save progress

src/AirGap/StellaOps.AirGap.Importer/Reconciliation/Parsers/CycloneDxParser.cs

@@ -4,6 +4,7 @@
 // Part of Step 2: Evidence Collection (Task T5)
 // =============================================================================
 
+using System.Globalization;
 using System.Text.Json;
 using System.Text.Json.Nodes;
 
@@ -121,7 +122,7 @@ public sealed class CycloneDxParser : ISbomParser
             {
                 if (metadataProp.TryGetProperty("timestamp", out var timestampProp))
                 {
-                    if (DateTimeOffset.TryParse(timestampProp.GetString(), out var parsed))
+                    if (TryParseTimestamp(timestampProp.GetString(), out var parsed))
                     {
                         createdAt = parsed;
                     }
@@ -214,21 +215,7 @@ public sealed class CycloneDxParser : ISbomParser
         }
 
         // Determine primary digest (prefer SHA-256)
-        string? digest = null;
-        if (hashes.TryGetValue("SHA-256", out var sha256))
-        {
-            digest = NormalizeDigest("sha256:" + sha256);
-        }
-        else if (hashes.TryGetValue("SHA256", out sha256))
-        {
-            digest = NormalizeDigest("sha256:" + sha256);
-        }
-        else if (hashes.Count > 0)
-        {
-            // Use first available hash
-            var first = hashes.First();
-            digest = NormalizeDigest($"{first.Key.ToLowerInvariant().Replace("-", "")}:{first.Value}");
-        }
+        var digest = TrySelectSha256Digest(hashes);
 
         // If no digest, this component can't be indexed by digest
         if (string.IsNullOrEmpty(digest))
@@ -333,4 +320,24 @@ public sealed class CycloneDxParser : ISbomParser
     {
         return ArtifactIndex.NormalizeDigest(digest);
     }
+
+    private static bool TryParseTimestamp(string? value, out DateTimeOffset timestamp)
+    {
+        timestamp = default;
+        return !string.IsNullOrWhiteSpace(value) &&
+               DateTimeOffset.TryParse(value, CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind, out timestamp);
+    }
+
+    private static string? TrySelectSha256Digest(IReadOnlyDictionary<string, string> hashes)
+    {
+        foreach (var key in new[] { "SHA-256", "SHA256", "sha256" })
+        {
+            if (hashes.TryGetValue(key, out var sha256))
+            {
+                return NormalizeDigest("sha256:" + sha256);
+            }
+        }
+
+        return null;
+    }
 }