Add digest property to parent and nested java package metadata (#941)

internal/formats/spdx22json/to_format_model.go

@@ -55,14 +55,32 @@ func toPackages(catalog *pkg.Catalog, relationships []artifact.Relationship) []m
 	for _, p := range catalog.Sorted() {
 		license := spdxhelpers.License(p)
 		packageSpdxID := model.ElementID(p.ID()).String()
+		filesAnalyzed := false
 
+		// we generate digest for some Java packages
+		// see page 33 of the spdx specification for 2.2
+		// spdx.github.io/spdx-spec/package-information/#710-package-checksum-field
+		var checksums []model.Checksum
+		if p.MetadataType == pkg.JavaMetadataType {
+			javaMetadata := p.Metadata.(pkg.JavaMetadata)
+			if len(javaMetadata.ArchiveDigests) > 0 {
+				filesAnalyzed = true
+				for _, digest := range javaMetadata.ArchiveDigests {
+					checksums = append(checksums, model.Checksum{
+						Algorithm:     digest.Algorithm,
+						ChecksumValue: digest.Value,
+					})
+				}
+			}
+		}
 		// note: the license concluded and declared should be the same since we are collecting license information
 		// from the project data itself (the installed package files).
 		packages = append(packages, model.Package{
+			Checksums:        checksums,
 			Description:      spdxhelpers.Description(p),
 			DownloadLocation: spdxhelpers.DownloadLocation(p),
 			ExternalRefs:     spdxhelpers.ExternalRefs(p),
-			FilesAnalyzed:    false,
+			FilesAnalyzed:    filesAnalyzed,
 			HasFiles:         fileIDsForPackage(packageSpdxID, relationships),
 			Homepage:         spdxhelpers.Homepage(p),
 			// The Declared License is what the authors of a project believe govern the package