Benign github Download

temurin17 jdk-17.0.20.1+1

CycloneDX software bill of materialsPins an expected SHA-256 digest constant

SHA-256e018cd2f5d7809edd9d61169894d946c92f71f9f1c0b5a999119269c440fe207

URLhttps://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.20.1%2B1/OpenJDK17U-sbom_x64_alpine-linux_hotspot_17.0.20.1_1.json

MaleculeH(Cr)Md

Evidence

CycloneDX software bill of materials lines 1–6

1{
"bomFormat" : "CycloneDX",
"specVersion" : "1.6",
"serialNumber" : "urn:uuid:1dbec6aa-27bc-44fc-ab5b-73db1fa70e9f",
"version" : 1,
"metadata" : { …

Pins an expected SHA-256 digest constant lines 37–47

33…  SHA1",
        "version" : "adoptopenjdk/alpine3_build_image@sha256:67c8d64b2e8b3ed047856cf6a7e5df247e16d2bba3ac1b5a42dd3efc7eb9503d"
      }
    ],
⋯7 lines