Benign github Download

temurin17 jdk-17.0.20+8

CycloneDX software bill of materialsPins an expected SHA-256 digest constant

SHA-2563a3d6b398b6b0aeac1899454ca2229e846178972132aa4bc30ccda4cdb4b6751

URLhttps://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.20%2B8/OpenJDK17U-sbom_aarch64_linux_hotspot_17.0.20_8.json

MaleculeH(Cr)Md

Evidence

CycloneDX software bill of materials lines 1–6

1{
"bomFormat" : "CycloneDX",
"specVersion" : "1.6",
"serialNumber" : "urn:uuid:71492a2c-7273-4189-87e5-5ad03f615d87",
"version" : 1,
"metadata" : { …

Pins an expected SHA-256 digest constant lines 37–41

33…  SHA1",
        "version" : "adoptopenjdk/centos7_build_image@sha256:1d968f847005b3f4988c0dd69c6e9afaacfb5bee12a4ebefc47050f3fc78c14b adoptopenjdk/centos7_build_image@sha256:288cf57eafc8e545d3700f0fdd35a9f2b37f35fdecc60e0ee318f528be88cb56"
      }
    ],
 …