@sourcey/catalog-verifier 1.2.5 → 1.2.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +5 -0
- package/SBOM.cdx.json +1 -1
- package/SOURCEY-LICENSE-POLICY.json +0 -2
- package/THIRD_PARTY_NOTICES.json +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,11 @@
|
|
|
2
2
|
|
|
3
3
|
Release notes are maintained per immutable package version in GitHub Releases.
|
|
4
4
|
|
|
5
|
+
## 1.2.6
|
|
6
|
+
|
|
7
|
+
- The license policy carries no copied digest of a license text the package supplies; each text's
|
|
8
|
+
digest is in the SBOM, computed from its bytes.
|
|
9
|
+
|
|
5
10
|
## 1.2.5
|
|
6
11
|
|
|
7
12
|
- The taxonomy names its categories in full: AI and machine learning, APIs and integrations,
|
package/SBOM.cdx.json
CHANGED
|
@@ -25,7 +25,6 @@
|
|
|
25
25
|
"version": "2.0.3",
|
|
26
26
|
"license": "MIT",
|
|
27
27
|
"path": "distributions/licenses/err-code-2.0.3.txt",
|
|
28
|
-
"sha256": "sha256:5cfd203775f0b7ba0bd84e059d37b224c161497bf2a2d649a13fabce46c1c452",
|
|
29
28
|
"reason": "Upstream declares MIT in package.json and ships no license text in its package or its repository at the release's commit; this is the standard MIT text naming the package's declared author. Pulled by @sigstore/sign through promise-retry."
|
|
30
29
|
},
|
|
31
30
|
{
|
|
@@ -33,7 +32,6 @@
|
|
|
33
32
|
"version": "3.1.1",
|
|
34
33
|
"license": "Apache-2.0",
|
|
35
34
|
"path": "distributions/licenses/sigstore-verify-3.1.1.txt",
|
|
36
|
-
"sha256": "sha256:364a130d2ca340bd56eb1e6d045fc6929bb0f9d0aa018f2c1949b29517e1cdd0",
|
|
37
35
|
"reason": "Upstream declares Apache-2.0 in package.json and its package ships no license text; this is sigstore-js's root LICENSE at the release's commit (1a8709a), byte-identical to the text @sigstore/core ships. Pulled by provenry's GitHub Actions verifiers."
|
|
38
36
|
}
|
|
39
37
|
]
|
package/THIRD_PARTY_NOTICES.json
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
"distribution_id": "catalog-verifier",
|
|
4
4
|
"package_name": "@sourcey/catalog-verifier",
|
|
5
5
|
"package_license": "MIT",
|
|
6
|
-
"license_policy_sha256": "sha256:
|
|
6
|
+
"license_policy_sha256": "sha256:8af9408a6aa99084144722d97c73a813c2b2bff7190aecdf1da078948590c486",
|
|
7
7
|
"dependencies": [
|
|
8
8
|
{
|
|
9
9
|
"name": "@sigstore/verify",
|