Per T359634: Adopt Software Bill of Materials (SBOM) for MediaWiki we are replacing the in-house foreign-resources.yaml format with the CycloneDX standard. foreign-resources.yaml was managed via manageForeignResources.php (and the ForeignResourceManager class) which can:

• validate the foreign-resources.yaml file format
• download the file(s) or directory or tarball from the given URL, and verify it matches the hashes in the foreign-resources.yaml
• download the file(s) etc from the given URL, and verify it matches the content in the repository
• download the file(s) etc and update the ones on disk (after one has updated the version/URL in the foreign-resources.yaml file), potentially filtering which files are stored, and mapping where they are stored, and optionally apply a set of transformations to the files (currently the only supported one is prefixing specified CSS files with /*@nomin*/)
• download the file(s) etc and print their hashes, so the foreign-resources.yaml file can be updated (in case of upstreams who don't publish hashes for their releases)

ForeignResourceStructureTest does the first three of these (only for MediaWiki core - that's T330508).

All this should be migrated for CycloneDX (which presumably already has tooling for it).