CISA-CD-003 warning

Component Hash Value is present, or explicitly unknown

Pack cisa-2026-v2.1 1.0.0

Severity: warning
A hash is what lets a recipient verify they hold the same artifact the SBOM describes. The document permits 'unknown' when the author had no access to the executable artifact, which is legitimate for a before-build SBOM, so this rule accepts an explicit unknown and fires only on silence.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.components[*]","spdx":"$.packages[*]"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Record the hash of the executable component artifact as ASCII hexadecimal. If the artifact was not available, state that the value is unknown.
Source: cisa-2026-v2.1: Component Data, element 3, Component Hash Value (New)
Note: Interacts with CISA-MD-005: a 'before build' generation context makes 'unknown' here expected rather than sloppy. A tool should not flag this as hard when the context explains it.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-CD-003 --pack cisa-2026-v2.1 prints this page.