openvex / go-vex

Go module to generate and transform VEX documents
Apache License 2.0
34 stars 15 forks source link

removes extra colon delimiter before componentid #65

Closed p-ssanders closed 1 year ago

p-ssanders commented 1 year ago

without this change, the VEX.GenerateCanonicalID function produces a string like:

:1671745003::pkg:oci/example@sha256:47fed8868b46b060efb8699dc40e981a0c785650223e03602d8c4493fc75b68c

without this change, the VEX.GenerateCanonicalID function produces a string like:

1671745003:pkg:oci/example@sha256:47fed8868b46b060efb8699dc40e981a0c785650223e03602d8c4493fc75b68c

since the string is hashed, the extra colon delimiter changes the hash in a meaningful way.

the reason for this behavior is that the cstringFromComponent function produces a string with a leading colon, and those strings were then joined into a string with another leading colon.