fix apkdb checksum representation (anchore#1247)

Signed-off-by: Alex Goodman <[email protected]>

Signed-off-by: Alex Goodman <[email protected]>

syft/pkg/cataloger/apkdb/parse_apk_db.go

@@ -134,10 +134,7 @@ func parseApkDBEntry(reader io.Reader) (*pkg.ApkMetadata, error) {
 				log.Warnf("checksum field with no parent record: %q", value)
 				continue
 			}
-			fileRecord.Digest = &file.Digest{
-				Algorithm: "sha1",
-				Value:     value,
-			}
+			fileRecord.Digest = processChecksum(value)
 		case "I", "S":
 			// coerce to integer
 			iVal, err := strconv.Atoi(value)
@@ -161,3 +158,23 @@ func parseApkDBEntry(reader io.Reader) (*pkg.ApkMetadata, error) {
 
 	return &entry, nil
 }
+
+func processChecksum(value string) *file.Digest {
+	// from: https://wiki.alpinelinux.org/wiki/Apk_spec
+	// The package checksum field is the SHA1 hash of the second gzip stream (control stream) in the package. The
+	// binary hash digest is base64 encoded. This is prefixed with Q1 to differentiate it from the MD5 hashes
+	// used in older index formats. It is not possible to compute this checksum with standard command line tools
+	// but the apk-tools can compute it in their index operation.
+
+	// based on https://github.com/alpinelinux/apk-tools/blob/dd1908f2fc20b4cfe2c15c55fafaa5fadfb599dc/src/blob.c#L379-L393
+	// it seems that the old md5 checksum value was only the hex representation (not base64)
+	algorithm := "md5"
+	if strings.HasPrefix(value, "Q1") {
+		algorithm = "'Q1'+base64(sha1)"
+	}
+
+	return &file.Digest{
+		Algorithm: algorithm,
+		Value:     value,
+	}
+}