Add SBOM, symbols, traces, and VEX files for CVE-2022-21661 SQLi case

- Created CycloneDX and SPDX SBOM files for both reachable and unreachable images.
- Added symbols.json detailing function entry and sink points in the WordPress code.
- Included runtime traces for function calls in both reachable and unreachable scenarios.
- Developed OpenVEX files indicating vulnerability status and justification for both cases.
- Updated README for evaluator harness to guide integration with scanner output.

src/Scanner/StellaOps.Scanner.Worker/Processing/Surface/SurfaceManifestPublisher.cs

@@ -1,7 +1,6 @@
 using System.Collections.Generic;
 using System.Collections.Immutable;
 using System.IO;
-using System.Security.Cryptography;
 using System.Text;
 using System.Text.Json;
 using System.Text.Json.Serialization;
@@ -15,6 +14,7 @@ using StellaOps.Scanner.Storage.ObjectStore;
 using StellaOps.Scanner.Storage.Repositories;
 using StellaOps.Scanner.Storage.Services;
 using StellaOps.Scanner.Surface.Env;
+using StellaOps.Cryptography;
 
 namespace StellaOps.Scanner.Worker.Processing.Surface;
 
@@ -58,6 +58,7 @@ internal sealed class SurfaceManifestPublisher : ISurfaceManifestPublisher
     private readonly ISurfaceEnvironment _surfaceEnvironment;
     private readonly TimeProvider _timeProvider;
     private readonly ILogger<SurfaceManifestPublisher> _logger;
+    private readonly ICryptoHash _hash;
 
     public SurfaceManifestPublisher(
         IArtifactObjectStore objectStore,
@@ -66,7 +67,8 @@ internal sealed class SurfaceManifestPublisher : ISurfaceManifestPublisher
         IOptions<ScannerStorageOptions> storageOptions,
         ISurfaceEnvironment surfaceEnvironment,
         TimeProvider timeProvider,
-        ILogger<SurfaceManifestPublisher> logger)
+        ILogger<SurfaceManifestPublisher> logger,
+        ICryptoHash hash)
     {
         _objectStore = objectStore ?? throw new ArgumentNullException(nameof(objectStore));
         _artifactRepository = artifactRepository ?? throw new ArgumentNullException(nameof(artifactRepository));
@@ -75,6 +77,7 @@ internal sealed class SurfaceManifestPublisher : ISurfaceManifestPublisher
         _surfaceEnvironment = surfaceEnvironment ?? throw new ArgumentNullException(nameof(surfaceEnvironment));
         _timeProvider = timeProvider ?? throw new ArgumentNullException(nameof(timeProvider));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        _hash = hash ?? throw new ArgumentNullException(nameof(hash));
     }
 
     public async Task<SurfaceManifestPublishResult> PublishAsync(SurfaceManifestRequest request, CancellationToken cancellationToken)
@@ -245,14 +248,13 @@ internal sealed class SurfaceManifestPublisher : ISurfaceManifestPublisher
             _ => format.ToString().ToLowerInvariant()
         };
 
-    private static string ComputeDigest(ReadOnlySpan<byte> content)
+    private string ComputeDigest(ReadOnlySpan<byte> content)
     {
-        Span<byte> hash = stackalloc byte[32];
-        SHA256.HashData(content, hash);
-        return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
+        var hex = _hash.ComputeHashHex(content, HashAlgorithms.Sha256);
+        return $"sha256:{hex}";
     }
 
-    private static string ComputeDigest(byte[] content)
+    private string ComputeDigest(byte[] content)
         => ComputeDigest(content.AsSpan());
 
     private static string NormalizeDigest(string digest)

src/Scanner/StellaOps.Scanner.Worker/Processing/Surface/SurfaceManifestStageExecutor.cs

@@ -3,7 +3,6 @@ using System.Collections.Immutable;
 using System.Diagnostics;
 using System.Globalization;
 using System.Reflection;
-using System.Security.Cryptography;
 using System.Text;
 using System.Text.Json;
 using System.Text.Json.Serialization;
@@ -15,6 +14,7 @@ using StellaOps.Scanner.Surface.Env;
 using StellaOps.Scanner.Surface.FS;
 using StellaOps.Scanner.Storage.Catalog;
 using StellaOps.Scanner.Worker.Diagnostics;
+using StellaOps.Cryptography;
 
 namespace StellaOps.Scanner.Worker.Processing.Surface;
 
@@ -37,6 +37,7 @@ internal sealed class SurfaceManifestStageExecutor : IScanStageExecutor
     private readonly ISurfaceEnvironment _surfaceEnvironment;
     private readonly ScannerWorkerMetrics _metrics;
     private readonly ILogger<SurfaceManifestStageExecutor> _logger;
+    private readonly ICryptoHash _hash;
     private readonly string _componentVersion;
 
     public SurfaceManifestStageExecutor(
@@ -44,13 +45,15 @@ internal sealed class SurfaceManifestStageExecutor : IScanStageExecutor
         ISurfaceCache surfaceCache,
         ISurfaceEnvironment surfaceEnvironment,
         ScannerWorkerMetrics metrics,
-        ILogger<SurfaceManifestStageExecutor> logger)
+        ILogger<SurfaceManifestStageExecutor> logger,
+        ICryptoHash hash)
     {
         _publisher = publisher ?? throw new ArgumentNullException(nameof(publisher));
         _surfaceCache = surfaceCache ?? throw new ArgumentNullException(nameof(surfaceCache));
         _surfaceEnvironment = surfaceEnvironment ?? throw new ArgumentNullException(nameof(surfaceEnvironment));
         _metrics = metrics ?? throw new ArgumentNullException(nameof(metrics));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        _hash = hash ?? throw new ArgumentNullException(nameof(hash));
         _componentVersion = Assembly.GetExecutingAssembly().GetName().Version?.ToString() ?? "unknown";
     }
 
@@ -274,11 +277,10 @@ internal sealed class SurfaceManifestStageExecutor : IScanStageExecutor
         return digest.Trim();
     }
 
-    private static string ComputeDigest(ReadOnlySpan<byte> content)
+    private string ComputeDigest(ReadOnlySpan<byte> content)
     {
-        Span<byte> hash = stackalloc byte[32];
-        SHA256.HashData(content, hash);
-        return $"sha256:{Convert.ToHexString(hash).ToLowerInvariant()}";
+        var hex = _hash.ComputeHashHex(content, HashAlgorithms.Sha256);
+        return $"sha256:{hex}";
     }
 
     private static readonly IFormatProvider CultureInfoInvariant = System.Globalization.CultureInfo.InvariantCulture;