AlmaLinux / AlmaLinux/alma-sbom

Question: what is unsigned_hash in immudb?

未关闭
#29 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Python
星标
16
派生
8
PR 合并指标
30 天内没有已合并 PR

描述

related issue: #30

Two immudb-hash record are stored in immudb for one source rpm.

The Hash value of nmstate-2.2.23-1.el9_3.src.rpm is:
```
$ sha256sum nmstate-2.2.23-1.el9_3.src.rpm
1beff4d72ade264196bc7467a505ca7a9a766163deb5d54409e7dcc622c3ad05 nmstate-2.2.23-1.el9_3.src.rpm
```

I checked the immudb record for this value and found the value unsigned_hash:
```
{
'Name': 'nmstate-2.2.23-1.el9_3.src.rpm',
'Hash': '1beff4d72ade264196bc7467a505ca7a9a766163deb5d54409e7dcc622c3ad05'
'Metadata': {
'sbom_api_ver': '0.2',
'unsigned_hash': 'cc9d4c40630118ea7fbf478437c81f404a9dc3af15307b541e48160de53f0a3c',
}
}
```

I also checked immudb record using this unsigned_hash, then I got almost same recored for nmstate-2.2.23-1.el9_3.src.rpm. (but 'Hash' and 'timestamp' are diferent):
```
{
'Name': 'nmstate-2.2.23-1.el9_3.src.rpm',
'Hash': 'cc9d4c40630118ea7fbf478437c81f404a9dc3af15307b541e48160de53f0a3c',
'Metadata': {
(...)
}
}
```

Checking https://build.almalinux.org/build/8307, the hash value of i686 source rpm is '1beff4d72ade264196bc7467a505ca7a9a766163deb5d54409e7dcc622c3ad05'(real hash value), and the hash value of other arch source rpms are 'cc9d4c40630118ea7fbf478437c81f404a9dc3af15307b541e48160de53f0a3c'(unsigned_hash).

What is unsigned_hash in immudb? and What is the difference between these records?

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。