Skip to content

Omit empty sbom-format from Verify invocation - #1028

Merged
cpanato merged 1 commit into
chainguard-dev:mainfrom
puerco:spdx-default
Sep 2, 2026
Merged

Omit empty sbom-format from Verify invocation#1028
cpanato merged 1 commit into
chainguard-dev:mainfrom
puerco:spdx-default

Omit empty sbom-format from Verify invocation

5f3212a
Select commit
Loading
Failed to load commit list.
Chainguard Guardener / Enforce - Commit Signing succeeded Sep 2, 2026 in 1s

Successfully verified commit signature.

CLAIM DESCRIPTION
Found Git signature
Validated Git signature
Validated Rekor entry
Allowed by policy

Details

Certificate

Details
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 236955800118053748051032015603847591730178962918 (0x2981772f15579f7b68a800e2143fa0aec3cc35e6)
    Signature Algorithm: ECDSA-SHA384
        Issuer: O=sigstore.dev,CN=sigstore-intermediate
        Validity
            Not Before: Aug 22 00:55:01 2026 UTC
            Not After : Aug 22 01:05:01 2026 UTC
        Subject:         Subject Public Key Info:
            Public Key Algorithm: ECDSA
                Public-Key: (256 bit)
                X:
                    7b:1c:74:ec:33:05:bc:6a:2a:28:75:5a:f8:c3:db:
                    89:3b:b5:3e:76:0d:d2:79:84:91:57:de:b3:49:44:
                    ad:34
                Y:
                    c9:68:04:d9:45:b6:c1:33:98:ab:2e:48:59:5c:5d:
                    eb:85:5a:8e:60:1c:16:59:bb:ca:48:e9:16:33:d0:
                    97:63
                Curve: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Subject Key Identifier:
                65:42:76:39:58:30:1D:50:E8:4C:5B:FB:63:EA:33:60:58:3E:9B:EF
            X509v3 Authority Key Identifier:
                keyid:DF:D3:E9:CF:56:24:11:96:F9:A8:D8:E9:28:55:A2:C6:2E:18:64:3F
            X509v3 Subject Alternative Name: critical
                email:puerco@carabiner.dev
            oidcIssuer:
                https://accounts.google.com
            Unknown extension 1.3.6.1.4.1.57264.1.8
            Unknown extension 1.3.6.1.4.1.57264.1.24
            Signed Certificate Timestamp:
                BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABoCb2xgwAAAQDAEcwRQIhANzsdO2AAwinugDmTcjMzkD2fRvebXGtSQD2YXKh2bbSAiAn0ti+Dpk5w9u6FZ19mt8+AWYiMNElhjplu38S4h72SA==

    Signature Algorithm: ECDSA-SHA384
         30:66:02:31:00:a9:fe:20:10:f5:77:87:c5:15:91:40:a9:bb:
         a2:c8:84:19:de:8a:3f:cb:5e:1f:4c:34:46:e6:29:5d:2d:09:
         2f:90:25:b2:75:20:c8:3f:7b:d7:4a:0d:97:4a:76:92:73:02:
         31:00:9f:b0:19:b1:42:c1:79:00:30:8e:40:f4:5a:d4:8e:a4:
         79:c5:76:e5:05:7a:af:8a:72:4f:6a:c4:38:18:28:cc:90:3f:
         69:0d:61:d8:41:ad:c5:3e:2a:70:6b:41:08:8c

Rekor Entry

Details
{
  "body": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIzMzFhMjNjYmFmYTBkZjc2OWRhZjZmM2E3ZGI1MDY3ZDNkNWQ0MTJjZjFkMmU5YmYyYzBhZTZjZDQwMDUzNmVmIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FWUNJUURGSmtzTG4wUUhTOUNIZjJzOXJqTjZxaGJSYUdobzdjWm1DRVhJQ000aERBSWhBTmtWRDI4U0hMZjFYdGZQZTQ3QVF3TVB3UFAyZnhKaVRQT3dQalpkWXdabSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVUkxla05EUVhKRFowRjNTVUpCWjBsVlMxbEdNMHg0VmxodU0zUnZjVUZFYVVaRUsyZHljMUJOVG1WWmQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDlFU1hsTlJFRXhUbFJCZUZkb1kwNU5hbGwzVDBSSmVVMUVSWGRPVkVGNFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZsZUhnd04wUk5SblpIYjNGTFNGWmhLMDFRWW1sVWRURlFibGxPTUc1dFJXdFdabVVLY3pCc1JYSlVWRXBoUVZSYVVtSmlRazAxYVhKTWEyaGFXRVl6Y21oV2NVOVpRbmRYVjJKMlMxTlBhMWROT1VOWVdUWlBRMEZqT0hkblowaE1UVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZhVlVveUNrOVdaM2RJVmtSdlZFWjJOMWtyYjNwWlJtY3JiU3M0ZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDBsbldVUldVakJTUVZGSUwwSkNaM2RHYjBWVlkwaFdiR050VG5aUlIwNW9ZMjFHYVdGWE5XeGphVFZyV2xoWmQwdFJXVXRMZDFsQ1FrRkhSQXAyZWtGQ1FWRlJZbUZJVWpCalNFMDJUSGs1YUZreVRuWmtWelV3WTNrMWJtSXlPVzVpUjFWMVdUSTVkRTFEYzBkRGFYTkhRVkZSUW1jM09IZEJVV2RGQ2toUmQySmhTRkl3WTBoTk5reDVPV2haTWs1MlpGYzFNR041Tlc1aU1qbHVZa2RWZFZreU9YUk5Sbk5IUTJselIwRlJVVUpuTnpoM1FWSm5SVlJSZUV3S1VUSm9WbVZGTVZWV1ZGWlBVa1ZGZVZSc1VsWk5NRGxGVkZST1RsWkdhM2hVVjNCV1pEQTFObFJXVGtsTmJXZDNXa1ZvUTJWck9YQldXR3hUWVZaV05RcFZiVEZIWVd4cmVVOVVSbWxpYkVvMlZFY3hhMlJ0U1hsYVNFNWhWWHBXY1ZscVNYZE5TVWRMUW1kdmNrSm5SVVZCWkZvMVFXZFJRMEpJZDBWbFowSTBDa0ZJV1VFelZEQjNZWE5pU0VWVVNtcEhValJqYlZkak0wRnhTa3RZY21wbFVFc3pMMmcwY0hsblF6aHdOMjgwUVVGQlIyZEtkbUpIUkVGQlFVSkJUVUVLVW5wQ1JrRnBSVUV6VDNnd04xbEJSRU5MWlRaQlQxcE9lVTE2VDFGUVdqbEhPVFYwWTJFeFNrRlFXbWhqY1VoYWRIUkpRMGxEWmxNeVREUlBiVlJ1UkFveU4yOVdibGd5WVRONk5FSmFhVWwzTUZOWFIwOXRWemRtZUV4cFNIWmFTVTFCYjBkRFEzRkhVMDAwT1VKQlRVUkJNbXRCVFVkWlEwMVJRM0F2YVVGUkNqbFlaVWg0VWxkU1VVdHROMjl6YVVWSFpEWkxVRGgwWlVnd2R6QlNkVmx3V0ZNd1NrdzFRV3h6YmxWbmVVUTVOekV3YjA1c01IQXlhMjVOUTAxUlEyWUtjMEp0ZUZGelJqVkJSRU5QVVZCU1lURkpObXRsWTFZeU5WRldObkkwY0hsVU1uSkZUMEpuYjNwS1FTOWhVVEZvTWtWSGRIaFVOSEZqUjNSQ1EwbDNQUW90TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09In19fX0=",
  "integratedTime": 1787360102,
  "logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d",
  "logIndex": 2556402236,
  "verification": {
    "inclusionProof": {
      "checkpoint": "rekor.sigstore.dev - 1193050959916656506\n2434498023\n5AkiIy8YamaCDNZyvIVictWFzjhMpqWjv91Y9Cp/uls=\n\n— rekor.sigstore.dev wNI9ajBEAiBKTTfLehw8BsqV0mvDk9YQoyhjub+0z8zvrclbfkXzjgIgIgO28D23E8yYJPNqIG2dl94IIYBrk6cGzTYUlqw6J+k=\n",
      "hashes": [
        "7666391af426f2d6b32c6a42582280034db83c2c41e63f84457a110c5579e057",
        "4c032c404b07766ee8b931e01f650734be4bc8bc9b10b7debab5170fca05cc31",
        "1aca535bf75a8004996fd41fa23f1a1cc8145d548878784a677e4496b1b7a24f",
        "3d70e82fd76043471bca122d29c1605991fc88ae3f059f73c1296734a2229c56",
        "d990397fe559b33f7c8a5e68984ec18c54bfb75d1bac590060f79a6fcf2f4f02",
        "a7e2f4a85df38a2a40882f74b9e65d9d9c1b95bca118035fee611dd4f6aafa1e",
        "c80777a7885693197bc3be68de7c965776cba881c088563ef9cf23f609942a88",
        "1a4f765690b229785d85f3ec0a51fea26dede67f2caee3bbdf0d1b0c1d9f2f27",
        "fbd6b0fc0db4bded18180ac5a3b66dd92d9146498c403d088e86984f71bdaccd",
        "251c2f5b4eca6e73268b900e2212e2ab345b2f8bc89c7165a92653fec5795dd9",
        "99e517965f0ad01da01e18edc3660d6d62099ef7b23a542dfd1a76ef1d8db01d",
        "5035b92dfa5ca737209d13f651003db91a00ed0fec0eaa6660d9e75954bbfd94",
        "50f7da86732c728afd152f097cec38b715e60cf50367b52c2c77c01649d94a82",
        "583bb857c9bf7ce89ce01a876d5e67a626eec01d54b14e65e401e015e86aa213",
        "336c00cb755d54d62e5915c6b5435b5c0ab06b5354fc811865c9bf4cd684a3eb",
        "75da61d429662c42092d6eb82d8aa64ea6113b51e85922fafe93b369f9c016be",
        "7557a20ce74029cf30ca6eae844fdff95055f892eb63f691d73031b540a3f08d",
        "11582295300d23799e9c831191b4971babed17f2c1d008dee85445fddc39de58",
        "c6e801aaa39af78bf4153c9711e294b80f6489708e6f7592c861b2e769f625d0",
        "4a775b30a56d7137a7024c22d8905f1b30fe9a17b1a75a896d1218f80d494485",
        "c47fc30ac78b1ebf5e2a8613f2ab0e4592bbcd5744198587b95b6c56b0fde706"
      ],
      "logIndex": 2434497974,
      "rootHash": "e40922232f186a66820cd672bc856272d585ce384ca6a5a3bfdd58f42a7fba5b",
      "treeSize": 2434498023
    },
    "signedEntryTimestamp": "MEQCIHdOwCU22cmr+JzuUQXK4tHP+AiTsSeLSPjvuYtlek3ZAiApc4t/JETHmRQifIZkzkf0TpuLfCzAcTQQyGLmelaMFw=="
  }
}