Hash support is limited and ambiguous in the case of SHA. CycloneDX is more precise and supports the following: ```xml <xs:simpleType name="hashAlg"> <xs:restriction base="xs:string"> <xs:enumeration value="MD5"/> <xs:enumeration value="SHA-1"/> <xs:enumeration value="SHA-256"/> <xs:enumeration value="SHA-384"/> <xs:enumeration value="SHA-512"/> <xs:enumeration value="SHA3-256"/> <xs:enumeration value="SHA3-512"/> </xs:restriction> </xs:simpleType> <xs:simpleType name="hashValue"> <xs:restriction base="xs:token"> <xs:pattern value="([a-fA-F0-9]{32})|([a-fA-F0-9]{40})|([a-fA-F0-9]{64})|([a-fA-F0-9]{96})|([a-fA-F0-9]{128})"/> </xs:restriction> </xs:simpleType> ``` It also supports simple validation of the field as well, although complex validation (e.g. SHA-512 alg with only 40 characters) is not supported.
Hash support is limited and ambiguous in the case of SHA. CycloneDX is more precise and supports the following:
It also supports simple validation of the field as well, although complex validation (e.g. SHA-512 alg with only 40 characters) is not supported.