CISA 2026 SBOM Minimum Elements mandates per-component digests or hashes as a minimum element. I believe this is the most controversial and problematic change in the requirements. That is if we want those hashes to have some meaning. Apparently, there are 2 intended meanings: Here is why verification is an issue. My favourite example is… Continue reading Component Hashes in SBOMs
Tag: hash
Get sha256 hash on a directory
Update (2020-03-06): Following this conversation on reddit with issue raised by u/atoponce I updated the result to include file renames and moves and added LC_ALL=C section. Today I started building a new use case for Reliza Hub where we would match file system digest of the deployed directory to what we have in our metadata.… Continue reading Get sha256 hash on a directory