCheck(rootElementName, goModGraphOutputRows, man
         throw error;
     }
 }
+/** Parses go.sum to build a hash map of module@version to CycloneDX hashes. */
+function parseGoSumHashes(manifestDir) {
+    let goSumPath = path.join(manifestDir, 'go.sum');
+    if (!fs.existsSync(goSumPath)) {
+        return new Map();
+    }
+    let hashMap = new Map();
+    let content = fs.readFileSync(goSumPath, 'utf-8');
+    for (let line of content.split('\n')) {
+        line = line.trim();
+        if (!line) {
+            continue;
+        }
+        let parts = line.split(/\s+/);
+        if (parts.length < 3) {
+            continue;
+        }
+        let [mod, version, hash] = parts;
+        if (version.endsWith('/go.mod')) {
+            continue;
+        }
+        if (!hash.startsWith('h1:')) {
+            continue;
+        }
+        let base64Part = hash.slice(3);
+        let hexDigest = Buffer.from(base64Part, 'base64').toString('hex');
+        hashMap.set(`${mod}@${version}`, [{ alg: "SHA-256", content: hexDigest }]);
+    }
+    return hashMap;
+}
 /**
  * Create SBOM json string for go Module.
  * @param {string} manifest - path for go.mod
@@ -241,6 +272,7 @@ async function getSBOM(manifest, opts = {}, includeTransitive) {
     if (matchManifestVersions === "true") {
         performManifestVersionsCheck(root, rows, manifestContent, parser, requireQuery);
     }
+    let goSumHashes = parseGoSumHashes(manifestDir);
     const mainModule = toPurl(root, "@");
     const license = readLicenseFromManifest(manifest);
     sbom.addRoot(mainModule, license);
@@ -262,7 +294,7 @@ async function getSBOM(manifest, opts = {}, includeTransitive) {
             if (getParentVertexFromEdge(row) === root && !directDepPaths.has(getPackageName(child))) {
                 return;
             }
-            sbom.addDependency(source, target);
+            sbom.addDependency(source, target, undefined, goSumHashes.get(child));
         });
         // at the end, filter out all ignored dependencies including versions.
         sbom.filterIgnoredDepsIncludingVersion(allIgnoredDeps);
@@ -275,12 +307,22 @@ async function getSBOM(manifest, opts = {}, includeTransitive) {
             let target = toPurl(child, "@");
             if (dependencyNotIgnored(ignoredDeps, target)) {
                 if (directDepPaths.has(getPackageName(child))) {
-                    sbom.addDependency(mainModule, target);
+                    sbom.addDependency(mainModule, target, undefined, goSumHashes.get(child));
                 }
             }
         });
         enforceRemovingIgnoredDepsInCaseOfAutomaticVersionUpdate(ignoredDeps, sbom);
     }
+    // Backfill hashes for components that were only seen as dependency sources
+    for (const comp of sbom.sbomModel.components) {
+        if (!comp.hashes && comp.purl) {
+            let key = decodeURIComponent(comp.purl.replace('pkg:golang/', ''));
+            let hashes = goSumHashes.get(key);
+            if (hashes) {
+                comp.hashes = hashes;
+            }
+        }
+    }
     return sbom.getAsJsonString(opts);
 }
 /**

package/dist/src/providers/java_gradle.d.ts

@@ -17,6 +17,30 @@ export function parseGradleInitScriptOutput(raw: string): {
     path: string;
     dir: string;
 }[];
+/**
+ * Parse the structured output from the Gradle hash init script.
+ * Each recognised line has the form `::DA_HASH::group:name:version::<file-path>`.
+ *
+ * @param {string} raw - Raw stdout from gradle
+ * @returns {{ id: string, file: string }[]} component id (`group:name:version`) and absolute artifact file path
+ */
+export function parseGradleHashScriptOutput(raw: string): {
+    id: string;
+    file: string;
+}[];
+/**
+ * Parse a Gradle module component id (`group:name:version`) into its coordinate
+ * parts. The caller builds the canonical PURL key from these parts using the same
+ * builder {@link parseDep} uses, so the stored key and the lookup key cannot drift.
+ *
+ * @param {string} id - the Gradle component id
+ * @returns {{group: string, name: string, version: string}|null} the parsed coordinate, or null when the id is malformed
+ */
+export function parseComponentId(id: string): {
+    group: string;
+    name: string;
+    version: string;
+} | null;
 /**
  * This class provides common functionality for Groovy and Kotlin DSL files.
  */
@@ -54,6 +78,30 @@ export default class Java_gradle extends Base_java {
      * @returns {Provided}
      */
     provideComponent(manifest: string, opts?: {}): Provided;
+    /**
+     * Compute SHA-256 hashes for the resolved artifacts of a Gradle manifest.
+     *
+     * Rather than scanning the local Gradle cache, this asks Gradle itself for
+     * the resolved artifact files via an init script (mirroring the pattern used
+     * by {@link discoverGradleSubprojects}), then hashes each file with the
+     * Node.js `crypto` module. The result is keyed by the canonical PURL string
+     * built via {@link Base_java#toPurl} — the same builder {@link parseDep} uses
+     * for the lookup — so the stored key and the lookup key cannot drift.
+     *
+     * Degrades gracefully: if Gradle cannot be invoked, the init script fails, or
+     * an artifact has no readable file (e.g. BOM/`platform()` dependencies), the
+     * hash for that component is omitted rather than throwing. A warning is emitted
+     * on every degradation path so incomplete hash coverage is visible even without
+     * `TRUSTIFY_DA_DEBUG` (mirroring the pip/cargo providers).
+     *
+     * @param {string} manifest - path to build.gradle[.kts]
+     * @param {{}} [opts={}] - optional various options to pass along the application
+     * @returns {Promise<Map<string, Array<{alg: string, content: string}>>>} map of canonical PURL string to CycloneDX hashes
+     */
+    parseGradleHashes(manifest: string, opts?: {}): Promise<Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>>;
     #private;
 }
 export type Provided = import("../provider.js").Provided;

package/dist/src/providers/java_gradle.js

@@ -12,8 +12,8 @@ import Base_java, { ecosystem_gradle } from "./base_java.js";
 /** @typedef {import('../provider.js').Provider} */
 /** @typedef {import('../provider.js').Provided} Provided */
 const ROOT_PROJECT_KEY_NAME = "root-project";
-const TRUSTIFY_DA_IGNORE_REGEX_LINE = /.*\s?exhortignore\s*$/g;
-const TRUSTIFY_DA_IGNORE_REGEX = /\/\/\s?exhortignore/;
+const TRUSTIFY_DA_IGNORE_REGEX_LINE = /.*\s?(exhortignore|trustify-da-ignore)\s*$/g;
+const TRUSTIFY_DA_IGNORE_REGEX = /\/\/\s?(exhortignore|trustify-da-ignore)/;
 /**
  * Check if the dependency marked for exclusion has libs notation , so if it's true the rest of coordinates( GAV) should be fetched from TOML file.
  * @param {string} depToBeIgnored
@@ -59,7 +59,6 @@ export default class Java_gradle extends Base_java {
      * @param {string} manifestPath - path to manifest
      * @returns {null}
      */
-    // eslint-disable-next-line no-unused-vars
     readLicenseFromManifest(manifestPath) { return readLicenseFile(manifestPath); }
     /**
      * Provide content and content type for stack analysis.
@@ -67,10 +66,10 @@ export default class Java_gradle extends Base_java {
      * @param {{}} [opts={}] - optional various options to pass along the application
      * @returns {Provided}
      */
-    provideStack(manifest, opts = {}) {
+    async provideStack(manifest, opts = {}) {
         return {
             ecosystem: ecosystem_gradle,
-            content: this.#createSbomStackAnalysis(manifest, opts),
+            content: await this.#createSbomStackAnalysis(manifest, opts),
             contentType: 'application/vnd.cyclonedx+json'
         };
     }
@@ -80,10 +79,10 @@ export default class Java_gradle extends Base_java {
      * @param {{}} [opts={}] - optional various options to pass along the application
      * @returns {Provided}
      */
-    provideComponent(manifest, opts = {}) {
+    async provideComponent(manifest, opts = {}) {
         return {
             ecosystem: ecosystem_gradle,
-            content: this.#getSbomForComponentAnalysis(manifest, opts),
+            content: await this.#getSbomForComponentAnalysis(manifest, opts),
             contentType: 'application/vnd.cyclonedx+json'
         };
     }
@@ -133,9 +132,10 @@ export default class Java_gradle extends Base_java {
      * @param {Sbom} sbom - the SBOM object to add dependencies to
      * @param {Set} processedDeps - set of already processed dependencies
      * @param {string} scope - the dependency scope
+     * @param {Map<string, Array<{alg: string, content: string}>>} [hashMap] - map of "group:name@version" to CycloneDX hashes
      * @private
      */
-    #processDependencyTree(config, parentPurl, sbom, processedDeps, scope) {
+    #processDependencyTree(config, parentPurl, sbom, processedDeps, scope, hashMap) {
         const processedLines = this.#prepareLinesForParsingDependencyTree(config);
         let parentStack = [parentPurl];
         for (const { line, depth } of processedLines) {
@@ -153,7 +153,7 @@ export default class Java_gradle extends Base_java {
                 // Add dependency to SBOM if not already processed
                 if (!processedDeps.has(depKey)) {
                     processedDeps.add(depKey);
-                    sbom.addDependency(currentParent, purl, scope);
+                    sbom.addDependency(currentParent, purl, scope, hashMap?.get(purl.toString()));
                 }
                 parentStack.push(purl);
             }
@@ -166,7 +166,7 @@ export default class Java_gradle extends Base_java {
      * @returns {string} the Dot Graph content
      * @private
      */
-    #buildSbom(content, properties, manifestPath, opts = {}) {
+    #buildSbom(content, properties, manifestPath, opts = {}, hashMap) {
         let sbom = new Sbom();
         let root = `${properties.group}:${properties[ROOT_PROJECT_KEY_NAME].match(/Root project '(.+)'/)[1]}:jar:${properties.version}`;
         let rootPurl = this.parseDep(root);
@@ -175,8 +175,8 @@ export default class Java_gradle extends Base_java {
         let ignoredDeps = this.#getIgnoredDeps(manifestPath);
         const [runtimeConfig, compileConfig] = this.#extractConfigurations(content);
         const processedDeps = new Set();
-        this.#processDependencyTree(runtimeConfig, rootPurl, sbom, processedDeps, 'required');
-        this.#processDependencyTree(compileConfig, rootPurl, sbom, processedDeps, 'optional');
+        this.#processDependencyTree(runtimeConfig, rootPurl, sbom, processedDeps, 'required', hashMap);
+        this.#processDependencyTree(compileConfig, rootPurl, sbom, processedDeps, 'optional', hashMap);
         return sbom.filterIgnoredDepsIncludingVersion(ignoredDeps).getAsJsonString(opts);
     }
     /**
@@ -186,14 +186,15 @@ export default class Java_gradle extends Base_java {
      * @returns {string} the Dot Graph content
      * @private
      */
-    #createSbomStackAnalysis(manifest, opts = {}) {
+    async #createSbomStackAnalysis(manifest, opts = {}) {
         let content = this.#getDependencies(manifest, opts);
         let properties = this.#extractProperties(manifest, opts);
+        let hashMap = await this.parseGradleHashes(manifest, opts);
         // read dependency tree from temp file
         if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
             console.log("Dependency tree that will be used as input for creating the BOM =>" + EOL + EOL + content);
         }
-        let sbom = this.#buildSbom(content, properties, manifest, opts);
+        let sbom = this.#buildSbom(content, properties, manifest, opts, hashMap);
         return sbom;
     }
     /**
@@ -238,10 +239,11 @@ export default class Java_gradle extends Base_java {
      * @returns {string} - sbom string of the direct dependencies of build.gradle
      * @private
      */
-    #getSbomForComponentAnalysis(manifestPath, opts = {}) {
+    async #getSbomForComponentAnalysis(manifestPath, opts = {}) {
         let content = this.#getDependencies(manifestPath, opts);
         let properties = this.#extractProperties(manifestPath, opts);
-        let sbom = this.#buildDirectDependenciesSbom(content, properties, manifestPath, opts);
+        let hashMap = await this.parseGradleHashes(manifestPath, opts);
+        let sbom = this.#buildDirectDependenciesSbom(content, properties, manifestPath, opts, hashMap);
         return sbom;
     }
     /**
@@ -260,6 +262,112 @@ export default class Java_gradle extends Base_java {
             throw new Error(`Couldn't run gradle dependencies command, error message returned from gradle binary => ${EOL} ${error.message}`);
         }
     }
+    /**
+     * Hash a file using SHA-256 with streaming to handle large files efficiently.
+     * @param {string} filePath - path to the file to hash
+     * @returns {Promise<string>} hex-encoded SHA-256 digest
+     * @private
+     */
+    #hashFileStream(filePath) {
+        return new Promise((resolve, reject) => {
+            const hash = crypto.createHash('sha256');
+            const stream = fs.createReadStream(filePath);
+            stream.on('data', chunk => hash.update(chunk));
+            stream.on('end', () => resolve(hash.digest('hex')));
+            stream.on('error', reject);
+        });
+    }
+    /**
+     * Compute SHA-256 hashes for the resolved artifacts of a Gradle manifest.
+     *
+     * Rather than scanning the local Gradle cache, this asks Gradle itself for
+     * the resolved artifact files via an init script (mirroring the pattern used
+     * by {@link discoverGradleSubprojects}), then hashes each file with the
+     * Node.js `crypto` module. The result is keyed by the canonical PURL string
+     * built via {@link Base_java#toPurl} — the same builder {@link parseDep} uses
+     * for the lookup — so the stored key and the lookup key cannot drift.
+     *
+     * Degrades gracefully: if Gradle cannot be invoked, the init script fails, or
+     * an artifact has no readable file (e.g. BOM/`platform()` dependencies), the
+     * hash for that component is omitted rather than throwing. A warning is emitted
+     * on every degradation path so incomplete hash coverage is visible even without
+     * `TRUSTIFY_DA_DEBUG` (mirroring the pip/cargo providers).
+     *
+     * @param {string} manifest - path to build.gradle[.kts]
+     * @param {{}} [opts={}] - optional various options to pass along the application
+     * @returns {Promise<Map<string, Array<{alg: string, content: string}>>>} map of canonical PURL string to CycloneDX hashes
+     */
+    async parseGradleHashes(manifest, opts = {}) {
+        const hashMap = new Map();
+        const debug = process.env["TRUSTIFY_DA_DEBUG"] === "true";
+        let gradle;
+        try {
+            gradle = this.selectToolBinary(manifest, opts);
+        }
+        catch (error) {
+            console.warn(`Gradle could not be invoked to compute artifact hashes, SBOM will be generated without hashes: ${error.stack || error.message}`);
+            return hashMap;
+        }
+        const initScriptPath = path.join(os.tmpdir(), `da-list-hashes-${crypto.randomUUID()}.gradle`);
+        try {
+            fs.writeFileSync(initScriptPath, GRADLE_HASH_INIT_SCRIPT);
+            let output;
+            try {
+                output = this._invokeCommand(gradle, [
+                    '-q', '--no-daemon',
+                    '--init-script', initScriptPath,
+                    'daListHashes',
+                ], { cwd: path.dirname(manifest) });
+            }
+            catch (error) {
+                console.warn(`Gradle hash init script failed, SBOM will be generated without hashes: ${error.stack || error.message}`);
+                return hashMap;
+            }
+            let attempted = 0;
+            let missed = 0;
+            for (const { id, file } of parseGradleHashScriptOutput(output.toString())) {
+                const coord = parseComponentId(id);
+                if (!coord) {
+                    continue;
+                }
+                // Build the key with the same canonical PURL builder parseDep uses for
+                // the lookup, so the stored key and the lookup key cannot drift.
+                const key = this.toPurl(coord.group, coord.name, coord.version).toString();
+                if (hashMap.has(key)) {
+                    continue;
+                }
+                attempted++;
+                try {
+                    const digest = await this.#hashFileStream(file);
+                    hashMap.set(key, [{ alg: 'SHA-256', content: digest }]);
+                }
+                catch (error) {
+                    // artifact file missing/unreadable — omit the hash for this component
+                    missed++;
+                    if (debug) {
+                        console.error(`Gradle hash: could not read artifact ${file} => ${error.message}`);
+                    }
+                }
+            }
+            if (missed > 0) {
+                console.warn(`Gradle hash: ${missed} of ${attempted} resolved artifacts could not be read, SBOM will be generated without hashes for those components`);
+            }
+        }
+        catch (error) {
+            // Unexpected failure (e.g. a programming error) is degraded to keep SBOM
+            // generation working, but the error is surfaced so it is not mistaken
+            // for ordinary graceful degradation.
+            console.warn(`Gradle artifact hashing failed, SBOM will be generated without hashes: ${error.stack || error.message}`);
+            return hashMap;
+        }
+        finally {
+            try {
+                fs.unlinkSync(initScriptPath);
+            }
+            catch { /* ignore */ }
+        }
+        return hashMap;
+    }
     /**
      * Extracts runtime and compile configurations from the dependency tree
      * @param {string} content - the dependency tree content
@@ -307,7 +415,7 @@ export default class Java_gradle extends Base_java {
      * @param properties {Object} - properties of the gradle project.
      * @return {string} return sbom json string of the build.gradle manifest file
      */
-    #buildDirectDependenciesSbom(content, properties, manifestPath, opts = {}) {
+    #buildDirectDependenciesSbom(content, properties, manifestPath, opts = {}, hashMap) {
         let sbom = new Sbom();
         let root = `${properties.group}:${properties[ROOT_PROJECT_KEY_NAME].match(/Root project '(.+)'/)[1]}:jar:${properties.version}`;
         let rootPurl = this.parseDep(root);
@@ -321,7 +429,7 @@ export default class Java_gradle extends Base_java {
         directDependencies.forEach((scope, dep) => {
             const purl = this.parseDep(dep);
             purl.scope = scope;
-            sbom.addDependency(rootPurl, purl, scope);
+            sbom.addDependency(rootPurl, purl, scope, hashMap?.get(purl.toString()));
         });
         return sbom.filterIgnoredDepsIncludingVersion(ignoredDeps).getAsJsonString(opts);
     }
@@ -424,6 +532,29 @@ const GRADLE_INIT_SCRIPT = `allprojects {
     }
 }
 `;
+/**
+ * Gradle init script that emits, per resolved module artifact, a structured line
+ * of the form `::DA_HASH::group:name:version::/absolute/file/path`. It obtains
+ * files from Gradle's resolution API (the same approach as the CycloneDX Gradle
+ * plugin) so it is robust to cache-layout changes and correctly reports
+ * classifiers and non-jar artifacts. Uses a lenient artifact view so
+ * unresolved/fileless artifacts are skipped rather than failing the build.
+ */
+const GRADLE_HASH_INIT_SCRIPT = `allprojects {
+    task daListHashes {
+        doLast {
+            configurations.findAll { it.canBeResolved }.each { cfg ->
+                cfg.incoming.artifactView { lenient = true }.artifacts.each { artifact ->
+                    def cid = artifact.id.componentIdentifier
+                    if (cid instanceof org.gradle.api.artifacts.component.ModuleComponentIdentifier) {
+                        println "::DA_HASH::\${cid.group}:\${cid.module}:\${cid.version}::\${artifact.file.absolutePath}"
+                    }
+                }
+            }
+        }
+    }
+}
+`;
 /**
  * Discover all build.gradle[.kts] manifest paths in a Gradle multi-project build.
  * Uses a custom init script to get structured project listing.
@@ -521,3 +652,50 @@ export function parseGradleInitScriptOutput(raw) {
     }
     return projects;
 }
+/**
+ * Parse the structured output from the Gradle hash init script.
+ * Each recognised line has the form `::DA_HASH::group:name:version::<file-path>`.
+ *
+ * @param {string} raw - Raw stdout from gradle
+ * @returns {{ id: string, file: string }[]} component id (`group:name:version`) and absolute artifact file path
+ */
+export function parseGradleHashScriptOutput(raw) {
+    const artifacts = [];
+    for (const rawLine of raw.split('\n')) {
+        const line = rawLine.trimEnd();
+        if (!line.startsWith('::DA_HASH::')) {
+            continue;
+        }
+        const prefix = '::DA_HASH::';
+        const remainder = line.substring(prefix.length);
+        const lastSep = remainder.lastIndexOf('::');
+        if (lastSep < 0) {
+            continue;
+        }
+        const id = remainder.substring(0, lastSep);
+        const file = remainder.substring(lastSep + 2);
+        if (id && file) {
+            artifacts.push({ id, file });
+        }
+    }
+    return artifacts;
+}
+/**
+ * Parse a Gradle module component id (`group:name:version`) into its coordinate
+ * parts. The caller builds the canonical PURL key from these parts using the same
+ * builder {@link parseDep} uses, so the stored key and the lookup key cannot drift.
+ *
+ * @param {string} id - the Gradle component id
+ * @returns {{group: string, name: string, version: string}|null} the parsed coordinate, or null when the id is malformed
+ */
+export function parseComponentId(id) {
+    const parts = id.split(':');
+    if (parts.length < 3) {
+        return null;
+    }
+    const [group, name, version] = parts;
+    if (!group || !name || !version) {
+        return null;
+    }
+    return { group, name, version };
+}