We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
Description
When inspecting the SBOMs attached to the latest release of rekor, the reported SHA1 hashes are all-zero. For example:
{ //... "files": [ { "fileName": "/rekor-cli-linux-amd64", "SPDXID": "SPDXRef-File-rekor-cli-linux-amd64-364aab0fbaf403d4", "checksums": [ { "algorithm": "SHA1", "checksumValue": "0000000000000000000000000000000000000000" } ], "licenseConcluded": "NOASSERTION", "copyrightText": "" } ], //... }
A quick inspection seems to indicate these SBOMs are generated by goreleaser.
Ideally, the sbom would include a proper hash of the binary.
Version
Not applicable
Description
When inspecting the SBOMs attached to the latest release of rekor, the reported SHA1 hashes are all-zero. For example:
{ //... "files": [ { "fileName": "/rekor-cli-linux-amd64", "SPDXID": "SPDXRef-File-rekor-cli-linux-amd64-364aab0fbaf403d4", "checksums": [ { "algorithm": "SHA1", "checksumValue": "0000000000000000000000000000000000000000" } ], "licenseConcluded": "NOASSERTION", "copyrightText": "" } ], //... }A quick inspection seems to indicate these SBOMs are generated by goreleaser.
Ideally, the sbom would include a proper hash of the binary.
Version
Not applicable