sbom: make internal SPDX relationships reproducible - #2439
Merged
xnox merged 1 commit intoAug 27, 2026
Chainguard Guardener / Enforce - Commit Signing
succeeded
Aug 27, 2026 in 1s
Successfully verified commit signature.
| CLAIM | DESCRIPTION | |
|---|---|---|
| ✅ | Found Git signature | |
| ✅ | Validated Git signature | |
| ✅ | Validated Rekor entry | |
| ✅ | Allowed by policy |
Details
Certificate
Details
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 287149268841707946826421866287861992385858848873 (0x324c37f26a5a9a302301e2ccc632a1629d914869)
Signature Algorithm: ECDSA-SHA384
Issuer: O=sigstore.dev,CN=sigstore-intermediate
Validity
Not Before: Aug 27 22:29:04 2026 UTC
Not After : Aug 27 22:39:04 2026 UTC
Subject: Subject Public Key Info:
Public Key Algorithm: ECDSA
Public-Key: (256 bit)
X:
71:a8:f5:9d:13:f9:15:d6:bf:23:1b:f0:be:a6:65:
7b:e4:a2:0c:c0:33:5d:4c:03:e5:b9:2b:4a:39:aa:
3b:11
Y:
df:54:11:a4:bb:98:20:f2:fa:3f:13:74:8b:d1:42:
22:ae:59:87:81:b9:7a:d4:0f:83:bb:3f:5c:fa:e8:
ca:1c
Curve: P-256
X509v3 extensions:
X509v3 Key Usage: critical
Digital Signature
X509v3 Extended Key Usage:
Code Signing
X509v3 Subject Key Identifier:
6F:37:6C:5F:DD:21:00:2E:91:61:04:B1:0D:D5:96:EF:67:49:59:E6
X509v3 Authority Key Identifier:
keyid:DF:D3:E9:CF:56:24:11:96:F9:A8:D8:E9:28:55:A2:C6:2E:18:64:3F
X509v3 Subject Alternative Name: critical
email:kevin.davis@chainguard.dev
oidcIssuer:
https://accounts.google.com
Unknown extension 1.3.6.1.4.1.57264.1.8
Unknown extension 1.3.6.1.4.1.57264.1.24
Signed Certificate Timestamp:
BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoEVXTM8AAAQDAEcwRQIgURZH//3P4Tun62svNojeASYIqi6X1SbIoLTNUXekWwUCIQC1Vvo/VBngVNUYY2HveT2YscCj6eOVskUrB2DSNS/UBg==
Signature Algorithm: ECDSA-SHA384
30:64:02:30:55:06:43:b5:06:55:c7:bb:e3:e9:ab:b4:ac:4c:
40:20:cd:41:58:86:d1:bd:7a:73:c3:1d:dc:e7:08:55:75:22:
a2:02:8f:1d:2a:e4:09:ad:20:6f:ba:aa:46:98:6c:af:02:30:
76:51:6e:1b:14:64:7a:cf:9f:79:37:b4:eb:b1:36:59:d8:4e:
51:79:73:5c:d3:07:a6:8c:bb:80:31:9b:ca:4c:16:44:c8:63:
11:f5:9a:c2:59:22:9b:61:e1:6f:7f:ab
Rekor Entry
Details
{
"body": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJiMzUwY2MwN2NiM2IxMmMxZTVkNTcyNjk0MmZkYTUyZjg3YjEwNjA3ZDM0NDgyYzNjOTk0NzI2OWJlZjQ4OGM1In19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FWUNJUUQ2WDVrQmxKdW5uSmNwUTNuSWJEZi9UZTh1VjBEKzM3cU9vMWtvS3l6K3pRSWhBTWtDRmRpUFZuWElNMkFoc3ZXK2FFTk9oVHNRYnhEcm5TRFMwTHdTNFQ2ZyIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVUk1la05EUVhKaFowRjNTVUpCWjBsVlRXdDNNemh0Y0dGdGFrRnFRV1ZNVFhocVMyaFpjREpTVTBkcmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDlFU1ROTmFrbDVUMVJCTUZkb1kwNU5hbGwzVDBSSk0wMXFTWHBQVkVFd1YycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZqWVdveGJsSlFOVVprWVM5SmVIWjNkbkZhYkdVclUybEVUVUY2V0ZWM1JEVmlhM0lLVTJwdGNVOTRTR1pXUWtkcmRUVm5aemgyYnk5Rk0xTk1NRlZKYVhKc2JVaG5ZbXcyTVVFclJIVjZPV01yZFdwTFNFdFBRMEZrVlhkblowaFNUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZpZW1SekNsZzVNR2hCUXpaU1dWRlRlRVJrVjFjM01tUktWMlZaZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDB0QldVUldVakJTUVZGSUwwSkNOSGRJU1VWaFlUSldNbUZYTkhWYVIwWXlZVmhPUVZreWFHaGhWelZ1WkZkR2VWcEROV3RhV0ZsM1MxRlpTd3BMZDFsQ1FrRkhSSFo2UVVKQlVWRmlZVWhTTUdOSVRUWk1lVGxvV1RKT2RtUlhOVEJqZVRWdVlqSTVibUpIVlhWWk1qbDBUVU56UjBOcGMwZEJVVkZDQ21jM09IZEJVV2RGU0ZGM1ltRklVakJqU0UwMlRIazVhRmt5VG5aa1Z6VXdZM2sxYm1JeU9XNWlSMVYxV1RJNWRFMUdjMGREYVhOSFFWRlJRbWMzT0hjS1FWSm5SVlJSZUV4Uk1taFdaVVV4UldGNlNrOVNSa1Y2Vkcxd1JtVkZOVlZSVkVwUFZrZE5lVlJyVW5KTmF6VkZVVlpPU1UxdFozZGFSV2hEWldzNWNBcFdXR3hUWVZaV05WVnRNVWRoYkd0NVQxUkdhV0pzU2paVVJ6RnJaRzFKZVZwSVRtRlZlbFp4V1dwSmQwMUpSMHRDWjI5eVFtZEZSVUZrV2pWQloxRkRDa0pJZDBWbFowSTBRVWhaUVROVU1IZGhjMkpJUlZSS2FrZFNOR050VjJNelFYRktTMWh5YW1WUVN6TXZhRFJ3ZVdkRE9IQTNielJCUVVGSFoxSldaRTBLZW5kQlFVSkJUVUZTZWtKR1FXbENVa1pyWmk4dll5OW9UelptY21GNU9ESnBUalJDU21kcGNVeHdabFpLYzJsbmRFMHhVbVEyVW1KQ1VVbG9RVXhXVndvcmFqbFZSMlZDVlRGU2FHcFpaVGsxVUZwcGVIZExVSEEwTlZkNVVsTnpTRmxPU1RGTU9WRkhUVUZ2UjBORGNVZFRUVFE1UWtGTlJFRXlZMEZOUjFGRENrMUdWVWRSTjFWSFZtTmxOelFyYlhKMFMzaE5VVU5FVGxGV2FVY3dZakUyWXpoTlpETlBZMGxXV0ZWcGIyZExVRWhUY210RFlUQm5ZamR4Y1ZKd2FITUtjbmRKZDJSc1JuVkhlRkpyWlhNclptVlVaVEEyTjBVeVYyUm9UMVZZYkhwWVRrMUljRzk1TjJkRVIySjVhM2RYVWsxb2FrVm1WMkYzYkd0cGJUSklhQXBpTXl0eUNpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9fX19",
"integratedTime": 1787869750,
"logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d",
"logIndex": 2619664626,
"verification": {
"inclusionProof": {
"checkpoint": "rekor.sigstore.dev - 1193050959916656506\n2498375491\n9S6SDmVmBAvFqPEhqVOz+WluIzCpGIbDILM3TTQB3Yc=\n\n— rekor.sigstore.dev wNI9ajBFAiEA+vzrZdR1u/vHXqF1Y5Bb0fa4My4iDkew9HRf8yzYbWgCIFLJoOjtusQP/gllW+/ntf+/jO+00Xl0MR+S4UcHYAKO\n",
"hashes": [
"2460bcd5c3eb3708e6ca69578a785c6fe20b808db1ea0f61f750b5871baa44df",
"ae0dc7f7492aae94dc7eeda2b84cbd6a3544dc973885ff5496ffad94a5b9f97f",
"0a093bcb1340287c983e090c8308d4e0ecabdd8bd81c87bfe0dd7bbdd50ed132",
"5d84248b29b3f9a70bbe721d6f4edc8b58a0951d7a8c4a1acafcc2d99f1dd55c",
"4f6e983be9714669da78cdd7087128d155e548741aab1d79bfb35cba63dbe540",
"6dc0f336b34b2548ace5d21c9dd3a2893cd1002c25a9502a1fc7ffbc7768c6dc",
"1d1256c4d05411bb6326e19187b90d5604109d6a6e64c9f1ba4cbf59d5534ab2",
"e45e002acbf37988a8f22b2f239a108a64ea23d2a42d5fa6521c9e1c1b18a70b",
"5ae9e59691c81e26b4457dd1e0011bf4345be840e38c99f3f04b64367873d6ec",
"a7fe6cdff79a015f210e8864ec84ecff78d5c1cecad62229a4ec4a68d0b56b04",
"7193056aabe0acbc9ae77a4657d463e85df469ea307db76b793a5c2cfbdd08d8",
"77bbf2dc62aec25a0d724ffd92238592f11f1ff169de6f79d4aa74fd04256e36",
"e92dcdcebda73fee79e99faf8425e8ac2c6258bacd2ba4724133332364a4c886",
"37bb0194659a9e5f3ac30219ae6e6059d5c161a242c0b80078782a4abad5a238",
"91d3cb3691c73f84e2c99232c043b745c4bc81c0a0baf68817a4cc2cd1bc846d",
"1b6e63ceada7569775b8e86e16f56e4cd7515691fd4aa7196213bc95576d07d8",
"04593905001fdcf27b3c81e74eb9fec9a143bf7edf7784598833264765ff764b",
"699fac19dd64c188176908fcc67623a5e7cccbc11ec5debb74af219093ae62d6",
"d45675976a44fb7a28ebe73d4848fbc07d7cf6e6264743a18eb9b94a1c3d2f57",
"079b0716c8e774c8f99381d3e4b0c6ff5f30bd71ddcceb9ab949db778e99863d",
"86ebc0e566cc01b333036e36b23091dc73798fc33c1e28fef6a257dc0e8253f6",
"42eb622ce01f42e9301d543bd7b80cfbde0517fe4689e97cda46d7913c7f17cc",
"ed37c309a316804c1224465dfdedf76f6e3dd7dac5e080c92e66ea34d44d859b",
"d077ddc43b7fcc6ba064b22e1dab2b74b116f6cf0e693ca4492a811031505ddc",
"4a775b30a56d7137a7024c22d8905f1b30fe9a17b1a75a896d1218f80d494485",
"c47fc30ac78b1ebf5e2a8613f2ab0e4592bbcd5744198587b95b6c56b0fde706"
],
"logIndex": 2497760364,
"rootHash": "f52e920e6566040bc5a8f121a953b3f9696e2330a91886c320b3374d3401dd87",
"treeSize": 2498375491
},
"signedEntryTimestamp": "MEUCIATAp40+bctKMnAzjfNggtwu0Qq6Q+2/MPrSRD0zDuzcAiEA7Leih35MmIp3v46X4z9dW3WI2ISrvvk5Rci8GS8PZA8="
}
}
Loading