CISA-CD-004 warning

Component Hash Algorithm is a registered IANA Hash Function Textual Name

Pack cisa-2026-v2.1 1.0.0

Severity: warning
This is one of the few elements with a genuine controlled vocabulary, so it is directly machine-checkable rather than a judgement call. An unrecognised algorithm name makes the hash unverifiable by an automated consumer.
Applies to: cyclonedx, spdx
Selector: {"cyclonedx":"$.components[*].hashes[*]","spdx":"$.packages[*].checksums[*]"}
On an empty selector: fire
The selector walks a collection and the assertion asks whether each member carries something. A document with zero members has not satisfied that requirement, it has avoided being measured against it, and reporting nothing would let an empty or absent collection read as a clean result. The absence is the violation.
Fix: Name the algorithm using an IANA Hash Function Textual Name. The algorithm should also be approved by a relevant authority such as NIST.
Source: cisa-2026-v2.1: Component Data, element 4, Component Hash Algorithm (New)
Note: Vocabulary source: https://www.iana.org/assignments/hash-function-text-names/hash-function-text-names.xhtml, cached in packages/rules/data/iana-hash-names.json with its retrieval date. The vocabulary check against packages/rules/data/iana-hash-names.json is performed by the loader after this presence assert, because three outcomes must be distinguished: maps to IANA, is a real algorithm with no IANA registration, or is unrecognised. Only the third is a finding.

Check a file against this

npx stratifypro check sbom.json --pack cisa-2026-v2.1
npx stratifypro explain CISA-CD-004 --pack cisa-2026-v2.1 prints this page.