BUG: XML SWID tags fail to parse when hash attribute is present in File element

[carl-wallace]

What version of the package are you using?

Current

Does this issue reproduce with the latest release?

Yes

What OS and CPU architecture are you using (go env)?

GOARCH="amd64"
GOOS="darwin"

GOHOSTARCH="amd64"
GOHOSTOS="darwin"

What did you do?

Tried parsing XML SWID tags generated using NIST's swid-tools and StrongSwan's swidGenerator using the FromXML method on swid.SoftwareIdentity.

What did you expect to see?

I expected it to successfully parse.

What did you see instead?

An error indicating bad format: expecting :

An issue is that the codify invocation at https://github.com/veraison/swid/blob/main/hashentry.go#L216 is expecting : but is being passed . If the SWID tag is modified to include SHA256: in the value, for example, parsing is successful.

Additionally, there appears to be intolerance of multiple hash attributes. Two samples (one with one hash attribute and one with two) are below. When the sample with two hash attrs was modified as described above to parse successfully then serialized as JSON, only the second attribute was emitted.

[thomas-fossati]

Thanks @carl-wallace for finding this.

In your report you say:

Two samples (one with one hash attribute and one with two) are below

but I don't know what samples you are referring to. Could you please clarify?

[carl-wallace]

Weird. They were at the bottom of that text block (or at least I thought they were). I copied them into the attached file.
two_samples.txt