Open hidde-jan opened 1 month ago
@cpanato any idea why? At a glance at documentation, I don’t see anything about configuring checksums
I've reproduced the issue, and it is not in the goreleaser, it is in the syft
tool that is used to generate the sbom
and seems there is an issue already for this https://github.com/anchore/syft/issues/2307
Description
When inspecting the SBOMs attached to the latest release of rekor, the reported SHA1 hashes are all-zero. For example:
A quick inspection seems to indicate these SBOMs are generated by goreleaser.
Ideally, the sbom would include a proper hash of the binary.
Version
Not applicable