Benign github Download

temurin21 jdk-21.0.12.1+1

CycloneDX software bill of materialsPins an expected SHA-256 digest constant

SHA-256fb8db94e50e50b42677b25e8920516b328de0a743d636c4f539b335e3fabb643

URLhttps://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.12.1%2B1/OpenJDK21U-sbom_x64_alpine-linux_hotspot_21.0.12.1_1.json

MaleculeH(Cr)Md

Evidence

CycloneDX software bill of materials lines 1–6

1{
"bomFormat" : "CycloneDX",
"specVersion" : "1.6",
"serialNumber" : "urn:uuid:5c861909-f554-4e34-a754-e0ad1f821430",
"version" : 1,
"metadata" : { …

Pins an expected SHA-256 digest constant lines 37–47

33…  SHA1",
        "version" : "adoptopenjdk/alpine3_build_image@sha256:67c8d64b2e8b3ed047856cf6a7e5df247e16d2bba3ac1b5a42dd3efc7eb9503d"
      }
    ],
⋯7 lines