Update algorithm names to match CycloneDX schema#362
Update algorithm names to match CycloneDX schema#362n1ckl0sk0rtge wants to merge 1 commit intomainfrom
Conversation
Updates algorithm naming conventions in mapper model to align with the CycloneDX cryptography-defs.json specification: - SHA1 → SHA-1, SHA256 → SHA-256, SHA384 → SHA-384, SHA512 → SHA-512 - SHA3-* → SHA-3-* (e.g., SHA3-256 → SHA-3-256) - ChaCha20Poly1305 → ChaCha20-Poly1305 - RSASSA-PSS → RSA-PSS - DH → FFDH (Finite Field Diffie-Hellman) - KDF in Counter Mode → SP800-108-CounterKDF - KDF in Feedback Mode → SP800-108-FeedbackKDF - SPHINCS+ → SLH-DSA Also adds CycloneDX schema JavaDoc references to algorithm classes and updates test assertions across all language modules (Java, Python, Go). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
bhess
left a comment
bhess
left a comment
There was a problem hiding this comment.
Excellent!
Did you run an automatic check to verify that the patterns match?
I noticed a few that don’t, see the inline comments.
| PasswordBasedEncryption pbe = pbeOpt.get(); | ||
| assertThat(pbe.getName()).isEqualTo("PBES1"); | ||
| assertThat(pbe.asString()).isEqualTo("pbeWithHmacSHA256AndAES"); | ||
| assertThat(pbe.asString()).isEqualTo("pbeWithHmacSHA-256AndAES"); |
There was a problem hiding this comment.
See the pattern here: https://github.com/CycloneDX/specification/blob/8c16b5c89503657e14d618bd6851c416707a244b/schema/cryptography-defs.json#L1404
Should be
PBES1-AES-HMAC-SHA-256
|
|
||
| // Initialize RSADigestSigner | ||
| RSADigestSigner signer = new RSADigestSigner(digest, new ASN1ObjectIdentifier("1234")); | ||
| // Noncompliant@-1 {{(Signature) SHA256withRSA}} |
There was a problem hiding this comment.
This maps to RSA RSA-PKCS1-1.5-SHA-256, see
https://github.com/CycloneDX/specification/blob/8c16b5c89503657e14d618bd6851c416707a244b/schema/cryptography-defs.json#L19C23-L19C56
Similarly, all other patterns in the PR using "XYZwithRSA" or "XYZwithDSA" should be adapted.
|
This mapping isn't strictly true: |
|
What's the state of this? Will there be further changes? |
|
@san-zrl Yeah, hope I will find some time for that. It's work in progress to align the algorithm naming in sonar with the standardized naming of the cyclonedx registry. If you have some time for this, feel free to look into it :) |
3 participants
Summary
Naming changes:
Test plan
mvn spotless:apply🤖 Generated with Claude Code