Benign github Download

temurin21 jdk-21.0.12.1+1

CycloneDX software bill of materialsPins an expected SHA-256 digest constant

SHA-256a7aa9fe3728721284ed13079caac5960ab29627eef2b529d3b5bc51d809cf11c

URLhttps://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-sbom_aarch64_alpine-linux_hotspot_21.0.12.1_1.json

MaleculeH(Cr)Md

Evidence

CycloneDX software bill of materials lines 1–6

1{
"bomFormat" : "CycloneDX",
"specVersion" : "1.6",
"serialNumber" : "urn:uuid:fede2fd8-d8ad-4520-b164-0bc469ee7f7e",
"version" : 1,
"metadata" : { …

Pins an expected SHA-256 digest constant lines 37–47

33…  SHA1",
        "version" : "adoptopenjdk/alpine3_build_image@sha256:67c8d64b2e8b3ed047856cf6a7e5df247e16d2bba3ac1b5a42dd3efc7eb9503d"
      }
    ],
⋯7 lines