Skip to content

Commit 66e7acc

Browse files
mprpicmprpic
authored
Merge pull request #59 from RedHatProductSecurity/fix-checksums
Fix checksums in container image manifests
2 parents b5c05a4 + 6988687 commit 66e7acc

24 files changed

Lines changed: 559 additions & 501 deletions

‎docs/purl.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -93,10 +93,10 @@ to specify the module. For example the purl for the `libecap` RPM in the `squid:
9393
would be the following:
9494

9595
```
96-
pkg:rpm/redhat/libecap@1.0.1-2.module%2Bel8.1.0%2B4044%2B36416a77?rpmmod=squid:4:8030020200828070549:30b713e6&arch=ppc64le&repository_id=rhel-8-for-x86_64-appstream-eus-rpms__8_DOT_6
96+
pkg:rpmmod/redhat/squid@4:8040020210420090912:522a0ee4?arch=ppc64le&repository_id=rhel-8-for-x86_64-appstream-eus-rpms__8_DOT_6
9797
```
9898

99-
The RPM module Name, Stream, Version, and Context can be parsed from `squid:4:8030020200828070549:30b713e6`.
99+
The version component of the purl is a value that contains the Stream, Version, and Context, delimited by a colon.
100100

101101
## Identifying container images
102102

@@ -115,7 +115,7 @@ its digest value for the amd64 architecture is:
115115
`sha256:8bca3b1be5750aeb94ef1351aa22636a54112f595d11a4d5c777890b80dfd387`. In purl, this information is represented as:
116116

117117
```
118-
pkg:oci/ubi@sha256%3A8bca3b1be5750aeb94ef1351aa22636a54112f595d11a4d5c777890b80dfd387?arch=amd64&repository_url=registry.redhat.io/ubi9/ubi&tag=9.3-1610
118+
pkg:oci/ubi@sha256:8bca3b1be5750aeb94ef1351aa22636a54112f595d11a4d5c777890b80dfd387?arch=amd64&repository_url=registry.redhat.io/ubi9/ubi&tag=9.3-1610
119119
```
120120

121121
Note that an image with a particular digest value may appear in multiple repositories, so the purl would only differ
@@ -129,7 +129,7 @@ A purl may also refer to the [Image Index](https://github.com/opencontainers/ima
129129
which is a higher-level representation of a set of image manifests. An image index has its own unique digest value:
130130

131131
```
132-
pkg:oci/ubi@sha256%3A66233eebd72bb5baa25190d4f55e1dc3fff3a9b77186c1f91a0abdb274452072?repository_url=registry.redhat.io/ubi9/ubi&tag=9.3-1610
132+
pkg:oci/ubi@sha256:66233eebd72bb5baa25190d4f55e1dc3fff3a9b77186c1f91a0abdb274452072?repository_url=registry.redhat.io/ubi9/ubi&tag=9.3-1610
133133
```
134134

135135
The `arch` qualifier is simply omitted in this purl.

‎pyproject.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,4 @@ line-length = 100
77
[tool.ruff.lint]
88
# https://beta.ruff.rs/docs/rules/
99
select = ["F", "E", "W", "I", "N"]
10+
ignore = ["E501"]

‎requirements/dev-requirements.txt‎

Lines changed: 402 additions & 340 deletions
Large diffs are not rendered by default.

‎sbom/examples/container_image/build/kernel-module-management-operator-container-1.1.2-25.spdx.json‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55
"creationInfo": {
66
"created": "2006-08-14T02:34:56Z",
77
"creators": [
8-
"Tool: example SPDX document only"
8+
"Tool: example SPDX document only",
9+
"Organization: Red Hat"
910
]
1011
},
1112
"name": "kernel-module-management-operator-container-1.1.2-25",
@@ -43,7 +44,7 @@
4344
{
4445
"referenceCategory": "PACKAGE-MANAGER",
4546
"referenceType": "purl",
46-
"referenceLocator": "pkg:oci/kernel-module-management-rhel9-operator@sha256%3Ad845f0bd93dad56c92c47e8c116a11a0cc5924c0b99aed912b4f8b54178efa98?arch=amd64"
47+
"referenceLocator": "pkg:oci/kernel-module-management-rhel9-operator@sha256%3Asha256%3Aed976a0ba418a498b05a56cb05afa0cb36a65e750771f3840b12e9bae3afb22d?arch=amd64"
4748
}
4849
],
4950
"checksums": [
@@ -64,7 +65,7 @@
6465
{
6566
"referenceCategory": "PACKAGE-MANAGER",
6667
"referenceType": "purl",
67-
"referenceLocator": "pkg:oci/kernel-module-management-rhel9-operator@sha256%3Ad845f0bd93dad56c92c47e8c116a11a0cc5924c0b99aed912b4f8b54178efa98?arch=arm64"
68+
"referenceLocator": "pkg:oci/kernel-module-management-rhel9-operator@sha256%3Asha256%3A9e74a91f532b7550ee909c6ce1636122982a5c5e32859c40c3bfe68231d31100?arch=arm64"
6869
}
6970
],
7071
"checksums": [
@@ -85,7 +86,7 @@
8586
{
8687
"referenceCategory": "PACKAGE-MANAGER",
8788
"referenceType": "purl",
88-
"referenceLocator": "pkg:oci/kernel-module-management-rhel9-operator@sha256%3Ad845f0bd93dad56c92c47e8c116a11a0cc5924c0b99aed912b4f8b54178efa98?arch=ppc64le"
89+
"referenceLocator": "pkg:oci/kernel-module-management-rhel9-operator@sha256%3Asha256%3A32a9929e6f11dfefb7a339d6767d1050cec2b24d397856cbd9b46a1bbc3f8827?arch=ppc64le"
8990
}
9091
],
9192
"checksums": [

‎sbom/examples/container_image/build/kernel-module-management-operator-container-1.1.2-25_amd64.spdx.json‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55
"creationInfo": {
66
"created": "2006-08-14T02:34:56Z",
77
"creators": [
8-
"Tool: example SPDX document only"
8+
"Tool: example SPDX document only",
9+
"Organization: Red Hat"
910
]
1011
},
1112
"name": "kernel-module-management-operator-container-1.1.2-25_amd64",
@@ -22,7 +23,7 @@
2223
{
2324
"referenceCategory": "PACKAGE-MANAGER",
2425
"referenceType": "purl",
25-
"referenceLocator": "pkg:oci/kernel-module-management-rhel9-operator@sha256%3Ad845f0bd93dad56c92c47e8c116a11a0cc5924c0b99aed912b4f8b54178efa98?arch=amd64"
26+
"referenceLocator": "pkg:oci/kernel-module-management-rhel9-operator@sha256%3Asha256%3Aed976a0ba418a498b05a56cb05afa0cb36a65e750771f3840b12e9bae3afb22d?arch=amd64"
2627
}
2728
],
2829
"checksums": [
@@ -4003,7 +4004,7 @@
40034004
{
40044005
"referenceCategory": "PACKAGE-MANAGER",
40054006
"referenceType": "purl",
4006-
"referenceLocator": "pkg:oci/rhel9-go-toolset@sha256%3A354b40a0fdcd1a9dd9af1b88f9a45fc2b0c8065980dfd9b5097e137a7db6e0bd?tag=1.19.4-18"
4007+
"referenceLocator": "pkg:oci/rhel9-go-toolset@sha256:354b40a0fdcd1a9dd9af1b88f9a45fc2b0c8065980dfd9b5097e137a7db6e0bd?tag=1.19.4-18"
40074008
}
40084009
],
40094010
"checksums": [
@@ -4024,7 +4025,7 @@
40244025
{
40254026
"referenceCategory": "PACKAGE-MANAGER",
40264027
"referenceType": "purl",
4027-
"referenceLocator": "pkg:oci/rhel@sha256%3A8759d95740eb14a6b6253a574edeea7de6840be30d38c630675ae2a0c76b9f93?tag=9.2-1191&repository_url=registry.redhat.io/rhel9-2-els"
4028+
"referenceLocator": "pkg:oci/rhel@sha256:8759d95740eb14a6b6253a574edeea7de6840be30d38c630675ae2a0c76b9f93?tag=9.2-1191&repository_url=registry.redhat.io/rhel9-2-els"
40284029
}
40294030
],
40304031
"checksums": [

‎sbom/examples/container_image/build/kernel-module-management-operator-container-1.1.2-25_arm64.spdx.json‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55
"creationInfo": {
66
"created": "2006-08-14T02:34:56Z",
77
"creators": [
8-
"Tool: example SPDX document only"
8+
"Tool: example SPDX document only",
9+
"Organization: Red Hat"
910
]
1011
},
1112
"name": "kernel-module-management-operator-container-1.1.2-25_arm64",
@@ -22,7 +23,7 @@
2223
{
2324
"referenceCategory": "PACKAGE-MANAGER",
2425
"referenceType": "purl",
25-
"referenceLocator": "pkg:oci/kernel-module-management-rhel9-operator@sha256%3Ad845f0bd93dad56c92c47e8c116a11a0cc5924c0b99aed912b4f8b54178efa98?arch=arm64"
26+
"referenceLocator": "pkg:oci/kernel-module-management-rhel9-operator@sha256%3Asha256%3A9e74a91f532b7550ee909c6ce1636122982a5c5e32859c40c3bfe68231d31100?arch=arm64"
2627
}
2728
],
2829
"checksums": [
@@ -4003,7 +4004,7 @@
40034004
{
40044005
"referenceCategory": "PACKAGE-MANAGER",
40054006
"referenceType": "purl",
4006-
"referenceLocator": "pkg:oci/rhel9-go-toolset@sha256%3A355b1d0a6e12250247d157949dcdc68d8a9508fc027223515a6d4662f4ec03f6?tag=1.19.4-18"
4007+
"referenceLocator": "pkg:oci/rhel9-go-toolset@sha256:355b1d0a6e12250247d157949dcdc68d8a9508fc027223515a6d4662f4ec03f6?tag=1.19.4-18"
40074008
}
40084009
],
40094010
"checksums": [
@@ -4024,7 +4025,7 @@
40244025
{
40254026
"referenceCategory": "PACKAGE-MANAGER",
40264027
"referenceType": "purl",
4027-
"referenceLocator": "pkg:oci/rhel@sha256%3A8d79ed0aaf36d7bf914411aab26e3a78308fe6217ca865ad7cc107c9078bfb12?tag=9.2-1191&repository_url=registry.redhat.io/rhel9-2-els"
4028+
"referenceLocator": "pkg:oci/rhel@sha256:8d79ed0aaf36d7bf914411aab26e3a78308fe6217ca865ad7cc107c9078bfb12?tag=9.2-1191&repository_url=registry.redhat.io/rhel9-2-els"
40284029
}
40294030
],
40304031
"checksums": [

‎sbom/examples/container_image/build/kernel-module-management-operator-container-1.1.2-25_ppc64le.spdx.json‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55
"creationInfo": {
66
"created": "2006-08-14T02:34:56Z",
77
"creators": [
8-
"Tool: example SPDX document only"
8+
"Tool: example SPDX document only",
9+
"Organization: Red Hat"
910
]
1011
},
1112
"name": "kernel-module-management-operator-container-1.1.2-25_ppc64le",
@@ -22,7 +23,7 @@
2223
{
2324
"referenceCategory": "PACKAGE-MANAGER",
2425
"referenceType": "purl",
25-
"referenceLocator": "pkg:oci/kernel-module-management-rhel9-operator@sha256%3Ad845f0bd93dad56c92c47e8c116a11a0cc5924c0b99aed912b4f8b54178efa98?arch=ppc64le"
26+
"referenceLocator": "pkg:oci/kernel-module-management-rhel9-operator@sha256%3Asha256%3A32a9929e6f11dfefb7a339d6767d1050cec2b24d397856cbd9b46a1bbc3f8827?arch=ppc64le"
2627
}
2728
],
2829
"checksums": [
@@ -4003,7 +4004,7 @@
40034004
{
40044005
"referenceCategory": "PACKAGE-MANAGER",
40054006
"referenceType": "purl",
4006-
"referenceLocator": "pkg:oci/rhel9-go-toolset@sha256%3Aa6b2fd68651aa7d544e53676f99f9017cf241b855bcdc2400d81081bba6f329a?tag=1.19.4-18"
4007+
"referenceLocator": "pkg:oci/rhel9-go-toolset@sha256:a6b2fd68651aa7d544e53676f99f9017cf241b855bcdc2400d81081bba6f329a?tag=1.19.4-18"
40074008
}
40084009
],
40094010
"checksums": [
@@ -4024,7 +4025,7 @@
40244025
{
40254026
"referenceCategory": "PACKAGE-MANAGER",
40264027
"referenceType": "purl",
4027-
"referenceLocator": "pkg:oci/rhel@sha256%3Acb23b09712fa36dfa2cd39ea60afb439c17fd0fec60a26a59e122618c8a33379?tag=9.2-1191&repository_url=registry.redhat.io/rhel9-2-els"
4028+
"referenceLocator": "pkg:oci/rhel@sha256:cb23b09712fa36dfa2cd39ea60afb439c17fd0fec60a26a59e122618c8a33379?tag=9.2-1191&repository_url=registry.redhat.io/rhel9-2-els"
40284029
}
40294030
],
40304031
"checksums": [

‎sbom/examples/container_image/build/ubi9-micro-container-9.4-6.1716471860.spdx.json‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55
"creationInfo": {
66
"created": "2006-08-14T02:34:56Z",
77
"creators": [
8-
"Tool: example SPDX document only"
8+
"Tool: example SPDX document only",
9+
"Organization: Red Hat"
910
]
1011
},
1112
"name": "ubi9-micro-container-9.4-6.1716471860",
@@ -48,12 +49,12 @@
4849
{
4950
"referenceCategory": "PACKAGE-MANAGER",
5051
"referenceType": "purl",
51-
"referenceLocator": "pkg:oci/ubi-micro@sha256%3A1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=ppc64le"
52+
"referenceLocator": "pkg:oci/ubi-micro@sha256%3Asha256%3A26f08722139c4da653b870272a192fac700960a3315baa1f79f83a4712a436d4?arch=ppc64le"
5253
},
5354
{
5455
"referenceCategory": "PACKAGE-MANAGER",
5556
"referenceType": "purl",
56-
"referenceLocator": "pkg:oci/ubi9-micro@sha256%3A1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=ppc64le"
57+
"referenceLocator": "pkg:oci/ubi9-micro@sha256%3Asha256%3A26f08722139c4da653b870272a192fac700960a3315baa1f79f83a4712a436d4?arch=ppc64le"
5758
}
5859
],
5960
"checksums": [
@@ -74,12 +75,12 @@
7475
{
7576
"referenceCategory": "PACKAGE-MANAGER",
7677
"referenceType": "purl",
77-
"referenceLocator": "pkg:oci/ubi-micro@sha256%3A1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=s390x"
78+
"referenceLocator": "pkg:oci/ubi-micro@sha256%3Asha256%3A2c9e70f4174747c6b53d253e879177c52731cc4bdc5fe9c6a2555412d849a952?arch=s390x"
7879
},
7980
{
8081
"referenceCategory": "PACKAGE-MANAGER",
8182
"referenceType": "purl",
82-
"referenceLocator": "pkg:oci/ubi9-micro@sha256%3A1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=s390x"
83+
"referenceLocator": "pkg:oci/ubi9-micro@sha256%3Asha256%3A2c9e70f4174747c6b53d253e879177c52731cc4bdc5fe9c6a2555412d849a952?arch=s390x"
8384
}
8485
],
8586
"checksums": [
@@ -100,12 +101,12 @@
100101
{
101102
"referenceCategory": "PACKAGE-MANAGER",
102103
"referenceType": "purl",
103-
"referenceLocator": "pkg:oci/ubi-micro@sha256%3A1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=arm64"
104+
"referenceLocator": "pkg:oci/ubi-micro@sha256%3Asha256%3Ac72c705fe4e9de2e065a817be2fbf1b6406010610532243727fdc3042227c71b?arch=arm64"
104105
},
105106
{
106107
"referenceCategory": "PACKAGE-MANAGER",
107108
"referenceType": "purl",
108-
"referenceLocator": "pkg:oci/ubi9-micro@sha256%3A1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=arm64"
109+
"referenceLocator": "pkg:oci/ubi9-micro@sha256%3Asha256%3Ac72c705fe4e9de2e065a817be2fbf1b6406010610532243727fdc3042227c71b?arch=arm64"
109110
}
110111
],
111112
"checksums": [
@@ -126,12 +127,12 @@
126127
{
127128
"referenceCategory": "PACKAGE-MANAGER",
128129
"referenceType": "purl",
129-
"referenceLocator": "pkg:oci/ubi-micro@sha256%3A1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=amd64"
130+
"referenceLocator": "pkg:oci/ubi-micro@sha256%3Asha256%3A213fd2a0116a76eaa274fee20c86eef4dfba9f311784e8fb7d7f5fc38b32f3ef?arch=amd64"
130131
},
131132
{
132133
"referenceCategory": "PACKAGE-MANAGER",
133134
"referenceType": "purl",
134-
"referenceLocator": "pkg:oci/ubi9-micro@sha256%3A1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=amd64"
135+
"referenceLocator": "pkg:oci/ubi9-micro@sha256%3Asha256%3A213fd2a0116a76eaa274fee20c86eef4dfba9f311784e8fb7d7f5fc38b32f3ef?arch=amd64"
135136
}
136137
],
137138
"checksums": [

‎sbom/examples/container_image/build/ubi9-micro-container-9.4-6.1716471860_amd64.spdx.json‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55
"creationInfo": {
66
"created": "2006-08-14T02:34:56Z",
77
"creators": [
8-
"Tool: example SPDX document only"
8+
"Tool: example SPDX document only",
9+
"Organization: Red Hat"
910
]
1011
},
1112
"name": "ubi9-micro-container-9.4-6.1716471860_amd64",
@@ -22,12 +23,12 @@
2223
{
2324
"referenceCategory": "PACKAGE-MANAGER",
2425
"referenceType": "purl",
25-
"referenceLocator": "pkg:oci/ubi-micro@sha256%3A1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=amd64"
26+
"referenceLocator": "pkg:oci/ubi-micro@sha256%3Asha256%3A213fd2a0116a76eaa274fee20c86eef4dfba9f311784e8fb7d7f5fc38b32f3ef?arch=amd64"
2627
},
2728
{
2829
"referenceCategory": "PACKAGE-MANAGER",
2930
"referenceType": "purl",
30-
"referenceLocator": "pkg:oci/ubi9-micro@sha256%3A1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=amd64"
31+
"referenceLocator": "pkg:oci/ubi9-micro@sha256%3Asha256%3A213fd2a0116a76eaa274fee20c86eef4dfba9f311784e8fb7d7f5fc38b32f3ef?arch=amd64"
3132
}
3233
],
3334
"checksums": [
@@ -488,7 +489,7 @@
488489
{
489490
"referenceCategory": "PACKAGE-MANAGER",
490491
"referenceType": "purl",
491-
"referenceLocator": "pkg:oci/ubi9@sha256%3A11d5b4a77bfc15341d4b6dffa3d6ed510189fec9583db77cfc107067b5f906c5?tag=9.4-947"
492+
"referenceLocator": "pkg:oci/ubi9@sha256:11d5b4a77bfc15341d4b6dffa3d6ed510189fec9583db77cfc107067b5f906c5?tag=9.4-947"
492493
}
493494
],
494495
"checksums": [

‎sbom/examples/container_image/build/ubi9-micro-container-9.4-6.1716471860_arm64.spdx.json‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55
"creationInfo": {
66
"created": "2006-08-14T02:34:56Z",
77
"creators": [
8-
"Tool: example SPDX document only"
8+
"Tool: example SPDX document only",
9+
"Organization: Red Hat"
910
]
1011
},
1112
"name": "ubi9-micro-container-9.4-6.1716471860_arm64",
@@ -22,12 +23,12 @@
2223
{
2324
"referenceCategory": "PACKAGE-MANAGER",
2425
"referenceType": "purl",
25-
"referenceLocator": "pkg:oci/ubi-micro@sha256%3A1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=arm64"
26+
"referenceLocator": "pkg:oci/ubi-micro@sha256%3Asha256%3Ac72c705fe4e9de2e065a817be2fbf1b6406010610532243727fdc3042227c71b?arch=arm64"
2627
},
2728
{
2829
"referenceCategory": "PACKAGE-MANAGER",
2930
"referenceType": "purl",
30-
"referenceLocator": "pkg:oci/ubi9-micro@sha256%3A1c8483e0fda0e990175eb9855a5f15e0910d2038dd397d9e2b357630f0321e6d?arch=arm64"
31+
"referenceLocator": "pkg:oci/ubi9-micro@sha256%3Asha256%3Ac72c705fe4e9de2e065a817be2fbf1b6406010610532243727fdc3042227c71b?arch=arm64"
3132
}
3233
],
3334
"checksums": [
@@ -488,7 +489,7 @@
488489
{
489490
"referenceCategory": "PACKAGE-MANAGER",
490491
"referenceType": "purl",
491-
"referenceLocator": "pkg:oci/ubi9@sha256%3Acad979d0a2eb78699b62efaf4797f51c4781dfc2a17d9bef5a3a2f5d67cc8e8c?tag=9.4-947"
492+
"referenceLocator": "pkg:oci/ubi9@sha256:cad979d0a2eb78699b62efaf4797f51c4781dfc2a17d9bef5a3a2f5d67cc8e8c?tag=9.4-947"
492493
}
493494
],
494495
"checksums": [

0 commit comments

Comments
 (0)