diff --git a/Cargo.lock b/Cargo.lock index e2349889e1..6625630895 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -9001,6 +9001,7 @@ dependencies = [ "actix-http", "actix-web", "anyhow", + "async-trait", "bytes", "chrono", "cpe", @@ -9024,6 +9025,7 @@ dependencies = [ "osv", "packageurl 0.7.1", "regex", + "reqwest 0.13.5", "roxmltree", "rstest", "sanitize-filename", diff --git a/entity/src/sbom_crypto.rs b/entity/src/sbom_crypto.rs index 2a7cd211b4..e1a9dbfc09 100644 --- a/entity/src/sbom_crypto.rs +++ b/entity/src/sbom_crypto.rs @@ -10,6 +10,7 @@ pub struct Model { pub asset_type: CryptoAssetType, pub properties: serde_json::Value, pub oid: Option, + pub policy_verdict: Option, } /// Possible types of the cryptographic assets within a CBOM diff --git a/etc/conforma/policy.yaml b/etc/conforma/policy.yaml new file mode 100644 index 0000000000..6add1407c7 --- /dev/null +++ b/etc/conforma/policy.yaml @@ -0,0 +1,5 @@ +description: 'PQC Readiness Policy for trustify CBOM evaluation' +sources: + - name: PQC Readiness + policy: + - /policy diff --git a/etc/conforma/policy/policy.rego b/etc/conforma/policy/policy.rego new file mode 100644 index 0000000000..d846bee782 --- /dev/null +++ b/etc/conforma/policy/policy.rego @@ -0,0 +1,81 @@ +package main + +import future.keywords.contains +import future.keywords.if +import future.keywords.in + +# Each entry in input.algorithms is: +# { "node_id": str, "sbom_id": str, "name": str, "oid": str|null, "properties": obj } +# +# Conforma strips extra fields from deny/warn results and only preserves "msg". +# We embed the node_id as a "[node_id:]" prefix so trustify can parse it +# back out and match violations to individual AlgorithmPolicyResult rows. + +deny contains result if { + algo := input.algorithms[_] + _is_non_compliant(algo) + result := { + "msg": sprintf("[node_id:%v] Algorithm '%v' is non-compliant (weak or broken)", [algo.node_id, algo.name]), + } +} + +warn contains result if { + algo := input.algorithms[_] + not _is_pqc_safe(algo.name) + not _is_non_compliant(algo) + result := { + "msg": sprintf("[node_id:%v] Algorithm '%v' is not PQC-safe (classical — consider migration)", [algo.node_id, algo.name]), + } +} + +# ── PQC-safe detection ──────────────────────────────────────────────────────── + +_is_pqc_safe(name) if { + normalized := upper(replace(name, "-", "")) + some pattern in {"MLKEM", "KYBER", "MLDSA", "DILITHIUM", "SLHDSA", "SPHINCS"} + contains(normalized, pattern) +} + +# ── Non-compliant detection ─────────────────────────────────────────────────── + +_is_non_compliant(algo) if { + normalized := upper(replace(algo.name, "-", "")) + some pattern in {"MD5", "RC4", "RC2"} + contains(normalized, pattern) +} + +_is_non_compliant(algo) if { + _is_sha1(algo.name) +} + +# DES but not 3DES / Triple-DES / DESede +_is_non_compliant(algo) if { + normalized := upper(replace(algo.name, "-", "")) + contains(normalized, "DES") + not contains(normalized, "3DES") + not contains(normalized, "TDES") + not contains(normalized, "TRIPLE") + not contains(normalized, "DESEDE") +} + +# RSA with key size <= 1024 +_is_non_compliant(algo) if { + normalized := upper(replace(algo.name, "-", "")) + contains(normalized, "RSA") + to_number(algo.properties.algorithmProperties.parameterSetIdentifier) <= 1024 +} + +# DSA (exact match) with key size <= 1024 +_is_non_compliant(algo) if { + upper(replace(algo.name, "-", "")) == "DSA" + to_number(algo.properties.algorithmProperties.parameterSetIdentifier) <= 1024 +} + +# ── SHA-1 helper ────────────────────────────────────────────────────────────── +# Matches SHA1 / SHA-1 but NOT SHA128, SHA256, SHA384, SHA512, etc. + +_is_sha1(name) if { + normalized := upper(replace(name, "-", "")) + # Contains "SHA1" not immediately followed by a digit + regex.match(`.*SHA1([^0-9].*)?$`, normalized) +} diff --git a/etc/conforma/policy/pqc_strict.rego b/etc/conforma/policy/pqc_strict.rego new file mode 100644 index 0000000000..d976808bd0 --- /dev/null +++ b/etc/conforma/policy/pqc_strict.rego @@ -0,0 +1,40 @@ +# pqc_strict.rego +# Allowlist: ML-KEM, ML-DSA, SLH-DSA only (all parameter sets) +# Everything else is a FAIL. + +package pqc.strict + +import future.keywords.in +import future.keywords.contains +import future.keywords.if + +pqc_allowed := {"ML-KEM", "ML-DSA", "SLH-DSA"} + +crypto_algorithms := [c | + c := input.components[_] + c.type == "cryptographic-asset" + c.cryptoProperties.assetType == "algorithm" +] + +violations contains v if { + c := crypto_algorithms[_] + family := c.cryptoProperties.algorithmProperties.algorithmFamily + not family in pqc_allowed + + v := { + "rule": "NOT_PQC_APPROVED", + "severity": "FAIL", + "component": c.name, + "family": family, + "message": sprintf("'%v' (family: %v) is not in the approved PQC set {ML-KEM, ML-DSA, SLH-DSA}.", [c.name, family]), + } +} + +compliant := count(violations) == 0 + +summary := { + "compliant": compliant, + "total_algorithms": count(crypto_algorithms), + "violation_count": count(violations), + "violations": violations, +} diff --git a/etc/deploy/compose/compose-conforma.yaml b/etc/deploy/compose/compose-conforma.yaml new file mode 100644 index 0000000000..bdc301888e --- /dev/null +++ b/etc/deploy/compose/compose-conforma.yaml @@ -0,0 +1,14 @@ +services: + conforma: + image: quay.io/conforma/cli:latest + # Conforma binds to 127.0.0.1 inside the container; host networking is required + # for rootless podman + slirp4netns so the trustify server can reach it. + network_mode: host + volumes: + - ../../conforma:/policy:ro,Z + command: > + validate input + --server + --server-port 8085 + --policy /policy/policy.yaml + restart: unless-stopped diff --git a/etc/test-data/cyclonedx/cryptographic/cosign-cbom.json b/etc/test-data/cyclonedx/cryptographic/cosign-cbom.json new file mode 100644 index 0000000000..10203a716f --- /dev/null +++ b/etc/test-data/cyclonedx/cryptographic/cosign-cbom.json @@ -0,0 +1,19169 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.7", + "serialNumber": "urn:uuid:c572f3b7-672a-48c2-b314-a068cb4344e5", + "version": 2, + "metadata": { + "timestamp": "2026-08-06T11:09:15Z", + "tools": { + "components": [ + { + "group": "@cyclonedx", + "name": "cdxgen", + "version": "12.8.2", + "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.2", + "type": "application", + "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.2", + "publisher": "OWASP Foundation", + "authors": [ + { + "name": "OWASP Foundation" + } + ] + } + ] + }, + "authors": [ + { + "name": "OWASP Foundation" + } + ], + "lifecycles": [ + { + "phase": "build" + } + ], + "component": { + "group": "", + "name": "github.com/sigstore/cosign/v3", + "version": "", + "purl": "pkg:golang/github.com/sigstore/cosign/v3", + "bom-ref": "pkg:golang/github.com/sigstore/cosign/v3", + "scope": "required", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/go.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.26.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:toolVersion", + "value": "2.5.1" + }, + { + "name": "cdx:golem:callGraphMode", + "value": "static" + }, + { + "name": "cdx:golem:dataFlowMode", + "value": "none" + }, + { + "name": "cdx:golem:dataFlowCallGraphMode", + "value": "static" + }, + { + "name": "cdx:golem:noRecurse", + "value": "false" + }, + { + "name": "cdx:golem:includeAllFlows", + "value": "false" + }, + { + "name": "cdx:golem:dataFlowPacks", + "value": "all" + }, + { + "name": "cdx:golem:packageCount", + "value": "80" + }, + { + "name": "cdx:golem:moduleCount", + "value": "259" + }, + { + "name": "cdx:golem:fileCount", + "value": "232" + }, + { + "name": "cdx:golem:importCount", + "value": "1554" + }, + { + "name": "cdx:golem:declarationCount", + "value": "1389" + }, + { + "name": "cdx:golem:usageCount", + "value": "7922" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "7922" + }, + { + "name": "cdx:golem:buildDirectiveCount", + "value": "8" + }, + { + "name": "cdx:golem:securitySignalCount", + "value": "148" + }, + { + "name": "cdx:golem:diagnosticCount", + "value": "160" + }, + { + "name": "cdx:golem:licenseFileModuleCount", + "value": "256" + }, + { + "name": "cdx:golem:buildDirectiveKinds", + "value": "go-build,legacy-build" + }, + { + "name": "cdx:golem:securitySignalCategories", + "value": "deserialization,environment,filesystem,http-client,http-server,process-execution,reflection,syscall,template,tls" + }, + { + "name": "cdx:golem:securitySignalSeverities", + "value": "high,info,medium" + }, + { + "name": "cdx:golem:goDirectiveVersion", + "value": "1.26.0" + }, + { + "name": "cdx:golem:cryptoLibraryCount", + "value": "62" + }, + { + "name": "cdx:golem:cryptoAssetCount", + "value": "3" + }, + { + "name": "cdx:golem:cryptoOperationCount", + "value": "310" + }, + { + "name": "cdx:golem:cryptoMaterialCount", + "value": "345" + }, + { + "name": "cdx:golem:cryptoProtocolCount", + "value": "1" + }, + { + "name": "cdx:golem:cryptoFindingCount", + "value": "58" + }, + { + "name": "cdx:golem:cryptoAlgorithms", + "value": "rsa,sha-256" + }, + { + "name": "cdx:golem:cryptoMaterialTypes", + "value": "credential,key,password,private-key,public-key,token" + }, + { + "name": "cdx:golem:cryptoProtocols", + "value": "tls" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sigstore/cosign/v3" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.26.0" + }, + { + "name": "cdx:golem:mainModule", + "value": "true" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "blank" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "call" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageKind", + "value": "reference" + }, + { + "name": "cdx:golem:usageKind", + "value": "functionValueCall" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "5184" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "391" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1688" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "3105" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "type": "application", + "evidence": { + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 230 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 242 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 166 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 192 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 212 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 185 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 166 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 192 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 215 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 227 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 245 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 252 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 256 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 259 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 262 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 266 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 273 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 281 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 285 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 288 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 293 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 295 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 298 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 301 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 305 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 306 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 307 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 309 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 312 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 313 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 318 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 320 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 323 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 327 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 330 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 332 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 336 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 337 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 340 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 343 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 346 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 348 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 351 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 354 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 360 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 361 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 365 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 375 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 383 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 387 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 391 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 393 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 395 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 409 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 411 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 412 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 415 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 417 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 419 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 422 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 428 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 430 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 441 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 443 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 445 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 449 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 453 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 457 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 459 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 461 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 466 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 467 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 471 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 474 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 479 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 480 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 485 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 486 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 487 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 488 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 491 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 494 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 495 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 498 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 500 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 505 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 508 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 510 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 515 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 521 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 526 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 528 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 531 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 532 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 533 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 534 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 535 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 541 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 544 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 545 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 546 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 551 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 553 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 556 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 560 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 568 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 570 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 574 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 575 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 578 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 580 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 586 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 593 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 595 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 596 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 597 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 599 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 18 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug/provider.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug/provider.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug/provider.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/fulcio/fulcio.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/fulcio/fulcio.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/fulcio/fulcio.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/env.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/env.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/experimental.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/experimental.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/flags.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate_key_pair.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate_key_pair.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/key.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/load.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/load.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/reference.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 229 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 245 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 249 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/rekor.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/save.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/save.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/security_key.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/security_key.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 161 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/tree.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/tree.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/tree.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/triangulate.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/triangulate.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 222 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 230 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 257 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 286 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 288 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 289 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 290 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 291 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 295 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 299 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 308 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 311 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 316 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 320 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/rekor/rekor.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/rekor/rekor.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 259 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 263 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 269 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 279 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 286 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 292 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 297 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 307 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 317 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 322 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 324 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 327 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 330 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 332 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 335 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 336 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 339 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 340 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 343 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 351 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 354 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 361 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 364 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 372 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 375 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 384 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 388 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 391 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 394 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 405 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 408 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 411 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 415 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 420 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 423 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 425 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 429 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 433 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 439 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 441 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 443 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 447 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 448 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 452 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 456 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 459 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 464 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 469 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 472 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 169 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 169 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 212 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 250 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 288 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 289 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 291 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 292 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 297 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 321 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 324 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 330 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 339 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 344 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 366 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 371 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 375 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 380 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 381 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 386 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 388 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 410 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 434 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 435 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 436 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 450 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 453 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 458 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 460 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 465 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 470 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 478 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 481 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 484 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 487 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 490 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 493 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 526 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 528 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 531 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 535 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 572 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 574 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 585 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 586 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 589 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 590 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 591 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 594 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 595 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 605 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 607 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 614 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 616 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 624 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 626 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 638 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 640 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 185 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 192 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 199 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 215 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 227 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 242 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 260 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 261 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 267 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 268 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 275 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 277 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 280 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 303 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 316 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 333 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 400 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 435 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 447 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 484 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 496 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 538 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 550 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 573 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 210 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 215 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 222 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 227 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 229 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 230 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 241 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 242 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 245 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 252 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 256 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 259 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 263 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 268 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 311 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 313 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 314 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 317 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 322 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 323 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 324 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 325 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 326 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 327 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 328 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 329 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 330 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 332 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 334 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 335 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 336 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 337 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 338 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 339 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 340 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 341 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 342 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 343 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 344 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 345 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 346 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 347 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 348 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 349 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 350 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 352 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 355 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 356 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 358 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 359 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 362 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 366 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 371 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 404 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 406 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 407 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 410 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 415 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 416 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 417 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 418 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 419 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 420 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 421 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 422 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 423 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 425 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 427 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 428 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 429 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 430 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 431 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 432 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 433 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 434 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 435 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 436 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 437 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 438 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 439 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 440 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 441 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 442 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 443 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 444 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 445 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 446 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 447 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 449 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 452 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 460 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 461 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 463 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 464 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 467 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 471 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 210 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 215 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 222 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 242 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 247 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 249 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 250 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 257 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 262 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 273 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 285 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 286 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 295 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 297 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 299 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 300 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 301 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 305 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 306 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 308 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 309 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 310 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 313 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 314 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 315 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 318 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 319 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 320 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 323 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 329 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 350 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 354 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 362 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 376 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 414 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 429 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 433 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 434 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 436 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 438 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 442 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 446 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 449 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 453 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 458 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 460 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 467 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 471 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 199 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 241 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 251 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 256 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 262 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 263 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 272 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 284 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 285 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 315 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 227 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 245 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 266 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 268 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 280 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 210 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 229 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 249 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 251 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 271 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 282 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 286 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 296 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 305 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 309 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 314 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 326 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 161 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 210 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 259 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 266 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 271 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 281 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 283 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 293 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 294 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 296 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 300 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 301 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 302 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 306 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 307 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 308 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 309 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 311 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 319 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 323 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 327 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 331 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 333 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 334 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 335 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 342 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 345 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 346 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 350 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 354 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 355 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 364 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 365 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 367 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 384 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 387 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 395 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 401 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 406 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/error_wrap.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/errors.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/errors.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/errors.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/errors.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/generate_docs.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/generate_docs.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/generate_docs.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/errors.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/sign.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/env.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/env.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/env.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/log.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/log.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/log.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/log.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/prompt.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/prompt.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/prompt.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/prompt.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/prompt.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/spinner.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/spinner.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/spinner.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/blob/load.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/blob/load.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 192 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 229 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 296 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 338 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 347 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 369 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 377 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 185 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 265 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 267 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 268 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 273 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 275 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 279 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 281 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 185 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/git.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/git.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/git.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 222 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 230 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 249 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 262 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 298 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/obsolete.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/obsolete.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 185 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 229 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 241 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 161 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 260 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 264 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 270 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 288 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 309 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 329 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 374 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 382 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 383 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 388 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 392 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 396 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 397 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 413 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 417 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1006 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1011 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1016 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1033 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1034 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1039 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1043 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1049 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1050 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1051 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1052 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1054 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1055 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1070 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1075 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1080 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1088 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1091 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1092 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1098 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1166 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1192 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1199 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1261 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1267 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1275 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1281 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1294 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1298 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1303 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1307 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1311 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1315 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1320 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1333 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1334 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1335 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1340 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1344 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1351 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1352 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1357 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1363 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1367 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1386 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1391 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1395 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1416 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1422 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1426 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1434 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1438 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1445 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1448 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1453 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1466 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1468 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1469 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1470 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1478 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1486 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1502 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1507 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1545 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1568 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1595 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1673 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1679 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1688 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1689 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1691 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1692 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1702 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1710 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1715 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1718 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1724 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1730 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1744 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1750 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1751 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1760 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1788 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1794 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1800 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1807 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1809 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1815 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1820 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1825 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1842 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1925 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1937 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1940 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1941 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1942 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1947 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1949 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1969 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1973 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1974 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2015 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2031 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2035 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2043 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2050 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2054 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2057 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2061 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2062 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2064 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 215 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 247 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 251 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 260 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 265 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 270 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 271 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 283 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 284 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 307 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 317 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 319 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 331 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 339 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 353 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 357 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 364 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 396 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 397 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 402 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 414 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 420 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 423 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 427 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 434 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 435 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 445 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 458 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 470 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 473 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 477 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 478 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 482 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 483 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 484 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 488 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 489 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 500 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 501 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 503 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 511 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 513 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 535 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 536 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 543 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 544 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 551 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 552 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 559 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 560 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 567 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 568 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 586 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 592 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 594 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 599 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 603 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 607 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 620 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 621 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 628 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 643 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 652 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 653 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 659 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 664 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 670 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 684 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 685 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 687 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 691 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 696 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 702 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 709 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 713 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 720 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 724 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 743 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 751 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 755 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 766 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 769 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 770 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 771 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 775 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 776 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 782 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 835 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 836 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 845 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 846 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 853 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 861 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 866 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 870 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 875 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 885 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 889 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 899 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 906 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 916 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 918 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 927 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 932 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 933 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 939 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 949 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 956 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 964 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 966 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 980 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 985 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 986 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 991 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/empty/empty.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/empty/empty.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/errors.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mediatypes.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mediatypes.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mediatypes.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 166 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 199 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 244 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 245 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 256 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 272 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 277 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 282 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 293 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 294 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 303 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 312 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 315 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 333 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 335 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 337 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 342 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 347 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 352 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 359 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 365 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 366 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 373 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 374 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 378 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 380 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 169 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 210 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/digest.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/digest.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 169 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 256 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 260 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 262 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 263 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 280 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 227 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 267 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 271 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 277 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 291 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 314 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 317 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 321 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 327 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 347 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 361 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 386 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 391 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 414 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 420 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 427 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 446 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 465 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 466 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 474 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signatures.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/image.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/image.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/image.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/image.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/walk/walk.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/walk/walk.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/walk/walk.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/walk/walk.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/envvar/env.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/envvar/env.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/envvar/env.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/envvar/env.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/envvar/env.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/filesystem/filesystem.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/filesystem/filesystem.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/annotations.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/annotations.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/annotations.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/annotations.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/annotations.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 222 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/test/cmd/getoidctoken/main.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/test/cmd/getoidctoken/main.go", + "line": 55 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/conformance", + "module": "function", + "function": "main", + "line": 82, + "column": 3, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/conformance", + "module": "function", + "function": "main", + "line": 86, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "SignatureCmd", + "line": 53, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "attachAttestation", + "line": 136, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "AttestationCmd", + "line": 48, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "SignatureCmd", + "line": 73, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "SignatureCmd", + "line": 120, + "column": 117, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "SignatureCmd", + "line": 120, + "column": 39, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go" + } + ] + } + } + }, + "properties": [] + }, + "components": [ + { + "type": "cryptographic-asset", + "name": "BundleAnnotationKey", + "bom-ref": "crypto/material/BundleAnnotationKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:35:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "BundleKey", + "bom-ref": "crypto/material/BundleKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:37:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "CertificateAnnotationKey", + "bom-ref": "crypto/material/CertificateAnnotationKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:33:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "certkey", + "bom-ref": "crypto/material/certkey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:35:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "ChainAnnotationKey", + "bom-ref": "crypto/material/ChainAnnotationKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:34:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "chainkey", + "bom-ref": "crypto/material/chainkey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:36:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "CosignPrivateKeyPemType", + "bom-ref": "crypto/material/CosignPrivateKeyPemType@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:43:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "ctPublicKeyStr", + "bom-ref": "crypto/material/ctPublicKeyStr@public-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "public-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go:28:5" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "ECPrivateKeyPemType", + "bom-ref": "crypto/material/ECPrivateKeyPemType@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:48:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "encryptedCosignPasswd", + "bom-ref": "crypto/material/encryptedCosignPasswd@password", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "password" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go:99:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "encryptedCosignPrivKey", + "bom-ref": "crypto/material/encryptedCosignPrivKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go:116:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "encryptedCosignPubKey", + "bom-ref": "crypto/material/encryptedCosignPubKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go:133:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "extKeyUsageNames", + "bom-ref": "crypto/material/extKeyUsageNames@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:68:5" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "FilesystemTokenPath", + "bom-ref": "crypto/material/FilesystemTokenPath@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/filesystem/filesystem.go:37:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "flowClientCredentials", + "bom-ref": "crypto/material/flowClientCredentials@credential", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "credential" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go:37:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "flowToken", + "bom-ref": "crypto/material/flowToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go:36:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "idToken", + "bom-ref": "crypto/material/idToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go:96:4" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go:98:4" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "key", + "bom-ref": "crypto/material/key@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go:206:3" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyAlg", + "bom-ref": "crypto/material/keyAlg@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go:62:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go:64:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go:66:3" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyAlgorithmHelp", + "bom-ref": "crypto/material/keyAlgorithmHelp@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go:161:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyID", + "bom-ref": "crypto/material/keyID@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go:144:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyLabel", + "bom-ref": "crypto/material/keyLabel@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go:143:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyParts", + "bom-ref": "crypto/material/keyParts@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:216:4" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "KeyReference", + "bom-ref": "crypto/material/KeyReference@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go:32:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyUsageNames", + "bom-ref": "crypto/material/keyUsageNames@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:53:5" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyvalue", + "bom-ref": "crypto/material/keyvalue@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go:202:3" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "PKCS#1 private key", + "bom-ref": "crypto/material/PKCS%231%20private%20key@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/x509.ParsePKCS1PrivateKey" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:152:17" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "private-key", + "bom-ref": "crypto/material/private-key@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/tls.LoadX509KeyPair" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go:246:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go:103:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:119:10" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "privateKeyExts", + "bom-ref": "crypto/material/privateKeyExts@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/options.go:41:5" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "privateKeyFileName", + "bom-ref": "crypto/material/privateKeyFileName@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go:47:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go:43:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "PrivateKeyPemType", + "bom-ref": "crypto/material/PrivateKeyPemType@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:50:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "pubKey", + "bom-ref": "crypto/material/pubKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:550:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go:222:3" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "public-key", + "bom-ref": "crypto/material/public-key@public-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "public-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/x509.ParseCertificate" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go:157:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go:67:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:279:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:285:36" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:287:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:288:25" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:291:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:291:51" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:291:88" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:294:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:295:39" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:297:10" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:298:40" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:300:10" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:301:35" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:306:38" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:307:37" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:310:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:345:42" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:345:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:345:74" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:347:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:348:41" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:350:25" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:353:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:360:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:369:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:379:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:386:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:387:58" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:389:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:390:31" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:400:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:401:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:407:59" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:437:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:439:29" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:445:113" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:445:95" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:449:64" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:54:8" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:57:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:58:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:59:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:609:26" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:60:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:613:27" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:61:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:62:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:63:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:64:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:65:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:68:28" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:69:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:70:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:71:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:72:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:73:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:74:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:75:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:76:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:77:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:78:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go:105:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go:106:17" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go:107:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go:108:17" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go:109:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go:98:24" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/fulcio/fulcio.go:24:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/fulcio/fulcio.go:28:27" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go:238:11" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go:239:7" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:249:37" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:273:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:315:14" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:317:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:549:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:319:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:316:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:281:32" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:225:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:551:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go:469:58" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:506:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:323:27" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:357:24" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:338:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:511:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:371:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:500:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:362:34" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:458:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:363:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:453:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:346:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:349:43" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:357:37" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:375:50" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:433:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:434:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:436:27" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:438:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:446:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:449:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:458:28" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:460:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:74:187" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go:251:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go:203:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go:46:130" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go:104:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go:365:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go:125:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go:249:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go:367:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go:136:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go:96:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go:316:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go:52:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:69:24" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:83:36" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:33:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:83:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:67:14" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:89:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:52:27" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:84:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:41:14" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:66:36" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:32:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:66:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:87:25" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go:96:10" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go:85:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go:97:7" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go:41:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:101:26" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:101:50" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:102:28" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:102:45" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:122:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:122:64" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:123:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:128:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:129:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:129:38" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:131:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:148:126" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:148:144" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:148:74" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:149:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:155:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:160:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:161:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:161:39" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:180:116" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:180:70" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:181:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:186:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:187:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:187:38" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:189:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:215:166" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:215:212" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:216:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:224:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:225:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:225:38" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:227:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:52:117" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:52:34" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:52:60" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:53:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:58:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:65:25" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:66:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:68:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:74:26" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:74:50" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:92:42" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:92:86" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:93:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:95:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:191:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:193:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:199:31" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:204:25" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:205:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:205:35" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:208:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:75:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pivkey/disabled.go:47:26" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pivkey/disabled.go:51:45" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pivkey/disabled.go:83:31" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/disabled.go:40:31" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go:23:8" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go:47:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go:48:40" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go:50:38" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go:52:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go:52:41" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go:42:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go:43:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:161:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:170:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:200:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:294:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go:96:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:134:76" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:141:7" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:145:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:145:36" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:36:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:37:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:38:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1051:54" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1053:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1054:59" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:121:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:123:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1241:24" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1241:58" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1245:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1248:8" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1251:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1254:8" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1258:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1261:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1264:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1267:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:159:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:161:25" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:163:33" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1642:100" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1642:24" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1642:49" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1642:79" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1643:17" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1643:29" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1647:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1650:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1651:4" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:348:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:349:11" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:352:44" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:356:47" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:363:34" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:372:103" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:372:142" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:372:51" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:373:42" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:382:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:384:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:389:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:395:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:397:49" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:423:31" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:467:35" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:580:43" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:580:70" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:584:14" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:585:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:588:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:590:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:886:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:904:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:908:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:910:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:992:35" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go:143:54" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:102:29" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:118:32" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go:187:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go:188:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go:39:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go:40:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go:79:32" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go:87:35" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:157:32" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:169:35" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signatures.go:57:11" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signatures.go:62:14" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "publicKeyExts", + "bom-ref": "crypto/material/publicKeyExts@public-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "public-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/options.go:44:5" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "publicKeyFileName", + "bom-ref": "crypto/material/publicKeyFileName@public-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "public-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go:48:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go:44:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "RepoOverrideEnvKey", + "bom-ref": "crypto/material/RepoOverrideEnvKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go:34:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "requiredKeys", + "bom-ref": "crypto/material/requiredKeys@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go:195:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:543:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:440:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:489:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "RFC3161TimestampAnnotationKey", + "bom-ref": "crypto/material/RFC3161TimestampAnnotationKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:36:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "RFC3161TimestampKey", + "bom-ref": "crypto/material/RFC3161TimestampKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:38:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "rsa", + "bom-ref": "crypto/algorithm/rsa@2.5.8.1.1", + "description": "X.500 algorithms. Ambiguous, since no padding rules specified", + "cryptoProperties": { + "assetType": "algorithm", + "oid": "2.5.8.1.1", + "algorithmProperties": { + "primitive": "pke" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:strength", + "value": "acceptable" + }, + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/rsa.GenerateKey" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:119:10" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "RSAPrivateKeyPemType", + "bom-ref": "crypto/material/RSAPrivateKeyPemType@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:46:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "sha-256", + "bom-ref": "crypto/algorithm/sha-256@2.16.840.1.101.3.4.2.1", + "description": "NIST Algorithm", + "cryptoProperties": { + "assetType": "algorithm", + "oid": "2.16.840.1.101.3.4.2.1", + "algorithmProperties": { + "primitive": "hash" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:strength", + "value": "strong" + }, + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/sha256.New" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/blob/load.go:89:18" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "sigkey", + "bom-ref": "crypto/material/sigkey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:34:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "SignatureAnnotationKey", + "bom-ref": "crypto/material/SignatureAnnotationKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:32:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "SigstorePrivateKeyPemType", + "bom-ref": "crypto/material/SigstorePrivateKeyPemType@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:44:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "TLS", + "bom-ref": "crypto/protocol/TLS@tls", + "description": "Cryptographic protocol detected by golem source analysis", + "cryptoProperties": { + "assetType": "protocol", + "protocolProperties": { + "type": "tls" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/tls.Config" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go:225:44" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "tokenLabel", + "bom-ref": "crypto/material/tokenLabel@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go:141:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableBuildkiteAgentAccessToken", + "bom-ref": "crypto/material/VariableBuildkiteAgentAccessToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:77:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableGitHubRequestToken", + "bom-ref": "crypto/material/VariableGitHubRequestToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:71:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableGitHubToken", + "bom-ref": "crypto/material/VariableGitHubToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:70:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableGitLabToken", + "bom-ref": "crypto/material/VariableGitLabToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:76:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariablePassword", + "bom-ref": "crypto/material/VariablePassword@password", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "password" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:49:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableSigstoreCTLogPublicKeyFile", + "bom-ref": "crypto/material/VariableSigstoreCTLogPublicKeyFile@public-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "public-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:57:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableSigstoreIDToken", + "bom-ref": "crypto/material/VariableSigstoreIDToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:60:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableSigstoreRekorPublicKey", + "bom-ref": "crypto/material/VariableSigstoreRekorPublicKey@public-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "public-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:59:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "X.509 certificate", + "bom-ref": "crypto/certificate/X.509%20certificate@x509", + "description": "Certificate asset detected by golem source analysis", + "cryptoProperties": { + "assetType": "certificate", + "algorithmProperties": { + "primitive": "unknown" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/x509.ParsePKIXPublicKey" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:75:18" + } + ], + "tags": [ + "cryptographic-asset" + ] + } + ], + "dependencies": [ + { + "ref": "pkg:golang/github.com/sigstore/cosign/v3", + "dependsOn": [] + } + ], + "services": [], + "compositions": [ + { + "bom-ref": "pkg:golang/github.com/sigstore/cosign/v3", + "aggregate": "incomplete" + } + ], + "annotations": [ + { + "bom-ref": "metadata-annotations", + "subjects": [ + "pkg:golang/github.com/sigstore/cosign/v3" + ], + "annotator": { + "component": { + "group": "@cyclonedx", + "name": "cdxgen", + "version": "12.8.2", + "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.2", + "type": "application", + "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.2", + "publisher": "OWASP Foundation", + "authors": [ + { + "name": "OWASP Foundation" + } + ] + } + }, + "timestamp": "2026-08-06T11:09:15Z", + "text": "This Cryptography Bill-of-Materials (CBOM) document was created on Thursday, August 6, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'github.com/sigstore/cosign/v3'. There are 56 cryptographic assets listed under components in this CBOM. There are 56 components." + } + ] +} diff --git a/etc/test-data/cyclonedx/cryptographic/cosign-full-sbom.json b/etc/test-data/cyclonedx/cryptographic/cosign-full-sbom.json new file mode 100644 index 0000000000..7fca149803 --- /dev/null +++ b/etc/test-data/cyclonedx/cryptographic/cosign-full-sbom.json @@ -0,0 +1,65938 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.7", + "serialNumber": "urn:uuid:7364ccd3-2fe1-4d18-882e-a0c001daf9ff", + "version": 2, + "metadata": { + "timestamp": "2026-08-06T16:57:51Z", + "tools": { + "components": [ + { + "group": "@cyclonedx", + "name": "cdxgen", + "version": "12.8.2", + "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.2", + "type": "application", + "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.2", + "publisher": "OWASP Foundation", + "authors": [ + { + "name": "OWASP Foundation" + } + ] + } + ] + }, + "authors": [ + { + "name": "OWASP Foundation" + } + ], + "lifecycles": [ + { + "phase": "build" + } + ], + "component": { + "group": "", + "name": "github.com/sigstore/cosign/v3", + "version": "", + "purl": "pkg:golang/github.com/sigstore/cosign/v3", + "bom-ref": "pkg:golang/github.com/sigstore/cosign/v3", + "scope": "required", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/go.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.26.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:toolVersion", + "value": "2.5.1" + }, + { + "name": "cdx:golem:callGraphMode", + "value": "static" + }, + { + "name": "cdx:golem:dataFlowMode", + "value": "none" + }, + { + "name": "cdx:golem:dataFlowCallGraphMode", + "value": "static" + }, + { + "name": "cdx:golem:noRecurse", + "value": "false" + }, + { + "name": "cdx:golem:includeAllFlows", + "value": "false" + }, + { + "name": "cdx:golem:dataFlowPacks", + "value": "all" + }, + { + "name": "cdx:golem:packageCount", + "value": "80" + }, + { + "name": "cdx:golem:moduleCount", + "value": "259" + }, + { + "name": "cdx:golem:fileCount", + "value": "232" + }, + { + "name": "cdx:golem:importCount", + "value": "1554" + }, + { + "name": "cdx:golem:declarationCount", + "value": "1389" + }, + { + "name": "cdx:golem:usageCount", + "value": "7922" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "7922" + }, + { + "name": "cdx:golem:buildDirectiveCount", + "value": "8" + }, + { + "name": "cdx:golem:securitySignalCount", + "value": "148" + }, + { + "name": "cdx:golem:diagnosticCount", + "value": "160" + }, + { + "name": "cdx:golem:licenseFileModuleCount", + "value": "256" + }, + { + "name": "cdx:golem:buildDirectiveKinds", + "value": "go-build,legacy-build" + }, + { + "name": "cdx:golem:securitySignalCategories", + "value": "deserialization,environment,filesystem,http-client,http-server,process-execution,reflection,syscall,template,tls" + }, + { + "name": "cdx:golem:securitySignalSeverities", + "value": "high,info,medium" + }, + { + "name": "cdx:golem:goDirectiveVersion", + "value": "1.26.0" + }, + { + "name": "cdx:golem:cryptoLibraryCount", + "value": "62" + }, + { + "name": "cdx:golem:cryptoAssetCount", + "value": "3" + }, + { + "name": "cdx:golem:cryptoOperationCount", + "value": "310" + }, + { + "name": "cdx:golem:cryptoMaterialCount", + "value": "345" + }, + { + "name": "cdx:golem:cryptoProtocolCount", + "value": "1" + }, + { + "name": "cdx:golem:cryptoFindingCount", + "value": "58" + }, + { + "name": "cdx:golem:cryptoAlgorithms", + "value": "rsa,sha-256" + }, + { + "name": "cdx:golem:cryptoMaterialTypes", + "value": "credential,key,password,private-key,public-key,token" + }, + { + "name": "cdx:golem:cryptoProtocols", + "value": "tls" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sigstore/cosign/v3" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.26.0" + }, + { + "name": "cdx:golem:mainModule", + "value": "true" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "blank" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "call" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageKind", + "value": "reference" + }, + { + "name": "cdx:golem:usageKind", + "value": "functionValueCall" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "5184" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "391" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1688" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "3105" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "type": "application", + "evidence": { + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 230 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 242 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 166 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 192 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 212 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 185 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 166 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 192 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 215 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 227 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 245 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 252 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 256 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 259 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 262 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 266 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 273 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 281 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 285 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 288 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 293 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 295 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 298 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 301 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 305 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 306 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 307 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 309 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 312 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 313 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 318 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 320 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 323 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 327 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 330 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 332 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 336 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 337 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 340 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 343 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 346 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 348 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 351 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 354 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 360 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 361 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 365 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 375 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 383 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 387 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 391 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 393 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 395 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 409 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 411 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 412 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 415 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 417 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 419 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 422 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 428 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 430 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 441 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 443 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 445 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 449 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 453 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 457 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 459 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 461 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 466 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 467 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 471 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 474 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 479 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 480 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 485 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 486 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 487 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 488 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 491 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 494 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 495 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 498 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 500 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 505 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 508 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 510 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 515 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 521 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 526 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 528 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 531 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 532 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 533 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 534 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 535 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 541 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 544 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 545 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 546 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 551 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 553 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 556 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 560 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 568 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 570 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 574 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 575 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 578 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 580 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 586 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 593 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 595 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 596 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 597 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 599 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 18 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug/provider.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug/provider.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug/provider.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/fulcio/fulcio.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/fulcio/fulcio.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/fulcio/fulcio.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/env.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/env.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/experimental.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/experimental.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/flags.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate_key_pair.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate_key_pair.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/key.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/load.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/load.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/reference.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 229 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 245 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 249 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/rekor.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/save.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/save.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/security_key.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/security_key.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 161 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/tree.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/tree.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/tree.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/triangulate.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/triangulate.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 222 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 230 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 257 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 286 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 288 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 289 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 290 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 291 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 295 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 299 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 308 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 311 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 316 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 320 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/rekor/rekor.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/rekor/rekor.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 259 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 263 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 269 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 279 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 286 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 292 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 297 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 307 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 317 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 322 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 324 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 327 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 330 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 332 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 335 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 336 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 339 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 340 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 343 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 351 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 354 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 361 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 364 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 372 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 375 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 384 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 388 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 391 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 394 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 405 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 408 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 411 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 415 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 420 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 423 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 425 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 429 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 433 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 439 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 441 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 443 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 447 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 448 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 452 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 456 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 459 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 464 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 469 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 472 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 169 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 169 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 212 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 250 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 288 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 289 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 291 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 292 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 297 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 321 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 324 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 330 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 339 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 344 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 366 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 371 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 375 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 380 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 381 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 386 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 388 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 410 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 434 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 435 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 436 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 450 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 453 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 458 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 460 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 465 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 470 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 478 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 481 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 484 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 487 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 490 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 493 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 526 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 528 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 531 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 535 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 572 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 574 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 585 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 586 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 589 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 590 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 591 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 594 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 595 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 605 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 607 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 614 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 616 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 624 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 626 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 638 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 640 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 185 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 192 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 199 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 215 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 227 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 242 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 260 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 261 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 267 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 268 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 275 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 277 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 280 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 303 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 316 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 333 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 400 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 435 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 447 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 484 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 496 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 538 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 550 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 573 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 210 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 215 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 222 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 227 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 229 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 230 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 241 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 242 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 245 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 252 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 256 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 259 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 263 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 268 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 311 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 313 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 314 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 317 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 322 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 323 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 324 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 325 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 326 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 327 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 328 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 329 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 330 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 332 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 334 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 335 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 336 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 337 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 338 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 339 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 340 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 341 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 342 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 343 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 344 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 345 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 346 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 347 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 348 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 349 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 350 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 352 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 355 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 356 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 358 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 359 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 362 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 366 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 371 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 404 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 406 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 407 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 410 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 415 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 416 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 417 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 418 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 419 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 420 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 421 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 422 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 423 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 425 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 427 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 428 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 429 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 430 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 431 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 432 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 433 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 434 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 435 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 436 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 437 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 438 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 439 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 440 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 441 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 442 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 443 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 444 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 445 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 446 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 447 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 449 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 452 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 460 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 461 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 463 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 464 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 467 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 471 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 210 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 215 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 222 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 242 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 247 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 249 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 250 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 257 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 262 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 273 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 285 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 286 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 295 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 297 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 299 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 300 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 301 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 305 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 306 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 308 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 309 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 310 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 313 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 314 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 315 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 318 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 319 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 320 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 323 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 329 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 350 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 354 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 362 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 376 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 414 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 429 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 433 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 434 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 436 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 438 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 442 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 446 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 449 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 453 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 458 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 460 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 467 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 471 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 199 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 241 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 251 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 256 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 262 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 263 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 272 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 284 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 285 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 315 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 227 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 245 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 266 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 268 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 280 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 210 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 229 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 249 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 251 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 271 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 282 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 286 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 296 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 305 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 309 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 314 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 326 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 161 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 210 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 259 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 266 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 271 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 281 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 283 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 293 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 294 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 296 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 300 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 301 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 302 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 306 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 307 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 308 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 309 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 311 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 319 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 323 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 327 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 331 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 333 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 334 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 335 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 342 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 345 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 346 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 350 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 354 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 355 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 364 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 365 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 367 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 384 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 387 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 395 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 401 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 406 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/error_wrap.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/errors.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/errors.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/errors.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/errors.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/exit_code_lookup.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/generate_docs.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/generate_docs.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/errors/generate_docs.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/common.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/errors.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/sign.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/env.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/env.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/env.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/log.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/log.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/log.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/log.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/prompt.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/prompt.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/prompt.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/prompt.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/prompt.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/spinner.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/spinner.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/spinner.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/blob/load.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/blob/load.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 192 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 229 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 296 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 338 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 347 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 369 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 377 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 185 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 265 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 267 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 268 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 273 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 275 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 279 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go", + "line": 281 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/errors.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 185 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/git.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/git.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/git.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 222 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 230 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 249 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 262 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 298 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/obsolete.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/obsolete.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 185 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 229 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 241 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 161 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 260 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 264 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 270 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 288 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 309 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 329 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 374 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 382 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 383 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 388 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 392 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 396 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 397 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 413 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 417 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1006 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1011 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1016 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1033 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1034 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1039 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1043 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1049 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1050 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1051 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1052 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1054 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1055 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1070 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1075 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1080 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1088 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1091 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1092 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1098 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1166 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1192 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1199 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1261 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1267 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1275 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1281 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1294 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1298 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1303 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1307 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1311 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1315 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1320 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1333 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1334 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1335 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1340 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1344 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1351 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1352 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1357 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1363 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1367 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1386 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1391 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1395 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1416 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1422 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1426 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1434 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1438 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1445 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1448 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1453 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1466 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1468 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1469 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1470 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1478 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1486 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1502 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1507 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1545 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1568 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1595 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1673 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1679 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1688 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1689 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1691 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1692 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1702 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1710 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1715 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1718 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1724 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1730 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1744 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1750 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1751 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1760 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1788 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1794 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1800 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1807 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1809 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1815 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1820 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1825 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1842 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1925 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1937 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1940 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1941 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1942 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1947 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1949 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1969 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1973 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1974 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2015 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2031 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2035 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2043 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2050 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2054 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2057 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2061 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2062 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2064 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 215 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 247 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 251 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 260 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 265 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 270 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 271 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 283 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 284 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 307 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 317 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 319 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 331 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 339 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 353 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 357 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 364 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 396 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 397 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 402 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 414 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 420 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 423 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 427 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 434 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 435 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 445 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 458 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 470 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 473 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 477 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 478 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 482 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 483 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 484 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 488 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 489 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 500 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 501 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 503 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 511 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 513 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 535 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 536 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 543 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 544 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 551 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 552 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 559 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 560 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 567 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 568 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 586 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 592 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 594 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 599 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 603 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 607 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 620 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 621 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 628 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 643 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 652 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 653 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 659 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 664 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 670 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 684 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 685 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 687 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 691 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 696 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 702 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 709 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 713 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 720 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 724 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 743 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 751 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 755 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 766 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 769 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 770 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 771 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 775 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 776 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 782 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 835 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 836 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 845 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 846 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 853 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 861 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 866 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 870 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 875 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 885 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 889 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 899 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 906 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 916 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 918 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 927 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 932 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 933 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 939 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 949 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 956 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 964 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 966 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 980 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 985 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 986 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 991 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/empty/empty.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/empty/empty.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/errors.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mediatypes.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mediatypes.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mediatypes.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 166 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 199 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 244 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 245 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 256 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 272 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 277 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 282 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 293 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 294 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 303 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 312 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 315 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 333 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 335 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 337 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 342 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 347 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 352 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 359 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 365 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 366 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 373 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 374 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 378 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 380 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 169 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 200 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 210 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 214 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/digest.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/digest.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 169 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 256 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 260 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 262 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 263 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 280 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 227 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 267 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 271 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 277 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 278 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 291 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 314 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 317 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 321 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 327 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 347 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 361 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 386 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 391 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 414 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 420 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 427 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 446 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 465 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 466 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 474 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signatures.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/image.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/image.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/image.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/image.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 206 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/walk/walk.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/walk/walk.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/walk/walk.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/walk/walk.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/all/all.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/envvar/env.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/envvar/env.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/envvar/env.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/envvar/env.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/envvar/env.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/filesystem/filesystem.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/filesystem/filesystem.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/github/github.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/interface.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/annotations.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/annotations.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/annotations.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/annotations.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/annotations.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 183 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 222 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/test/cmd/getoidctoken/main.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/test/cmd/getoidctoken/main.go", + "line": 55 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/conformance", + "module": "function", + "function": "main", + "line": 82, + "column": 3, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/conformance", + "module": "function", + "function": "main", + "line": 86, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "SignatureCmd", + "line": 53, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "attachAttestation", + "line": 136, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "AttestationCmd", + "line": 48, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "SignatureCmd", + "line": 73, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "SignatureCmd", + "line": 120, + "column": 117, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "SignatureCmd", + "line": 120, + "column": 39, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go" + } + ] + } + } + }, + "properties": [ + { + "name": "cdx:bom:componentTypes", + "value": "golang" + }, + { + "name": "cdx:bom:componentNamespaces", + "value": "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers\\ncloud.google.com/go\\ncloud.google.com/go/auth\\ncloud.google.com/go/compute\\nconnectrpc.com\\ncuelabs.dev/go/oci\\ncuelang.org\\ngithub.com/AliyunContainerService/ack-ram-tool/pkg/credentials\\ngithub.com/Azure\\ngithub.com/Azure/azure-sdk-for-go/sdk\\ngithub.com/Azure/azure-sdk-for-go/sdk/security/keyvault\\ngithub.com/Azure/go-autorest\\ngithub.com/Azure/go-autorest/autorest\\ngithub.com/Azure/go-autorest/autorest/azure\\ngithub.com/AzureAD\\ngithub.com/agnivade\\ngithub.com/alibabacloud-go\\ngithub.com/aliyun\\ngithub.com/asaskevich\\ngithub.com/aws\\ngithub.com/aws/aws-sdk-go-v2\\ngithub.com/aws/aws-sdk-go-v2/feature/ec2\\ngithub.com/aws/aws-sdk-go-v2/internal\\ngithub.com/aws/aws-sdk-go-v2/internal/endpoints\\ngithub.com/aws/aws-sdk-go-v2/service\\ngithub.com/aws/aws-sdk-go-v2/service/internal\\ngithub.com/awslabs/amazon-ecr-credential-helper\\ngithub.com/blang\\ngithub.com/buildkite\\ngithub.com/buildkite/agent\\ngithub.com/cenkalti/backoff\\ngithub.com/cespare/xxhash\\ngithub.com/chrismellard\\ngithub.com/clbanning/mxj\\ngithub.com/cockroachdb/apd\\ngithub.com/common-nighthawk\\ngithub.com/coreos/go-oidc\\ngithub.com/cpuguy83/go-md2man\\ngithub.com/cyberphone\\ngithub.com/davecgh\\ngithub.com/digitorus\\ngithub.com/dimchansky\\ngithub.com/docker\\ngithub.com/dustin\\ngithub.com/emicklei\\ngithub.com/emicklei/go-restful\\ngithub.com/felixge\\ngithub.com/fsnotify\\ngithub.com/fxamacker/cbor\\ngithub.com/go-chi/chi\\ngithub.com/go-jose/go-jose\\ngithub.com/go-logr\\ngithub.com/go-openapi\\ngithub.com/go-openapi/runtime\\ngithub.com/go-openapi/swag\\ngithub.com/go-viper/mapstructure\\ngithub.com/gobwas\\ngithub.com/golang\\ngithub.com/golang-jwt/jwt\\ngithub.com/google\\ngithub.com/google/go-github\\ngithub.com/googleapis\\ngithub.com/googleapis/gax-go\\ngithub.com/grpc-ecosystem/grpc-gateway\\ngithub.com/hashicorp\\ngithub.com/hashicorp/go-secure-stdlib\\ngithub.com/hashicorp/vault\\ngithub.com/in-toto\\ngithub.com/jedisct1\\ngithub.com/jellydator/ttlcache\\ngithub.com/json-iterator\\ngithub.com/kelseyhightower\\ngithub.com/klauspost\\ngithub.com/kylelemons\\ngithub.com/lestrrat-go\\ngithub.com/lestrrat-go/httprc\\ngithub.com/lestrrat-go/jwx\\ngithub.com/lestrrat-go/option\\ngithub.com/letsencrypt\\ngithub.com/mitchellh\\ngithub.com/moby\\ngithub.com/modern-go\\ngithub.com/mozillazg\\ngithub.com/munnerz\\ngithub.com/natefinch\\ngithub.com/nozzle\\ngithub.com/oklog/ulid\\ngithub.com/oleiade\\ngithub.com/open-policy-agent\\ngithub.com/opencontainers\\ngithub.com/pborman\\ngithub.com/pelletier/go-toml\\ngithub.com/pkg\\ngithub.com/protocolbuffers\\ngithub.com/rcrowley\\ngithub.com/rogpeppe\\ngithub.com/russross/blackfriday\\ngithub.com/ryanuber\\ngithub.com/sagikazarmark\\ngithub.com/sassoftware\\ngithub.com/secure-systems-lab\\ngithub.com/shibumi\\ngithub.com/sigstore\\ngithub.com/sigstore/rekor-tiles\\ngithub.com/sigstore/sigstore/pkg/signature/kms\\ngithub.com/sigstore/timestamp-authority\\ngithub.com/sirupsen\\ngithub.com/sourcegraph\\ngithub.com/spf13\\ngithub.com/spiffe/go-spiffe\\ngithub.com/subosito\\ngithub.com/syndtr\\ngithub.com/tchap/go-patricia\\ngithub.com/theupdateframework\\ngithub.com/theupdateframework/go-tuf\\ngithub.com/tink-crypto/tink-go\\ngithub.com/tink-crypto/tink-go-awskms\\ngithub.com/tink-crypto/tink-go-gcpkms\\ngithub.com/tink-crypto/tink-go-hcvault\\ngithub.com/titanous\\ngithub.com/tjfoc\\ngithub.com/transparency-dev\\ngithub.com/valyala\\ngithub.com/vektah/gqlparser\\ngithub.com/withfig/autocomplete-tools/integrations\\ngithub.com/x448\\ngithub.com/xeipuuv\\ngithub.com/yashtewari\\ngithub.com/youmark\\ngitlab.com/gitlab-org/api\\ngo.opentelemetry.io\\ngo.opentelemetry.io/auto\\ngo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc\\ngo.opentelemetry.io/contrib/instrumentation/net/http\\ngo.opentelemetry.io/otel\\ngo.uber.org\\ngo.yaml.in/yaml\\ngolang.org/x\\ngoogle.golang.org\\ngoogle.golang.org/genproto/googleapis\\ngopkg.in\\ngopkg.in/evanphx\\nk8s.io\\nk8s.io/klog\\nsigs.k8s.io\\nsigs.k8s.io/structured-merge-diff" + }, + { + "name": "cdx:bom:componentSrcFiles", + "value": "go.mod" + } + ] + }, + "components": [ + { + "group": "", + "name": "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go", + "version": "v1.36.11-20260415201107-50325440f8f2.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "b6fb5ba606955d95f883a3e7f809f317272e44adcc3b3e4725f1067849655d83" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright 2023-2026 Buf Technologies, Inc.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go@v1.36.11-20260415201107-50325440f8f2.1", + "type": "library", + "bom-ref": "pkg:golang/buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go@v1.36.11-20260415201107-50325440f8f2.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/@v/v1.36.11-20260415201107-50325440f8f2.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "0001-01-01 00:00:00 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go@v1.36.11-20260415201107-50325440f8f2.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "cloud.google.com/go/auth", + "version": "v0.20.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "f78dbfca2fe2b47d52b26a72adb9d33038067ddcb6054a882b277473260b7394" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/cloud.google.com/go/auth@v0.20.0", + "type": "library", + "bom-ref": "pkg:golang/cloud.google.com/go/auth@v0.20.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/cloud.google.com/go/auth/@v/v0.20.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-06 22:09:02 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/cloud.google.com/go/auth@v0.20.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "cloud.google.com/go/auth" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "cloud.google.com/go/auth/oauth2adapt", + "version": "v0.2.8", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "5d0f72df5464a9909cc0958d4b1d97beb89cdd1ad4f3c8406186e30d66032fe7" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", + "type": "library", + "bom-ref": "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/cloud.google.com/go/auth/oauth2adapt/@v/v0.2.8.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-03-20 15:18:21 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/cloud.google.com/go/auth/oauth2adapt@v0.2.8" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "cloud.google.com/go/auth/oauth2adapt" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "cloud.google.com/go/compute/metadata", + "version": "v0.9.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "1346d6c17e704e72cf79d08aaa4de926656008148ceaa408d724c17446f70b5d" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "type": "library", + "bom-ref": "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/cloud.google.com/go/compute/metadata/@v/v0.9.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-09-24 19:41:55 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/cloud.google.com/go/compute/metadata@v0.9.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "cloud.google.com/go/compute/metadata" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "2" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 40 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/google", + "module": "method", + "function": "Enabled", + "line": 40, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go" + } + ] + } + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "cloud.google.com/go/iam", + "version": "v1.11.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "28ffa7286ba03495b82dc2f1d6e11972ad68939b101c56907a140d978403815e" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/cloud.google.com/go/iam@v1.11.0", + "type": "library", + "bom-ref": "pkg:golang/cloud.google.com/go/iam@v1.11.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/cloud.google.com/go/iam/@v/v1.11.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-07 21:21:33 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/cloud.google.com/go/iam@v1.11.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "cloud.google.com/go/iam" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "cloud.google.com/go/kms", + "version": "v1.31.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "608c976729b5d51e6ea2f249b78a0de5e50bde83e68ab177c8a78887a4007f85" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/cloud.google.com/go/kms@v1.31.0", + "type": "library", + "bom-ref": "pkg:golang/cloud.google.com/go/kms@v1.31.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/cloud.google.com/go/kms/@v/v1.31.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-07 21:21:33 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/cloud.google.com/go/kms@v1.31.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "cloud.google.com/go/kms" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "cloud.google.com/go/longrunning", + "version": "v1.0.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "f27a8504f38ed54fd79215a5d08d7d00c644a61ac78bbdd5340048a4a61a4f03" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/cloud.google.com/go/longrunning@v1.0.0", + "type": "library", + "bom-ref": "pkg:golang/cloud.google.com/go/longrunning@v1.0.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/cloud.google.com/go/longrunning/@v/v1.0.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-11 16:07:01 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/cloud.google.com/go/longrunning@v1.0.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "cloud.google.com/go/longrunning" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "connectrpc.com/connect", + "version": "v1.20.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "036ca026bba45f05b2df6be408000735582e66ba99fa3799f6b1919c647874de" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright 2021-2025 The Connect Authors\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/connectrpc.com/connect@v1.20.0", + "type": "library", + "bom-ref": "pkg:golang/connectrpc.com/connect@v1.20.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/connectrpc.com/connect/@v/v1.20.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-20 21:15:32 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/connectrpc.com/connect@v1.20.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "connectrpc.com/connect" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "cuelabs.dev/go/oci/ociregistry", + "version": "v0.0.0-20251212221603-3adeb8663819", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "5a3990c5bf96ea754d0a08fc9d7ac5db8948cfde401f09d2977eada630d9494f" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/cuelabs.dev/go/oci/ociregistry@v0.0.0-20251212221603-3adeb8663819", + "type": "library", + "bom-ref": "pkg:golang/cuelabs.dev/go/oci/ociregistry@v0.0.0-20251212221603-3adeb8663819", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/cuelabs.dev/go/oci/ociregistry/@v/v0.0.0-20251212221603-3adeb8663819.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-12-12 22:16:03 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/cuelabs.dev/go/oci/ociregistry@v0.0.0-20251212221603-3adeb8663819" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "cuelabs.dev/go/oci/ociregistry" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "cuelang.org/go", + "version": "v0.16.1", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "fda5b7f7aec57960b91dcd5c0eb378678202540a5d322f37c0ee4bdee17fd613" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/cuelang.org/go@v0.16.1", + "type": "library", + "bom-ref": "pkg:golang/cuelang.org/go@v0.16.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/cuelang.org/go/@v/v0.16.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-08 12:56:04 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/cuelang.org/go@v0.16.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "cuelang.org/go" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "11" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "3" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "6" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "2" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go", + "line": 38 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/cue", + "module": "function", + "function": "ValidateJSON", + "line": 33, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/cue", + "module": "function", + "function": "ValidateJSON", + "line": 34, + "column": 6, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/cue", + "module": "function", + "function": "ValidateJSON", + "line": 35, + "column": 11, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/cue", + "module": "function", + "function": "ValidateJSON", + "line": 29, + "column": 6, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/cue", + "module": "function", + "function": "ValidateJSON", + "line": 30, + "column": 11, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/cue", + "module": "function", + "function": "ValidateJSON", + "line": 25, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/cue", + "module": "function", + "function": "ValidateJSON", + "line": 26, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/cue", + "module": "function", + "function": "ValidateJSON", + "line": 38, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/cue/cue.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/agnivade/levenshtein", + "version": "v1.2.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "415548d7a903aed4aec1ca5dd29d7ec4c0ba67f55f86d0b20c88dcc206b8fc35" + } + ], + "purl": "pkg:golang/github.com/agnivade/levenshtein@v1.2.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/agnivade/levenshtein@v1.2.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/agnivade/levenshtein/@v/v1.2.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.21" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-12-23 04:53:21 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/agnivade/levenshtein@v1.2.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "License.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/agnivade/levenshtein" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.21" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/alibabacloud-go/alibabacloud-gateway-spi", + "version": "v0.0.4", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "b026af480bddcce8ee978704a9e56dbe549a49271f36c4d0fb8e87c254cbd617" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright (c) 2009-present, Alibaba Cloud All rights reserved.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/alibabacloud-go/alibabacloud-gateway-spi@v0.0.4", + "type": "library", + "bom-ref": "pkg:golang/github.com/alibabacloud-go/alibabacloud-gateway-spi@v0.0.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/alibabacloud-go/alibabacloud-gateway-spi/@v/v0.0.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.14" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2022-03-19 18:10:00 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/alibabacloud-go/alibabacloud-gateway-spi@v0.0.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/alibabacloud-go/alibabacloud-gateway-spi" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.14" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "github.com/alibabacloud-go/cr-20160607", + "version": "v1.0.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "40778a66d67717714e13efee217081029f0f3b09d461e9292f0af576d41ae6bd" + } + ], + "purl": "pkg:golang/github.com/alibabacloud-go/cr-20160607@v1.0.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/alibabacloud-go/cr-20160607@v1.0.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/alibabacloud-go/cr-20160607/@v/v1.0.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.15" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2021-12-10 12:06:05 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/alibabacloud-go/cr-20160607@v1.0.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/alibabacloud-go/cr-20160607" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.15" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "github.com/alibabacloud-go/cr-20181201", + "version": "v1.0.10", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "54df68ac1ff0e46db4163cada12a5944eaaef59ab1c327004a61aa614252a037" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright (c) 2009-present, Alibaba Cloud All rights reserved.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/alibabacloud-go/cr-20181201@v1.0.10", + "type": "library", + "bom-ref": "pkg:golang/github.com/alibabacloud-go/cr-20181201@v1.0.10", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/alibabacloud-go/cr-20181201/@v/v1.0.10.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.15" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2022-03-10 07:21:26 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/alibabacloud-go/cr-20181201@v1.0.10" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/alibabacloud-go/cr-20181201" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.15" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "github.com/alibabacloud-go/darabonba-openapi", + "version": "v0.2.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "cd73aa2dba48aaae78de88a82fd22eb9960e4201d0e41f3f9f938fae7928f1a6" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright (c) 2009-present, Alibaba Cloud All rights reserved.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/alibabacloud-go/darabonba-openapi@v0.2.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/alibabacloud-go/darabonba-openapi@v0.2.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/alibabacloud-go/darabonba-openapi/@v/v0.2.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.14" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2022-06-30 10:18:43 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/alibabacloud-go/darabonba-openapi@v0.2.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/alibabacloud-go/darabonba-openapi" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.14" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "github.com/alibabacloud-go/debug", + "version": "v1.0.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "f207e06420800b7f920b38d6b58d39dc5ace71de3faa51fa2074c8e10c8808e7" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/alibabacloud-go/debug@v1.0.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/alibabacloud-go/debug@v1.0.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/alibabacloud-go/debug/@v/v1.0.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.18" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-06-28 11:09:27 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/alibabacloud-go/debug@v1.0.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/alibabacloud-go/debug" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.18" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "github.com/alibabacloud-go/endpoint-util", + "version": "v1.1.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "3b916e0802e608ab3615fec914932e747b3423910181e7175f1651cacc251231" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright (c) 2009-present, Alibaba Cloud All rights reserved.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/alibabacloud-go/endpoint-util@v1.1.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/alibabacloud-go/endpoint-util@v1.1.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/alibabacloud-go/endpoint-util/@v/v1.1.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2022-03-13 07:26:54 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/alibabacloud-go/endpoint-util@v1.1.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/alibabacloud-go/endpoint-util" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "github.com/alibabacloud-go/openapi-util", + "version": "v0.1.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "b10b8496be32c3015194209b7ab4302911614732321b84133ff3f8cb5089e96b" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright (c) 2009-present, Alibaba Cloud All rights reserved.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/alibabacloud-go/openapi-util@v0.1.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/alibabacloud-go/openapi-util@v0.1.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/alibabacloud-go/openapi-util/@v/v0.1.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.14" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2022-11-08 13:18:04 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/alibabacloud-go/openapi-util@v0.1.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/alibabacloud-go/openapi-util" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.14" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "github.com/alibabacloud-go/tea-utils", + "version": "v1.4.5", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "28d713d285e5659c4e5c8367641b3a62f80e779698a7d53aec6f84dd1f1f710c" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright (c) 2009-present, Alibaba Cloud All rights reserved.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/alibabacloud-go/tea-utils@v1.4.5", + "type": "library", + "bom-ref": "pkg:golang/github.com/alibabacloud-go/tea-utils@v1.4.5", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/alibabacloud-go/tea-utils/@v/v1.4.5.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.14" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2022-07-05 09:58:20 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/alibabacloud-go/tea-utils@v1.4.5" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/alibabacloud-go/tea-utils" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.14" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "github.com/alibabacloud-go/tea-xml", + "version": "v1.1.3", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "46ad3cbe009c0808c7c918bf33bc651ca532919084b72072f7e0cf17a1a012ef" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright (c) 2009-present, Alibaba Cloud All rights reserved.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/alibabacloud-go/tea-xml@v1.1.3", + "type": "library", + "bom-ref": "pkg:golang/github.com/alibabacloud-go/tea-xml@v1.1.3", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/alibabacloud-go/tea-xml/@v/v1.1.3.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.14" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-03-23 07:22:25 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/alibabacloud-go/tea-xml@v1.1.3" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/alibabacloud-go/tea-xml" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.14" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud", + "xml" + ] + }, + { + "group": "", + "name": "github.com/alibabacloud-go/tea", + "version": "v1.2.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "a9bce87f6f5b33f20584b32d24fae04c62b779ab95e49db04b2114a383849a70" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright (c) 2009-present, Alibaba Cloud All rights reserved.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/alibabacloud-go/tea@v1.2.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/alibabacloud-go/tea@v1.2.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/alibabacloud-go/tea/@v/v1.2.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.14" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-06-28 09:46:15 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/alibabacloud-go/tea@v1.2.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/alibabacloud-go/tea" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.14" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "cloud" + ] + }, + { + "group": "", + "name": "github.com/aliyun/credentials-go", + "version": "v1.3.2", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "b65a73e2ecace119fb224e3fa62191ad36d7cb6b8b2af78f81024976e13e6397" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright (c) 2009-present, Alibaba Cloud All rights reserved.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/aliyun/credentials-go@v1.3.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/aliyun/credentials-go@v1.3.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aliyun/credentials-go/@v/v1.3.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.14" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-11-17 09:04:49 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aliyun/credentials-go@v1.3.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aliyun/credentials-go" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.14" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider", + "version": "v0.14.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "b65aa9f665066ec3fed33dd0f9cd10e4c81276afce3304219b96df7d1dd0decb" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider@v0.14.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider@v0.14.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!aliyun!container!service/ack-ram-tool/pkg/credentials/provider/@v/v0.14.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.16" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-08-23 08:45:20 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!aliyun!container!service/ack-ram-tool/pkg/credentials/provider@v0.14.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.16" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/asaskevich/govalidator", + "version": "v0.0.0-20230301143203-a9d515a09cc2", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "59a1d482fc5356ad3850dba73be5e19c0a98ff041cf9bc6bef81aa6ec67f26ac" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2014-2020 Alex Saskevich\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2", + "type": "library", + "bom-ref": "pkg:golang/github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/asaskevich/govalidator/@v/v0.0.0-20230301143203-a9d515a09cc2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.13" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-03-01 14:32:03 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/asaskevich/govalidator" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.13" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2", + "version": "v1.42.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "dbbf800b2a522e58cb0042ac0983a6ae32a1f37bee4d192e01ef54bffdc0e1b8" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/@v/v1.42.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 18:35:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2@v1.42.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt,NOTICE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/config", + "version": "v1.32.25", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "2c9c94f2c0d16d7531167f313092063febfd418630bde34b23c6bf82200e880b" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.32.25", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.32.25", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/config/@v/v1.32.25.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-10 18:23:40 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/config@v1.32.25" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/config" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/credentials", + "version": "v1.19.24", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "203c29002b70a872c849dcdfc1450dab83fd0ec07f87904b83817024f35fa856" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.24", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.24", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/credentials/@v/v1.19.24.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-10 18:23:40 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/credentials@v1.19.24" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/credentials" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds", + "version": "v1.18.29", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "4119da45c4d518a3c6472f30efc1cc42d29419161c9cc64000d01391e540e8ca" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.29", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.29", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/@v/v1.18.29.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 18:35:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.29" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/internal/configsources", + "version": "v1.4.29", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "333a0b15402b286a460feba498f8933c6d57e71e28e8cda4ab8bf676bd458847" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.29", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.29", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/internal/configsources/@v/v1.4.29.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 18:35:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.29" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/internal/configsources" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2", + "version": "v2.7.29", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "ef5c2df16d8482cc1d672f4c7fd28d9f3c59dd389996fe1c68a8213e4b433a40" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.29", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.29", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/@v/v2.7.29.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 18:35:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.29" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/internal/v4a", + "version": "v1.4.30", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "012d07c9c52f25116f4edeb5dc06033a03b68f3c3ed3471548c9f2f17077c8c6" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.30", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.30", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/internal/v4a/@v/v1.4.30.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 18:35:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.30" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/internal/v4a" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/service/ecr", + "version": "v1.55.3", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "bc17c1bb6e0a6b7ff9519b5ea5b4d5d209dcf553cb4fca24fb4a030da600ce7e" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecr@v1.55.3", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecr@v1.55.3", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/service/ecr/@v/v1.55.3.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-02-23 19:11:41 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/service/ecr@v1.55.3" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/service/ecr" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/service/ecrpublic", + "version": "v1.38.10", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "0e2cb2cb3d1be375f5de9762d6654caa54f00e33a645b24cbc3b2a9ddb946163" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecrpublic@v1.38.10", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecrpublic@v1.38.10", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/service/ecrpublic/@v/v1.38.10.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-02-23 19:11:41 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/service/ecrpublic@v1.38.10" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/service/ecrpublic" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding", + "version": "v1.13.12", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "32ce3395c5416d76e23fb1152e197e9608ef03f6bb62986a437221df5ef81262" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.12", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.12", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/@v/v1.13.12.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-04 18:19:14 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.12" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url", + "version": "v1.13.29", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "2df4643c20fc6070ccd84e5e4e4a2cd94a7061e66705c55aad36bc2f9f5b2470" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.29", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.29", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/@v/v1.13.29.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 18:35:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.29" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/service/kms", + "version": "v1.53.4", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "dc478ac8318f192084a611b63a8970346345e3946f4087e6dbb0186297c45abc" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/kms@v1.53.4", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/kms@v1.53.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/service/kms/@v/v1.53.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 18:35:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/service/kms@v1.53.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/service/kms" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/service/signin", + "version": "v1.2.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "2f162e8d24cb3d1969daf4ed7143bffb58a5adec3ccadb7a4af4323a07a3cc54" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.2.0", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.2.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/service/signin/@v/v1.2.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-10 18:23:40 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/service/signin@v1.2.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/service/signin" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/service/sso", + "version": "v1.31.3", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "2e4ecf966a1362bc909b2046d045ea8f905c51b8f7c215dd536b37c862371007" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.31.3", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.31.3", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/service/sso/@v/v1.31.3.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 18:35:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/service/sso@v1.31.3" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/service/sso" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/service/ssooidc", + "version": "v1.36.6", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "43937a89c1fe2896432e1f8448dc3376fe9c67abcb145fde832dc83b15a19b3e" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.36.6", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.36.6", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/service/ssooidc/@v/v1.36.6.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 18:35:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.36.6" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/service/ssooidc" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/aws-sdk-go-v2/service/sts", + "version": "v1.43.3", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "afcc240ceb8b69a305a8589801bf1d198d80de02423ae8cc73a0853950b86617" + } + ], + "purl": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.43.3", + "type": "framework", + "bom-ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.43.3", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/aws-sdk-go-v2/service/sts/@v/v1.43.3.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 18:35:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/aws-sdk-go-v2/service/sts@v1.43.3" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/aws-sdk-go-v2/service/sts" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/aws/smithy-go", + "version": "v1.27.2", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "604d9185d22e0db0391396d375c886f4aad6dfe4e210e35e5160aac57f62d457" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/aws/smithy-go@v1.27.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/aws/smithy-go@v1.27.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/aws/smithy-go/@v/v1.27.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-05 19:01:18 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/aws/smithy-go@v1.27.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,NOTICE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/aws/smithy-go" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/awslabs/amazon-ecr-credential-helper/ecr-login", + "version": "v0.12.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "d38ebfa0bc85958740821610136c875e2fc4fff54ce427f7fdd16603edc26747" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Apache License\n\nVersion 2.0, January 2004\n\nhttp://www.apache.org/licenses/\nTERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n1. Definitions.\n\"License\" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.\n\"Licensor\" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.\n\"Legal Entity\" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, \"control\" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.\n\"You\" (or \"Your\") shall mean an individual or Legal Entity exercising permissions granted by this License.\n\"Source\" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.\n\"Object\" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.\n\"Work\" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).\n\"Derivative Works\" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.\n\"Contribution\" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, \"submitted\" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as \"Not a Contribution.\"\n\"Contributor\" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.\n2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.\n3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.\n4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:\n1. You must give any other recipients of the Work or Derivative Works a copy of this License; and\n2. You must cause any modified files to carry prominent notices stating that You changed the files; and\n3. You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and\n4. If the Work includes a \"NOTICE\" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.\n\nYou may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. \n5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.\n6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.\n7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.\n8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.\n9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.\nEND OF TERMS AND CONDITIONS\nAPPENDIX: How to apply the Apache License to your work\nTo apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets \"[]\" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same \"printed page\" as the copyright notice for easier identification within third-party archives.\nCopyright [yyyy] [name of copyright owner]\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n\n***\n\nNote: Other license terms may apply to certain, identified software files contained within or distributed with the accompanying software if such terms are included in the directory containing the accompanying software. Such other license terms will then apply in lieu of the terms of the software license above.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/awslabs/amazon-ecr-credential-helper/ecr-login@v0.12.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/awslabs/amazon-ecr-credential-helper/ecr-login@v0.12.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/awslabs/amazon-ecr-credential-helper/ecr-login/@v/v0.12.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-02-25 22:29:07 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/awslabs/amazon-ecr-credential-helper/ecr-login@v0.12.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/awslabs/amazon-ecr-credential-helper/ecr-login" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "3" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "2" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 27 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "GetRegistryClientOpts", + "line": 145, + "column": 49, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "GetRegistryClientOpts", + "line": 145, + "column": 32, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/Azure/azure-sdk-for-go", + "version": "v68.0.0+incompatible", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "f575cd294f9e467a65f66a0a9c1e1038b7f51deb2d7d76e669be455f18830637" + } + ], + "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go@v68.0.0%2Bincompatible", + "type": "library", + "bom-ref": "pkg:golang/github.com/Azure/azure-sdk-for-go@v68.0.0+incompatible", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/azure-sdk-for-go/@v/v68.0.0+incompatible.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-01-19 11:02:01 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/azure-sdk-for-go@v68.0.0+incompatible" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt,NOTICE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/azure-sdk-for-go" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/Azure/azure-sdk-for-go/sdk/azcore", + "version": "v1.22.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "fd6604c7da5c33d63e0ddfc03c968d952bd54afce5e78aeb31d653e7e3a2d8b3" + } + ], + "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.22.0", + "type": "framework", + "bom-ref": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.22.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/azure-sdk-for-go/sdk/azcore/@v/v1.22.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-04 17:26:12 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/azure-sdk-for-go/sdk/azcore@v1.22.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/azure-sdk-for-go/sdk/azcore" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/Azure/azure-sdk-for-go/sdk/azidentity", + "version": "v1.14.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "ab4f944d246f4a1c140ab47fb391edc889d8a6137b5afc5beec9c5337bbe48b0" + } + ], + "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.14.0", + "type": "framework", + "bom-ref": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.14.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/azure-sdk-for-go/sdk/azidentity/@v/v1.14.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-15 18:33:15 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/azure-sdk-for-go/sdk/azidentity@v1.14.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/azure-sdk-for-go/sdk/azidentity" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/Azure/azure-sdk-for-go/sdk/internal", + "version": "v1.12.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "edd09130bc22b1f447ddd06ea4a78d0a2a16614678492d3d675e07fbb8bc6686" + } + ], + "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.12.0", + "type": "framework", + "bom-ref": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.12.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/azure-sdk-for-go/sdk/internal/@v/v1.12.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-01 16:23:48 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/azure-sdk-for-go/sdk/internal@v1.12.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/azure-sdk-for-go/sdk/internal" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys", + "version": "v1.5.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "8b687d7ec4c5299a2b87c45d57621c4947ff423f7c1a54e4ad3bd46d7fecf1ab" + } + ], + "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.5.0", + "type": "framework", + "bom-ref": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.5.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/azure-sdk-for-go/sdk/security/keyvault/azkeys/@v/v1.5.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-25 15:24:34 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.5.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal", + "version": "v1.2.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "b9c52371ad89b5265ba18f08a14ab2432bae5efc1b30157014e9b4bdd40f3610" + } + ], + "purl": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.2.0", + "type": "framework", + "bom-ref": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.2.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/azure-sdk-for-go/sdk/security/keyvault/internal/@v/v1.2.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-06-12 20:47:26 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.2.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/Azure/go-autorest/autorest", + "version": "v0.11.29", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "66d1330b8272d890eb64bc6f5acf0bac1584072725d616d3d5e92723c32d7c0b" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n Copyright 2015 Microsoft Corporation\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/Azure/go-autorest/autorest@v0.11.29", + "type": "library", + "bom-ref": "pkg:golang/github.com/Azure/go-autorest/autorest@v0.11.29", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/go-autorest/autorest/@v/v0.11.29.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.15" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-04-27 23:34:14 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/go-autorest/autorest@v0.11.29" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/go-autorest/autorest" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.15" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/Azure/go-autorest/autorest/adal", + "version": "v0.9.23", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "e6970ca8591d3e1be225d944cb7902fefd592e7425d0c1fa5c0e5809c321cb87" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n Copyright 2015 Microsoft Corporation\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/adal@v0.9.23", + "type": "library", + "bom-ref": "pkg:golang/github.com/Azure/go-autorest/autorest/adal@v0.9.23", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/go-autorest/autorest/adal/@v/v0.9.23.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.15" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-03-15 18:42:44 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/go-autorest/autorest/adal@v0.9.23" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/go-autorest/autorest/adal" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.15" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/Azure/go-autorest/autorest/azure/auth", + "version": "v0.5.12", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "f38c3fb95f04dfb7de5b6342274f2e4fd5417e37d41e980b5671b6227603e9c8" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n Copyright 2015 Microsoft Corporation\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/azure/auth@v0.5.12", + "type": "library", + "bom-ref": "pkg:golang/github.com/Azure/go-autorest/autorest/azure/auth@v0.5.12", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/go-autorest/autorest/azure/auth/@v/v0.5.12.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.15" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-01-17 19:03:26 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/go-autorest/autorest/azure/auth@v0.5.12" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/go-autorest/autorest/azure/auth" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.15" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/Azure/go-autorest/autorest/azure/cli", + "version": "v0.4.6", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "a6209f80f868ec18880dd110d7e8385662b20f9cbea7f5ed48da84e87738403d" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n Copyright 2015 Microsoft Corporation\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/azure/cli@v0.4.6", + "type": "library", + "bom-ref": "pkg:golang/github.com/Azure/go-autorest/autorest/azure/cli@v0.4.6", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/go-autorest/autorest/azure/cli/@v/v0.4.6.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.15" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2022-07-26 15:30:24 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/go-autorest/autorest/azure/cli@v0.4.6" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/go-autorest/autorest/azure/cli" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.15" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/Azure/go-autorest/autorest/date", + "version": "v0.3.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "048d2ea2e55d9a7818354cc659e4989e8914f93ae6c04b0ea9db7c63ab2ca3be" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n Copyright 2015 Microsoft Corporation\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/Azure/go-autorest/autorest/date@v0.3.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/Azure/go-autorest/autorest/date@v0.3.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/go-autorest/autorest/date/@v/v0.3.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.12" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2020-06-23 18:36:26 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/go-autorest/autorest/date@v0.3.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/go-autorest/autorest/date" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.12" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/Azure/go-autorest/logger", + "version": "v0.2.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "4fd137700863d95aaf3ceb42600bdbcbd6815e46666c5e4d5ae3d5f3e59e116f" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n Copyright 2015 Microsoft Corporation\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/Azure/go-autorest/logger@v0.2.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/Azure/go-autorest/logger@v0.2.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/go-autorest/logger/@v/v0.2.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.12" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2021-02-05 22:21:48 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/go-autorest/logger@v0.2.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/go-autorest/logger" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.12" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/Azure/go-autorest/tracing", + "version": "v0.6.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "faf86d3c2ef9e17b1adb7203ec6946b2b74a069500efd58200a3cf6550b60de5" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n Copyright 2015 Microsoft Corporation\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/Azure/go-autorest/tracing@v0.6.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/Azure/go-autorest/tracing@v0.6.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure/go-autorest/tracing/@v/v0.6.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.12" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2020-06-23 18:36:26 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure/go-autorest/tracing@v0.6.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/Azure/go-autorest/tracing" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.12" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/AzureAD/microsoft-authentication-library-for-go", + "version": "v1.7.2", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "1caa50c6459a18b27e0ffe47f10469c905c0d5e2a3c6416538cc1c939fb7dc99" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " MIT License\r\n\r\n Copyright (c) Microsoft Corporation.\r\n\r\n Permission is hereby granted, free of charge, to any person obtaining a copy\r\n of this software and associated documentation files (the \"Software\"), to deal\r\n in the Software without restriction, including without limitation the rights\r\n to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\r\n copies of the Software, and to permit persons to whom the Software is\r\n furnished to do so, subject to the following conditions:\r\n\r\n The above copyright notice and this permission notice shall be included in all\r\n copies or substantial portions of the Software.\r\n\r\n THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\r\n IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\r\n FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\r\n AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\r\n LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\r\n OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\r\n SOFTWARE\r\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/AzureAD/microsoft-authentication-library-for-go@v1.7.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/AzureAD/microsoft-authentication-library-for-go@v1.7.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/!azure!a!d/microsoft-authentication-library-for-go/@v/v1.7.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.18" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-11 16:20:31 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/!azure!a!d/microsoft-authentication-library-for-go@v1.7.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/AzureAD/microsoft-authentication-library-for-go" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.18" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/blang/semver", + "version": "v3.5.1+incompatible", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "91104b979889fad0f84dc38ec6ccbfd1f9f079b36de445a5612032ad39e3cb29" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License\n\nCopyright (c) 2014 Benedikt Lang \n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/blang/semver@v3.5.1%2Bincompatible", + "type": "library", + "bom-ref": "pkg:golang/github.com/blang/semver@v3.5.1+incompatible", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/blang/semver/@v/v3.5.1+incompatible.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2017-07-27 06:48:18 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/blang/semver@v3.5.1+incompatible" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/blang/semver" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/buildkite/agent/v3", + "version": "v3.130.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "bdd47f48b6f359a91684ae3040eed2456d58acc190bcffb90113578155f0d0b1" + } + ], + "purl": "pkg:golang/github.com/buildkite/agent/v3@v3.130.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/buildkite/agent/v3@v3.130.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/buildkite/agent/v3/@v/v3.130.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.8" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-07-01 04:11:33 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/buildkite/agent/v3@v3.130.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/buildkite/agent/v3" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.8" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "11" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "6" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "3" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go", + "line": 70 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/buildkite", + "module": "method", + "function": "Provide", + "line": 63, + "column": 26, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/buildkite", + "module": "method", + "function": "Provide", + "line": 60, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/buildkite", + "module": "method", + "function": "Provide", + "line": 55, + "column": 31, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/buildkite", + "module": "method", + "function": "Provide", + "line": 63, + "column": 49, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/buildkite", + "module": "method", + "function": "Provide", + "line": 62, + "column": 29, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/buildkite", + "module": "method", + "function": "Provide", + "line": 70, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/buildkite", + "module": "method", + "function": "Provide", + "line": 62, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/buildkite", + "module": "method", + "function": "Provide", + "line": 55, + "column": 7, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/buildkite/buildkite.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/buildkite/go-pipeline", + "version": "v0.17.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "544dfba98dd7e6998028a50ca0366f3ec1ce42ec9a901f5c9978fd427e906ac0" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2023 Buildkite\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/buildkite/go-pipeline@v0.17.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/buildkite/go-pipeline@v0.17.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/buildkite/go-pipeline/@v/v0.17.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-21 06:33:09 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/buildkite/go-pipeline@v0.17.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/buildkite/go-pipeline" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/buildkite/interpolate", + "version": "v0.1.5", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "7479ebc077b0e4ef1534e020303a7046516784be5548de8cd5b1d599167d09c7" + } + ], + "purl": "pkg:golang/github.com/buildkite/interpolate@v0.1.5", + "type": "library", + "bom-ref": "pkg:golang/github.com/buildkite/interpolate@v0.1.5", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/buildkite/interpolate/@v/v0.1.5.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.22" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-12-16 21:33:37 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/buildkite/interpolate@v0.1.5" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/buildkite/interpolate" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.22" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/buildkite/roko", + "version": "v1.4.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "d2f6ce0ea50511c55fe2fdb155745f65946ca8956c0821d31bf4c1441c862b81" + } + ], + "purl": "pkg:golang/github.com/buildkite/roko@v1.4.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/buildkite/roko@v1.4.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/buildkite/roko/@v/v1.4.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.21" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-08-25 05:32:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/buildkite/roko@v1.4.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.md" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/buildkite/roko" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.21" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/cenkalti/backoff/v4", + "version": "v4.3.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "63754d9ed90e50fc5355e53127f1b9bdc33ffc09707e6c98a3355ca2684b8991" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2014 Cenk Altı\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/cenkalti/backoff/v4/@v/v4.3.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.18" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-01-02 22:56:19 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/cenkalti/backoff/v4@v4.3.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/cenkalti/backoff/v4" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.18" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/cenkalti/backoff/v5", + "version": "v5.0.3", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "ae4859746dc966e92cc037fb7f4730a8f364e0ad2c6be17dec1c59b619bf72bc" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2014 Cenk Altı\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", + "type": "library", + "bom-ref": "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/cenkalti/backoff/v5/@v/v5.0.3.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-07-23 16:23:35 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/cenkalti/backoff/v5@v5.0.3" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/cenkalti/backoff/v5" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/cespare/xxhash/v2", + "version": "v2.3.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "5465f40d0dd0ea45a2ec0a007990ed877fe3dc116d3994795cb14681cae308eb" + } + ], + "purl": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/cespare/xxhash/v2/@v/v2.3.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.11" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-04-04 20:00:10 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/cespare/xxhash/v2@v2.3.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/cespare/xxhash/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.11" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/chrismellard/docker-credential-acr-env", + "version": "v0.0.0-20230304212654-82a0ddb27589", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "3ae0f2be62e7302c1ad9ea782649ba9f2034a1c26e6651b2936806b1e5731113" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/chrismellard/docker-credential-acr-env@v0.0.0-20230304212654-82a0ddb27589", + "type": "library", + "bom-ref": "pkg:golang/github.com/chrismellard/docker-credential-acr-env@v0.0.0-20230304212654-82a0ddb27589", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/chrismellard/docker-credential-acr-env/@v/v0.0.0-20230304212654-82a0ddb27589.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.18" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-03-04 21:26:54 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/chrismellard/docker-credential-acr-env@v0.0.0-20230304212654-82a0ddb27589" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/chrismellard/docker-credential-acr-env" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.18" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "2" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 28 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "GetRegistryClientOpts", + "line": 146, + "column": 32, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/clbanning/mxj/v2", + "version": "v2.7.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "84d896a96d7887e91cf8c745f42ebf62845f8c4268477a2eead9ff428faf7b6b" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2012-2021 Charles Banning . All rights reserved.\n\nThe MIT License (MIT)\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/clbanning/mxj/v2@v2.7.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/clbanning/mxj/v2@v2.7.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/clbanning/mxj/v2/@v/v2.7.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.15" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-02-10 17:23:09 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/clbanning/mxj/v2@v2.7.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/clbanning/mxj/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.15" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/cockroachdb/apd/v3", + "version": "v3.2.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "9255c9723a7e15f7cb4c7961206ebdb5ecd30ef74fd3ae67683b07cca8584aa7" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/cockroachdb/apd/v3@v3.2.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/cockroachdb/apd/v3@v3.2.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/cockroachdb/apd/v3/@v/v3.2.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.17" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-09-13 03:04:08 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/cockroachdb/apd/v3@v3.2.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/cockroachdb/apd/v3" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.17" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/common-nighthawk/go-figure", + "version": "v0.0.0-20210622060536-734e95fb86be", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "9a4e4843e63465e3bcedbf39f13940eb8e6c55c11c6e25fa62a3fdf24b7eefec" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2018 Daniel Deutsch\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/common-nighthawk/go-figure@v0.0.0-20210622060536-734e95fb86be", + "type": "library", + "bom-ref": "pkg:golang/github.com/common-nighthawk/go-figure@v0.0.0-20210622060536-734e95fb86be", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/common-nighthawk/go-figure/@v/v0.0.0-20210622060536-734e95fb86be.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2021-06-22 06:05:36 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/common-nighthawk/go-figure@v0.0.0-20210622060536-734e95fb86be" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/common-nighthawk/go-figure" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/coreos/go-oidc/v3", + "version": "v3.18.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "0d809fdb8fa77188be5e4207f7b198d7e76aa1195b692236e8a553088f52ad8e" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/coreos/go-oidc/v3@v3.18.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/coreos/go-oidc/v3@v3.18.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/coreos/go-oidc/v3/@v/v3.18.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-08 03:20:45 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/coreos/go-oidc/v3@v3.18.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,NOTICE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/coreos/go-oidc/v3" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/cpuguy83/go-md2man/v2", + "version": "v2.0.7", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "a0e5b47a2a024c0e9c3a230b8943d93a9715c4c8a0e8d21043b392d399f51788" + } + ], + "purl": "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.7", + "type": "library", + "bom-ref": "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.7", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/cpuguy83/go-md2man/v2/@v/v2.0.7.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.12" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-04-24 23:51:24 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/cpuguy83/go-md2man/v2@v2.0.7" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.md" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/cpuguy83/go-md2man/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.12" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/cyberphone/json-canonicalization", + "version": "v0.0.0-20241213102144-19d51d7fe467", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "bb3be59b59b184791d7ea8ad480f768bb49ef92f64b0e9f76b7aa6bff932382c" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Copyright 2018 Anders Rundgren\r\n\r\n Licensed under the Apache License, Version 2.0 (the \"License\");\r\n you may not use this file except in compliance with the License.\r\n You may obtain a copy of the License at\r\n\r\n https://www.apache.org/licenses/LICENSE-2.0\r\n\r\n Unless required by applicable law or agreed to in writing, software\r\n distributed under the License is distributed on an \"AS IS\" BASIS,\r\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r\n See the License for the specific language governing permissions and\r\n limitations under the License.\r\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/cyberphone/json-canonicalization@v0.0.0-20241213102144-19d51d7fe467", + "type": "library", + "bom-ref": "pkg:golang/github.com/cyberphone/json-canonicalization@v0.0.0-20241213102144-19d51d7fe467", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/cyberphone/json-canonicalization/@v/v0.0.0-20241213102144-19d51d7fe467.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-12-13 10:21:44 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/cyberphone/json-canonicalization@v0.0.0-20241213102144-19d51d7fe467" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/cyberphone/json-canonicalization" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "2" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1627 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 40 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "VerifySET", + "line": 1627, + "column": 24, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/davecgh/go-spew", + "version": "v1.1.2-0.20180830191138-d8f796af33cc", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "27b63c61c5b636286c826568fe6bf7940c25fec90e37888b1e34ac23e7391f7f" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "ISC License\n\nCopyright (c) 2012-2016 Dave Collins \n\nPermission to use, copy, modify, and/or distribute this software for any\npurpose with or without fee is hereby granted, provided that the above\ncopyright notice and this permission notice appear in all copies.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\" AND THE AUTHOR DISCLAIMS ALL WARRANTIES\nWITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF\nMERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR\nANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES\nWHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN\nACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF\nOR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "type": "library", + "bom-ref": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/davecgh/go-spew/@v/v1.1.2-0.20180830191138-d8f796af33cc.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2018-08-30 19:11:38 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/davecgh/go-spew" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/digitorus/pkcs7", + "version": "v0.0.0-20230818184609-3a137a874352", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "48a544c6e4bebe9bb697d22839cd11c2a13b3589dbd0995c1471671099150f37" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2015 Andrew Smith\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352", + "type": "library", + "bom-ref": "pkg:golang/github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/digitorus/pkcs7/@v/v0.0.0-20230818184609-3a137a874352.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.13" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-08-18 18:46:09 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/digitorus/pkcs7" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.13" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/digitorus/timestamp", + "version": "v0.0.0-20231217203849-220c5c2851b7", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "1af5a7b57f6a89394eb9dd16910e9ec059b42cfcb92544755e8d0d81b775c3a6" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "BSD 2-Clause License\n\nCopyright (c) 2017, Digitorus B.V.\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\n list of conditions and the following disclaimer.\n\n2. Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7", + "type": "library", + "bom-ref": "pkg:golang/github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/digitorus/timestamp/@v/v0.0.0-20231217203849-220c5c2851b7.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.16" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-12-17 20:38:49 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/digitorus/timestamp" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.16" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "22" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "4" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "14" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "4" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 530 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 531 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 532 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 533 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 534 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 535 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1463 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 834 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 841 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTimestampSummary", + "line": 534, + "column": 61, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTimestampSummary", + "line": 531, + "column": 34, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTimestampSummary", + "line": 530, + "column": 23, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTimestampSummary", + "line": 532, + "column": 44, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTimestampSummary", + "line": 533, + "column": 83, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTimestampSummary", + "line": 535, + "column": 36, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/internal/pkg/cosign/tsa/client", + "module": "method", + "function": "GetTimestampResponse", + "line": 154, + "column": 13, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go" + }, + { + "package": "github.com/sigstore/cosign/v3/internal/pkg/cosign/tsa/client", + "module": "method", + "function": "GetTimestampResponse", + "line": 159, + "column": 59, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/dimchansky/utfbom", + "version": "v1.1.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "4b17681011f9a88a85a1c1ccc86397540c9b60976bef56f543f8f49800adadf1" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright (c) 2018-2020, Dmitrij Koniajev (dimchansky@gmail.com)\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/dimchansky/utfbom@v1.1.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/dimchansky/utfbom@v1.1.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/dimchansky/utfbom/@v/v1.1.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2020-11-06 16:33:08 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/dimchansky/utfbom@v1.1.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/dimchansky/utfbom" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/docker/cli", + "version": "v29.5.3+incompatible", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "24baf3aa7283698068a7b1f68daa8fb54e211ef30a3febe30b0bb6baccdc2c8f" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n https://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n Copyright 2013-2017 Docker, Inc.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n https://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/docker/cli@v29.5.3%2Bincompatible", + "type": "library", + "bom-ref": "pkg:golang/github.com/docker/cli@v29.5.3+incompatible", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/docker/cli/@v/v29.5.3+incompatible.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-03 17:16:33 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/docker/cli@v29.5.3+incompatible" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,NOTICE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/docker/cli" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/docker/docker-credential-helpers", + "version": "v0.9.5", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "bf54be85ea68c2b4172139047f0ea8e3e04c6c6a2dd36c222a9cd68465192ba7" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2016 David Calavera\n\nPermission is hereby granted, free of charge, to any person obtaining\na copy of this software and associated documentation files (the\n\"Software\"), to deal in the Software without restriction, including\nwithout limitation the rights to use, copy, modify, merge, publish,\ndistribute, sublicense, and/or sell copies of the Software, and to\npermit persons to whom the Software is furnished to do so, subject to\nthe following conditions:\n\nThe above copyright notice and this permission notice shall be\nincluded in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\nEXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\nMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.\nIN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY\nCLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,\nTORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\nSOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/docker/docker-credential-helpers@v0.9.5", + "type": "library", + "bom-ref": "pkg:golang/github.com/docker/docker-credential-helpers@v0.9.5", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/docker/docker-credential-helpers/@v/v0.9.5.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.21" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-01-08 16:44:32 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/docker/docker-credential-helpers@v0.9.5" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/docker/docker-credential-helpers" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.21" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/dustin/go-humanize", + "version": "v1.0.1", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "32ed7322ce97c15b85fe023539ea6f234a83d7cab2710c7e985ca48797c196da" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2005-2008 Dustin Sallings \n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/dustin/go-humanize@v1.0.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/dustin/go-humanize@v1.0.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/dustin/go-humanize/@v/v1.0.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.16" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-01-10 06:44:38 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/dustin/go-humanize@v1.0.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/dustin/go-humanize" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.16" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "2" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go", + "line": 18 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go", + "line": 29 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/internal/pkg/cosign/payload/size", + "module": "function", + "function": "CheckSize", + "line": 29, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/payload/size/size.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/emicklei/go-restful/v3", + "version": "v3.13.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "ea7dd704299041bdb908cd8b080086cfcba422b46bcbee1b86f6e95a7de6adb7" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2012,2013 Ernest Micklei\n\nMIT License\n\nPermission is hereby granted, free of charge, to any person obtaining\na copy of this software and associated documentation files (the\n\"Software\"), to deal in the Software without restriction, including\nwithout limitation the rights to use, copy, modify, merge, publish,\ndistribute, sublicense, and/or sell copies of the Software, and to\npermit persons to whom the Software is furnished to do so, subject to\nthe following conditions:\n\nThe above copyright notice and this permission notice shall be\nincluded in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\nEXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\nMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND\nNONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE\nLIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\nOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION\nWITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/emicklei/go-restful/v3@v3.13.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/emicklei/go-restful/v3@v3.13.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/emicklei/go-restful/v3/@v/v3.13.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.13" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-08-14 12:44:48 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/emicklei/go-restful/v3@v3.13.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/emicklei/go-restful/v3" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.13" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/emicklei/proto", + "version": "v1.14.3", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "ae7d458114bf14036265d0f6763c87ed3300f637510dc610f4810df72be35f40" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2017 Ernest Micklei\n\nMIT License\n\nPermission is hereby granted, free of charge, to any person obtaining\na copy of this software and associated documentation files (the\n\"Software\"), to deal in the Software without restriction, including\nwithout limitation the rights to use, copy, modify, merge, publish,\ndistribute, sublicense, and/or sell copies of the Software, and to\npermit persons to whom the Software is furnished to do so, subject to\nthe following conditions:\n\nThe above copyright notice and this permission notice shall be\nincluded in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\nEXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\nMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND\nNONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE\nLIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\nOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION\nWITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/emicklei/proto@v1.14.3", + "type": "library", + "bom-ref": "pkg:golang/github.com/emicklei/proto@v1.14.3", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/emicklei/proto/@v/v1.14.3.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.12" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-02-04 11:04:45 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/emicklei/proto@v1.14.3" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/emicklei/proto" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.12" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/felixge/httpsnoop", + "version": "v1.0.4", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "9bc28f24aaa4d601f927d0e0458d804a5da55827c62978b14b07af79af331f65" + } + ], + "purl": "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "type": "library", + "bom-ref": "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/felixge/httpsnoop/@v/v1.0.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.13" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-03-12 10:31:09 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/felixge/httpsnoop@v1.0.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/felixge/httpsnoop" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.13" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/fsnotify/fsnotify", + "version": "v1.10.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "4cb85ea9a9fa1c3e8604ae8fac35b20cf05a115f0bb293b1bcf4a30be6d57e0a" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright © 2012 The Go Authors. All rights reserved.\nCopyright © fsnotify Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without modification,\nare permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n list of conditions and the following disclaimer.\n* Redistributions in binary form must reproduce the above copyright notice, this\n list of conditions and the following disclaimer in the documentation and/or\n other materials provided with the distribution.\n* Neither the name of Google Inc. nor the names of its contributors may be used\n to endorse or promote products derived from this software without specific\n prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/fsnotify/fsnotify@v1.10.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/fsnotify/fsnotify@v1.10.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/fsnotify/fsnotify/@v/v1.10.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-04 10:39:17 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/fsnotify/fsnotify@v1.10.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/fsnotify/fsnotify" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/fxamacker/cbor/v2", + "version": "v2.9.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "bcce1bf83242b479fecf3ee1dc5169fe10c023d58d582b198f6dd5e72b6c4b14" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2019-present Faye Amacker\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/fxamacker/cbor/v2/@v/v2.9.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.20" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-07-14 04:00:34 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/fxamacker/cbor/v2@v2.9.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/fxamacker/cbor/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.20" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-chi/chi/v5", + "version": "v5.3.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "47eb5863684db955148f1a0fb6a51d801a9ebccf6cf678f39132eeb55b0e0ada" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2015-present Peter Kieltyka (https://github.com/pkieltyka), Google Inc.\n\nMIT License\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-chi/chi/v5@v5.3.0", + "type": "framework", + "bom-ref": "pkg:golang/github.com/go-chi/chi/v5@v5.3.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-chi/chi/v5/@v/v5.3.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-22 15:16:13 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-chi/chi/v5@v5.3.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-chi/chi/v5" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/go-jose/go-jose/v4", + "version": "v4.1.4", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "c78a146ac56bcd1ef4ef50384e71cb1923e934e9b66b6d4af4a7f4e24d6bb34f" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-jose/go-jose/v4/@v/v4.1.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-03-31 23:33:50 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-jose/go-jose/v4@v4.1.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-jose/go-jose/v4" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "4" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 24 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/internal/auth", + "module": "function", + "function": "idToken", + "line": 165, + "column": 36, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go" + }, + { + "package": "github.com/sigstore/cosign/v3/internal/auth", + "module": "function", + "function": "idToken", + "line": 165, + "column": 15, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go" + } + ] + } + }, + "tags": [ + "security" + ] + }, + { + "group": "", + "name": "github.com/go-logr/logr", + "version": "v1.4.3", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "f53d74e06cf2ad38a0148afcc2de6606b72d1cc8a6d0d6f61cb1ab990e342af6" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-logr/logr@v1.4.3", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-logr/logr@v1.4.3", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-logr/logr/@v/v1.4.3.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.18" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-05-19 04:56:57 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-logr/logr@v1.4.3" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-logr/logr" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.18" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-logr/stdr", + "version": "v1.2.2", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "98ca3fbed04ee5d61b7a1444a1ecba5d42b2fde4ae9a3082bde0e946b7b854a1" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-logr/stdr/@v/v1.2.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.16" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2021-12-14 08:00:35 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-logr/stdr@v1.2.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-logr/stdr" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.16" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/analysis", + "version": "v0.25.2", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "521b35b7fd97475d049f038d6082c6133c3c81c7c6206e579392b60319e1a83a" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/analysis@v0.25.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/analysis@v0.25.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/analysis/@v/v0.25.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-02 20:24:19 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/analysis@v0.25.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/analysis" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/errors", + "version": "v0.22.8", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "06e5281dc62b53a13b57d81f8f5239c0b42a82d2079eea7f6a55d9f0a760434c" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/errors@v0.22.8", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/errors@v0.22.8", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/errors/@v/v0.22.8.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-31 08:09:15 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/errors@v0.22.8" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/errors" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/jsonpointer", + "version": "v0.23.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "896466653ac69fb5f0621b4fb7f7ef752163d4e7cd06782a453d941b70714aa6" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/jsonpointer@v0.23.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/jsonpointer@v0.23.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/jsonpointer/@v/v0.23.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-18 11:48:20 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/jsonpointer@v0.23.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,NOTICE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/jsonpointer" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/jsonreference", + "version": "v0.21.6", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "c736e0b50dd96d6c6f113dc0c5dcc226526deaf928bdb7fe21f48f2630f4b546" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/jsonreference@v0.21.6", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/jsonreference@v0.21.6", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/jsonreference/@v/v0.21.6.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-31 08:07:13 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/jsonreference@v0.21.6" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,NOTICE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/jsonreference" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/loads", + "version": "v0.24.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "c503205fe870e71440846adc0d7c5e330efc205a94a48ce195ebb71ea3e1c85e" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/loads@v0.24.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/loads@v0.24.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/loads/@v/v0.24.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-07 15:16:55 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/loads@v0.24.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/loads" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/runtime", + "version": "v0.32.4", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "073ea478e670d4d5f84fa7fe9b8d8ea13d4c04f0ede917b5ddd6dc707c861ffe" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/runtime@v0.32.4", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/runtime@v0.32.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/runtime/@v/v0.32.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-19 07:30:21 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/runtime@v0.32.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,NOTICE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/runtime" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "3" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1536 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 42 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "extractEntryImpl", + "line": 1536, + "column": 113, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/go-openapi/runtime/server-middleware", + "version": "v0.30.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "398353fd3c4dbc1fd52b9a1ee21b4cda30d3c25117b9e8d5266bb40d565f00cb" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/runtime/server-middleware@v0.30.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/runtime/server-middleware@v0.30.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/runtime/server-middleware/@v/v0.30.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-13 20:17:54 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/runtime/server-middleware@v0.30.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/runtime/server-middleware" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "middleware" + ] + }, + { + "group": "", + "name": "github.com/go-openapi/spec", + "version": "v0.22.6", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "1d9bd31dab7e887d0f00b4115a1aea207b54fcf12ac6a77cf5fbb43311a531e3" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/spec@v0.22.6", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/spec@v0.22.6", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/spec/@v/v0.22.6.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-14 12:30:30 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/spec@v0.22.6" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,license.go" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/spec" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/strfmt", + "version": "v0.26.4", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "84d262ea76f91130fa8bb035c91a34dccf52e99a133cfa167dfd6251ec667d47" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/strfmt@v0.26.4", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/strfmt@v0.26.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/strfmt/@v/v0.26.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-29 15:33:28 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/strfmt@v0.26.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/strfmt" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "11" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "10" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1580 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1585 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1587 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1605 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1607 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1609 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1614 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1616 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "rekorEntry", + "line": 195, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "rekorEntry", + "line": 197, + "column": 15, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "bundleSig", + "line": 1580, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "bundleSig", + "line": 1585, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "bundleSig", + "line": 1587, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "bundleKey", + "line": 1605, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "bundleKey", + "line": 1607, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "bundleKey", + "line": 1609, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/go-openapi/swag", + "version": "v0.26.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "c8d637f016c856d8716e40edab550704219ab01aa36a45b794247a00dcdd044c" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/swag@v0.26.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/swag@v0.26.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/swag/@v/v0.26.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-07 11:54:50 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/swag@v0.26.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/swag" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/swag/cmdutils", + "version": "v0.26.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "4a6d4c54532417a82e249fa942a1e7400dcdd23f6a00b577371cc34afe9b1133" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/swag/cmdutils@v0.26.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/swag/cmdutils@v0.26.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/swag/cmdutils/@v/v0.26.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-07 11:54:50 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/swag/cmdutils@v0.26.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/swag/cmdutils" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/swag/conv", + "version": "v0.27.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "a5f8afd2e2904db68602993c66cfe5655dee4a3992a5ad853b5cb5f3762780df" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/swag/conv@v0.27.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/swag/conv@v0.27.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/swag/conv/@v/v0.27.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-29 18:30:18 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/swag/conv@v0.27.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/swag/conv" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "4" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "3" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 276 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 32 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "rekorEntry", + "line": 190, + "column": 17, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "rekorEntry", + "line": 191, + "column": 17, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "proposedEntries", + "line": 276, + "column": 16, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/go-openapi/swag/fileutils", + "version": "v0.26.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "998520c5000a5f84a14b7aafbf24b1fbff72ae55270e18e20f509a95a425f254" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/swag/fileutils@v0.26.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/swag/fileutils@v0.26.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/swag/fileutils/@v/v0.26.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-07 11:54:50 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/swag/fileutils@v0.26.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/swag/fileutils" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/swag/jsonname", + "version": "v0.26.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "3af756e81a16a23df7a537e2ef1f6f16b8264fe7e4edac34051c2f084d183ae7" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/swag/jsonname@v0.26.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/swag/jsonname@v0.26.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/swag/jsonname/@v/v0.26.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-07 11:54:50 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/swag/jsonname@v0.26.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/swag/jsonname" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/swag/jsonutils", + "version": "v0.26.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "53e44c247df06bee81462a61b91b48c88f1f5bd1cf16a150e2c1e4da8471d144" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.26.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.26.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/swag/jsonutils/@v/v0.26.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-07 11:54:50 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/swag/jsonutils@v0.26.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/swag/jsonutils" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/swag/loading", + "version": "v0.26.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "deabd12255b359dab51ef9a57709ae276a21a5c02bc8deb156dd8e4ca774ffb1" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/swag/loading@v0.26.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/swag/loading@v0.26.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/swag/loading/@v/v0.26.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-07 11:54:50 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/swag/loading@v0.26.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/swag/loading" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/swag/mangling", + "version": "v0.26.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "3ce1130c7d3586a01d0125dfc3b21211df5b08e13ac411ceb7c3479866519983" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/swag/mangling@v0.26.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/swag/mangling@v0.26.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/swag/mangling/@v/v0.26.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-07 11:54:50 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/swag/mangling@v0.26.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/swag/mangling" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/swag/netutils", + "version": "v0.26.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "cb4daf0728598503c0570397fb42a2a57159fe151b93a1bf12785fe6b19a3a44" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/swag/netutils@v0.26.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/swag/netutils@v0.26.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/swag/netutils/@v/v0.26.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-07 11:54:50 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/swag/netutils@v0.26.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/swag/netutils" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/swag/stringutils", + "version": "v0.26.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "49ce9dddb53c7e0939032651f3ff23110f88b3f02577e4c3fc822080f37c5099" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/swag/stringutils@v0.26.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/swag/stringutils@v0.26.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/swag/stringutils/@v/v0.26.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-07 11:54:50 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/swag/stringutils@v0.26.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/swag/stringutils" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/swag/typeutils", + "version": "v0.27.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "4ab9b4c4535167563ebc2c49725a39ab3c7c6a3fb5a4029d6bf61f14fac6d1d4" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/swag/typeutils@v0.27.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/swag/typeutils@v0.27.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/swag/typeutils/@v/v0.27.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-29 18:30:18 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/swag/typeutils@v0.27.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/swag/typeutils" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/swag/yamlutils", + "version": "v0.26.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "ed6e5becf457f4cc702fb4e3786ec7f0793204646c20344e6e1c8c5858012363" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.26.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.26.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/swag/yamlutils/@v/v0.26.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-07 11:54:50 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/swag/yamlutils@v0.26.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/swag/yamlutils" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-openapi/validate", + "version": "v0.26.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "6f8a34d2eabb7c978903ec1685514226929372dcde170cd9226186987b25d890" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-openapi/validate@v0.26.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-openapi/validate@v0.26.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-openapi/validate/@v/v0.26.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-10 16:37:43 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-openapi/validate@v0.26.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-openapi/validate" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/go-viper/mapstructure/v2", + "version": "v2.5.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "a090c7dc124acaa040d935c5843b0a0c60d3967758399eab192d014592311a13" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2013 Mitchell Hashimoto\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/go-viper/mapstructure/v2/@v/v2.5.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.18" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-01-12 17:24:26 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/go-viper/mapstructure/v2@v2.5.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/go-viper/mapstructure/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.18" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/gobwas/glob", + "version": "v0.2.3", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "777133e31d3a97d6d9b52bf321acb9f98ce2d1f999ccf8274db3dc2a3240913f" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2016 Sergey Kamardin\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/gobwas/glob@v0.2.3", + "type": "library", + "bom-ref": "pkg:golang/github.com/gobwas/glob@v0.2.3", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/gobwas/glob/@v/v0.2.3.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2018-02-08 21:06:56 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/gobwas/glob@v0.2.3" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/gobwas/glob" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/golang-jwt/jwt/v4", + "version": "v4.5.2", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "9b6d4b8e853e7aa26bdf89660cc6eb798d9e493449d5cbfbef0dfdfcc6340a1d" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2012 Dave Grijalva\nCopyright (c) 2021 golang-jwt maintainers\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/golang-jwt/jwt/v4@v4.5.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/golang-jwt/jwt/v4@v4.5.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/golang-jwt/jwt/v4/@v/v4.5.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.16" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-03-21 20:49:30 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/golang-jwt/jwt/v4@v4.5.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/golang-jwt/jwt/v4" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.16" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/golang-jwt/jwt/v5", + "version": "v5.3.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "7f10912d630ee3795173c9e11d663a2c6a9171ffb5810580aeca9a11411ae5b1" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2012 Dave Grijalva\nCopyright (c) 2021 golang-jwt maintainers\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/golang-jwt/jwt/v5/@v/v5.3.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.21" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-01-28 19:58:13 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/golang-jwt/jwt/v5@v5.3.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/golang-jwt/jwt/v5" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.21" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/golang/snappy", + "version": "v0.0.4", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "fd7c5b7e6320f25c5e7ca33b2170b77c1365ffb6d171cef6682473116ae63f64" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2011 The Snappy-Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/golang/snappy@v0.0.4", + "type": "library", + "bom-ref": "pkg:golang/github.com/golang/snappy@v0.0.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/golang/snappy/@v/v0.0.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2021-06-08 04:05:37 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/golang/snappy@v0.0.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/golang/snappy" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/google/certificate-transparency-go", + "version": "v1.3.3", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "891d7b66049a5d1cd26b9aaf8c597c4e7543e61f24cb624c562a3e773a0a3200" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/google/certificate-transparency-go@v1.3.3", + "type": "library", + "bom-ref": "pkg:golang/github.com/google/certificate-transparency-go@v1.3.3", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/google/certificate-transparency-go/@v/v1.3.3.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-02-26 11:25:10 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/google/certificate-transparency-go@v1.3.3" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/google/certificate-transparency-go" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "42" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "7" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "22" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "13" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 407 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 412 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 414 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 422 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 425 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 426 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 430 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 92 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateCertificateSummary", + "line": 422, + "column": 55, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateCertificateSummary", + "line": 425, + "column": 13, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateCertificateSummary", + "line": 430, + "column": 74, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateCertificateSummary", + "line": 414, + "column": 34, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateCertificateSummary", + "line": 407, + "column": 25, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateCertificateSummary", + "line": 426, + "column": 44, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateCertificateSummary", + "line": 412, + "column": 53, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/fulcioverifier/ctutil", + "module": "function", + "function": "createLeaf", + "line": 187, + "column": 15, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fulcioverifier/ctutil/ctutil.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/google/gnostic-models", + "version": "v0.7.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "c212f91b49ba76673970fc4a7396dd29d10ddd48c8ece506c41970e7b9a20eb4" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/google/gnostic-models@v0.7.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/google/gnostic-models@v0.7.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/google/gnostic-models/@v/v0.7.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.22" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-06-26 15:23:00 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/google/gnostic-models@v0.7.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/google/gnostic-models" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.22" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/google/go-cmp", + "version": "v0.7.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "a578aa9a7480f763871046bd1d72f65b813b95ff49cc29865547608d7dcdfe25" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2017 The Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/google/go-cmp@v0.7.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/google/go-cmp@v0.7.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/google/go-cmp/@v/v0.7.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.21" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-01-14 18:15:44 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/google/go-cmp@v0.7.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/google/go-cmp" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.21" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/google/go-containerregistry", + "version": "v0.21.7", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "92349bb7bff332c28b59f9c7ac8bcabe15c7530f758db7bd0cd8cf3c9df68171" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/google/go-containerregistry@v0.21.7", + "type": "library", + "bom-ref": "pkg:golang/github.com/google/go-containerregistry@v0.21.7", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/google/go-containerregistry/@v/v0.21.7.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-17 22:00:28 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/google/go-containerregistry@v0.21.7" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/google/go-containerregistry" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageKind", + "value": "functionValueCall" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "780" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "129" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "320" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "331" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 161 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 161 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/sbom.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/signature.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 169 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 161 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 355 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 365 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 440 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 441 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 443 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 452 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 405 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 409 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 169 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 192 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate/triangulate.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/blob.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload/wasm.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 262 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/obsolete.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/obsolete.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/index.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1006 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1683 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1696 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1706 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1732 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1739 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1749 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1750 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1754 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1755 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1756 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1809 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1815 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1820 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1825 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1850 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1855 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1860 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1866 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1867 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1868 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1869 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1873 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1899 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1905 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1907 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1908 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1912 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1913 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1930 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1935 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2020 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2025 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 672 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 679 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 718 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 720 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 724 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 730 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 735 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/empty/empty.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/empty/empty.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/empty/empty.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/empty/empty.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/empty/empty.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/empty/empty.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/empty/empty.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/file.go", + "line": 18 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/image.go", + "line": 18 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/index.go", + "line": 18 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/interface.go", + "line": 18 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/index.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/signatures.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/layout/write.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/map.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 335 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/mutate.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/options.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signatures.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/platform/platform.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/digest.go", + "line": 18 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/digest.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/digest.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/digest.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/digest.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/image.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/index.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/referrers.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 169 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 201 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 246 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 260 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 267 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 280 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 284 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/remote.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/unknown.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 218 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 244 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 252 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 258 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 262 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 268 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 269 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 271 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 277 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 295 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 296 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 298 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 300 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 302 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 306 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 314 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 316 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 317 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 332 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 334 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 338 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 342 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 351 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 362 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 368 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 370 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 371 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 372 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 378 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 379 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 380 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 381 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 406 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 414 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 431 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 470 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 474 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 478 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signatures.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/image.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signed/index.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/file.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/options.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 72 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "attachAttestation", + "line": 136, + "column": 37, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "SignatureCmd", + "line": 37, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "sbomCmdOCIExperimental", + "line": 97, + "column": 24, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "sbomCmdOCIExperimental", + "line": 89, + "column": 30, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "sbomCmdOCIExperimental", + "line": 120, + "column": 3, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "sbomCmdOCIExperimental", + "line": 89, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "sbomCmdOCIExperimental", + "line": 78, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "sbomCmdOCIExperimental", + "line": 121, + "column": 41, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sbom.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/google/go-github/v88", + "version": "v88.0.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "aee7d30e09f6378e708e1ba42d3cb19af73d9e2952a779abdd182db7a6f530fc" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2013 The go-github AUTHORS. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/google/go-github/v88@v88.0.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/google/go-github/v88@v88.0.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/google/go-github/v88/@v/v88.0.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-21 14:47:51 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/google/go-github/v88@v88.0.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/google/go-github/v88" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "18" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "6" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "11" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 66 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/github", + "module": "function", + "function": "encryptSecretWithPublicKey", + "line": 194, + "column": 22, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/github", + "module": "method", + "function": "PutSecret", + "line": 60, + "column": 17, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/github", + "module": "method", + "function": "PutSecret", + "line": 60, + "column": 69, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/github", + "module": "function", + "function": "getPublicKey", + "line": 172, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/github", + "module": "method", + "function": "PutSecret", + "line": 66, + "column": 34, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/github", + "module": "method", + "function": "PutSecret", + "line": 60, + "column": 34, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/github", + "module": "function", + "function": "createOrUpdateOrgSecret", + "line": 167, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/github", + "module": "function", + "function": "getPublicKey", + "line": 174, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/google/go-querystring", + "version": "v1.2.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "f08149aa9491213c89f10850d776e66de3010df99e109643e40d1e8043a692a5" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2013 Google. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/google/go-querystring@v1.2.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/google/go-querystring@v1.2.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/google/go-querystring/@v/v1.2.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.13" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-11-10 17:18:24 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/google/go-querystring@v1.2.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/google/go-querystring" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.13" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/google/s2a-go", + "version": "v0.1.9", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "600d048b66502f769ca30d8eeb691da7d5259ef32653b900e84bad9f47576b23" + } + ], + "purl": "pkg:golang/github.com/google/s2a-go@v0.1.9", + "type": "library", + "bom-ref": "pkg:golang/github.com/google/s2a-go@v0.1.9", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/google/s2a-go/@v/v0.1.9.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.20" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-01-06 17:53:46 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/google/s2a-go@v0.1.9" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.md" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/google/s2a-go" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.20" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/google/uuid", + "version": "v1.6.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "4c8c8f65ee0c82abdf7980c115e74ca061a9130fcba8e79a393fa787153ec87a" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2009,2014 Google Inc. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/google/uuid@v1.6.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/google/uuid@v1.6.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/google/uuid/@v/v1.6.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-01-23 18:54:04 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/google/uuid@v1.6.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/google/uuid" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/googleapis/enterprise-certificate-proxy", + "version": "v0.3.16", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "f586f4780907fd7aa1befdf36de29fffec0c26a09ea1c59ce8a2210ef100b981" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.16", + "type": "library", + "bom-ref": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.16", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/googleapis/enterprise-certificate-proxy/@v/v0.3.16.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.8" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-20 21:48:28 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/googleapis/enterprise-certificate-proxy@v0.3.16" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/googleapis/enterprise-certificate-proxy" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.8" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/googleapis/gax-go/v2", + "version": "v2.22.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "8ab5816c02d2af44a4dea96a6fd4b227587af168e0785ba23b323846ac39f9a6" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2016, Google Inc.\nAll rights reserved.\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/googleapis/gax-go/v2@v2.22.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/googleapis/gax-go/v2@v2.22.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/googleapis/gax-go/v2/@v/v2.22.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-14 19:15:00 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/googleapis/gax-go/v2@v2.22.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/googleapis/gax-go/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/grpc-ecosystem/grpc-gateway/v2", + "version": "v2.29.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "1f29779fa4f07b586fb5df575170de738a53be0312122c51b9028f4cc1f66cdb" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2015, Gengo, Inc.\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without modification,\nare permitted provided that the following conditions are met:\n\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n\n * Neither the name of Gengo, Inc. nor the names of its\n contributors may be used to endorse or promote products derived from this\n software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.29.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.29.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/grpc-ecosystem/grpc-gateway/v2/@v/v2.29.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-15 18:42:47 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/grpc-ecosystem/grpc-gateway/v2@v2.29.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/grpc-ecosystem/grpc-gateway/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/hashicorp/errwrap", + "version": "v1.1.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "607fb514a88b5f11d29263ec78ffa4365ba568cb8fde7d9baef29612a93f25ce" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Mozilla Public License, version 2.0\n\n1. Definitions\n\n1.1. “Contributor”\n\n means each individual or legal entity that creates, contributes to the\n creation of, or owns Covered Software.\n\n1.2. “Contributor Version”\n\n means the combination of the Contributions of others (if any) used by a\n Contributor and that particular Contributor’s Contribution.\n\n1.3. “Contribution”\n\n means Covered Software of a particular Contributor.\n\n1.4. “Covered Software”\n\n means Source Code Form to which the initial Contributor has attached the\n notice in Exhibit A, the Executable Form of such Source Code Form, and\n Modifications of such Source Code Form, in each case including portions\n thereof.\n\n1.5. “Incompatible With Secondary Licenses”\n means\n\n a. that the initial Contributor has attached the notice described in\n Exhibit B to the Covered Software; or\n\n b. that the Covered Software was made available under the terms of version\n 1.1 or earlier of the License, but not also under the terms of a\n Secondary License.\n\n1.6. “Executable Form”\n\n means any form of the work other than Source Code Form.\n\n1.7. “Larger Work”\n\n means a work that combines Covered Software with other material, in a separate\n file or files, that is not Covered Software.\n\n1.8. “License”\n\n means this document.\n\n1.9. “Licensable”\n\n means having the right to grant, to the maximum extent possible, whether at the\n time of the initial grant or subsequently, any and all of the rights conveyed by\n this License.\n\n1.10. “Modifications”\n\n means any of the following:\n\n a. any file in Source Code Form that results from an addition to, deletion\n from, or modification of the contents of Covered Software; or\n\n b. any new file in Source Code Form that contains any Covered Software.\n\n1.11. “Patent Claims” of a Contributor\n\n means any patent claim(s), including without limitation, method, process,\n and apparatus claims, in any patent Licensable by such Contributor that\n would be infringed, but for the grant of the License, by the making,\n using, selling, offering for sale, having made, import, or transfer of\n either its Contributions or its Contributor Version.\n\n1.12. “Secondary License”\n\n means either the GNU General Public License, Version 2.0, the GNU Lesser\n General Public License, Version 2.1, the GNU Affero General Public\n License, Version 3.0, or any later versions of those licenses.\n\n1.13. “Source Code Form”\n\n means the form of the work preferred for making modifications.\n\n1.14. “You” (or “Your”)\n\n means an individual or a legal entity exercising rights under this\n License. For legal entities, “You” includes any entity that controls, is\n controlled by, or is under common control with You. For purposes of this\n definition, “control” means (a) the power, direct or indirect, to cause\n the direction or management of such entity, whether by contract or\n otherwise, or (b) ownership of more than fifty percent (50%) of the\n outstanding shares or beneficial ownership of such entity.\n\n\n2. License Grants and Conditions\n\n2.1. Grants\n\n Each Contributor hereby grants You a world-wide, royalty-free,\n non-exclusive license:\n\n a. under intellectual property rights (other than patent or trademark)\n Licensable by such Contributor to use, reproduce, make available,\n modify, display, perform, distribute, and otherwise exploit its\n Contributions, either on an unmodified basis, with Modifications, or as\n part of a Larger Work; and\n\n b. under Patent Claims of such Contributor to make, use, sell, offer for\n sale, have made, import, and otherwise transfer either its Contributions\n or its Contributor Version.\n\n2.2. Effective Date\n\n The licenses granted in Section 2.1 with respect to any Contribution become\n effective for each Contribution on the date the Contributor first distributes\n such Contribution.\n\n2.3. Limitations on Grant Scope\n\n The licenses granted in this Section 2 are the only rights granted under this\n License. No additional rights or licenses will be implied from the distribution\n or licensing of Covered Software under this License. Notwithstanding Section\n 2.1(b) above, no patent license is granted by a Contributor:\n\n a. for any code that a Contributor has removed from Covered Software; or\n\n b. for infringements caused by: (i) Your and any other third party’s\n modifications of Covered Software, or (ii) the combination of its\n Contributions with other software (except as part of its Contributor\n Version); or\n\n c. under Patent Claims infringed by Covered Software in the absence of its\n Contributions.\n\n This License does not grant any rights in the trademarks, service marks, or\n logos of any Contributor (except as may be necessary to comply with the\n notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\n No Contributor makes additional grants as a result of Your choice to\n distribute the Covered Software under a subsequent version of this License\n (see Section 10.2) or under the terms of a Secondary License (if permitted\n under the terms of Section 3.3).\n\n2.5. Representation\n\n Each Contributor represents that the Contributor believes its Contributions\n are its original creation(s) or it has sufficient rights to grant the\n rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\n This License is not intended to limit any rights You have under applicable\n copyright doctrines of fair use, fair dealing, or other equivalents.\n\n2.7. Conditions\n\n Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in\n Section 2.1.\n\n\n3. Responsibilities\n\n3.1. Distribution of Source Form\n\n All distribution of Covered Software in Source Code Form, including any\n Modifications that You create or to which You contribute, must be under the\n terms of this License. You must inform recipients that the Source Code Form\n of the Covered Software is governed by the terms of this License, and how\n they can obtain a copy of this License. You may not attempt to alter or\n restrict the recipients’ rights in the Source Code Form.\n\n3.2. Distribution of Executable Form\n\n If You distribute Covered Software in Executable Form then:\n\n a. such Covered Software must also be made available in Source Code Form,\n as described in Section 3.1, and You must inform recipients of the\n Executable Form how they can obtain a copy of such Source Code Form by\n reasonable means in a timely manner, at a charge no more than the cost\n of distribution to the recipient; and\n\n b. You may distribute such Executable Form under the terms of this License,\n or sublicense it under different terms, provided that the license for\n the Executable Form does not attempt to limit or alter the recipients’\n rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\n You may create and distribute a Larger Work under terms of Your choice,\n provided that You also comply with the requirements of this License for the\n Covered Software. If the Larger Work is a combination of Covered Software\n with a work governed by one or more Secondary Licenses, and the Covered\n Software is not Incompatible With Secondary Licenses, this License permits\n You to additionally distribute such Covered Software under the terms of\n such Secondary License(s), so that the recipient of the Larger Work may, at\n their option, further distribute the Covered Software under the terms of\n either this License or such Secondary License(s).\n\n3.4. Notices\n\n You may not remove or alter the substance of any license notices (including\n copyright notices, patent notices, disclaimers of warranty, or limitations\n of liability) contained within the Source Code Form of the Covered\n Software, except that You may alter any license notices to the extent\n required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\n You may choose to offer, and to charge a fee for, warranty, support,\n indemnity or liability obligations to one or more recipients of Covered\n Software. However, You may do so only on Your own behalf, and not on behalf\n of any Contributor. You must make it absolutely clear that any such\n warranty, support, indemnity, or liability obligation is offered by You\n alone, and You hereby agree to indemnify every Contributor for any\n liability incurred by such Contributor as a result of warranty, support,\n indemnity or liability terms You offer. You may include additional\n disclaimers of warranty and limitations of liability specific to any\n jurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n\n If it is impossible for You to comply with any of the terms of this License\n with respect to some or all of the Covered Software due to statute, judicial\n order, or regulation then You must: (a) comply with the terms of this License\n to the maximum extent possible; and (b) describe the limitations and the code\n they affect. Such description must be placed in a text file included with all\n distributions of the Covered Software under this License. Except to the\n extent prohibited by statute or regulation, such description must be\n sufficiently detailed for a recipient of ordinary skill to be able to\n understand it.\n\n5. Termination\n\n5.1. The rights granted under this License will terminate automatically if You\n fail to comply with any of its terms. However, if You become compliant,\n then the rights granted under this License from a particular Contributor\n are reinstated (a) provisionally, unless and until such Contributor\n explicitly and finally terminates Your grants, and (b) on an ongoing basis,\n if such Contributor fails to notify You of the non-compliance by some\n reasonable means prior to 60 days after You have come back into compliance.\n Moreover, Your grants from a particular Contributor are reinstated on an\n ongoing basis if such Contributor notifies You of the non-compliance by\n some reasonable means, this is the first time You have received notice of\n non-compliance with this License from such Contributor, and You become\n compliant prior to 30 days after Your receipt of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\n infringement claim (excluding declaratory judgment actions, counter-claims,\n and cross-claims) alleging that a Contributor Version directly or\n indirectly infringes any patent, then the rights granted to You by any and\n all Contributors for the Covered Software under Section 2.1 of this License\n shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user\n license agreements (excluding distributors and resellers) which have been\n validly granted by You or Your distributors under this License prior to\n termination shall survive termination.\n\n6. Disclaimer of Warranty\n\n Covered Software is provided under this License on an “as is” basis, without\n warranty of any kind, either expressed, implied, or statutory, including,\n without limitation, warranties that the Covered Software is free of defects,\n merchantable, fit for a particular purpose or non-infringing. The entire\n risk as to the quality and performance of the Covered Software is with You.\n Should any Covered Software prove defective in any respect, You (not any\n Contributor) assume the cost of any necessary servicing, repair, or\n correction. This disclaimer of warranty constitutes an essential part of this\n License. No use of any Covered Software is authorized under this License\n except under this disclaimer.\n\n7. Limitation of Liability\n\n Under no circumstances and under no legal theory, whether tort (including\n negligence), contract, or otherwise, shall any Contributor, or anyone who\n distributes Covered Software as permitted above, be liable to You for any\n direct, indirect, special, incidental, or consequential damages of any\n character including, without limitation, damages for lost profits, loss of\n goodwill, work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses, even if such party shall have been\n informed of the possibility of such damages. This limitation of liability\n shall not apply to liability for death or personal injury resulting from such\n party’s negligence to the extent applicable law prohibits such limitation.\n Some jurisdictions do not allow the exclusion or limitation of incidental or\n consequential damages, so this exclusion and limitation may not apply to You.\n\n8. Litigation\n\n Any litigation relating to this License may be brought only in the courts of\n a jurisdiction where the defendant maintains its principal place of business\n and such litigation shall be governed by laws of that jurisdiction, without\n reference to its conflict-of-law provisions. Nothing in this Section shall\n prevent a party’s ability to bring cross-claims or counter-claims.\n\n9. Miscellaneous\n\n This License represents the complete agreement concerning the subject matter\n hereof. If any provision of this License is held to be unenforceable, such\n provision shall be reformed only to the extent necessary to make it\n enforceable. Any law or regulation which provides that the language of a\n contract shall be construed against the drafter shall not be used to construe\n this License against a Contributor.\n\n\n10. Versions of the License\n\n10.1. New Versions\n\n Mozilla Foundation is the license steward. Except as provided in Section\n 10.3, no one other than the license steward has the right to modify or\n publish new versions of this License. Each version will be given a\n distinguishing version number.\n\n10.2. Effect of New Versions\n\n You may distribute the Covered Software under the terms of the version of\n the License under which You originally received the Covered Software, or\n under the terms of any subsequent version published by the license\n steward.\n\n10.3. Modified Versions\n\n If you create software not governed by this License, and you want to\n create a new license for such software, you may create and use a modified\n version of this License if you rename the license and remove any\n references to the name of the license steward (except to note that such\n modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses\n If You choose to distribute Source Code Form that is Incompatible With\n Secondary Licenses under the terms of this version of the License, the\n notice described in Exhibit B of this License must be attached.\n\nExhibit A - Source Code Form License Notice\n\n This Source Code Form is subject to the\n terms of the Mozilla Public License, v.\n 2.0. If a copy of the MPL was not\n distributed with this file, You can\n obtain one at\n http://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular file, then\nYou may include the notice in a location (such as a LICENSE file in a relevant\ndirectory) where a recipient would be likely to look for such a notice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - “Incompatible With Secondary Licenses” Notice\n\n This Source Code Form is “Incompatible\n With Secondary Licenses”, as defined by\n the Mozilla Public License, v. 2.0.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/hashicorp/errwrap/@v/v1.1.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2020-07-14 15:51:01 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/hashicorp/errwrap@v1.1.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/hashicorp/errwrap" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/hashicorp/go-cleanhttp", + "version": "v0.5.2", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "90efd80e53fc2f5df8e84e92a1dc3e3eba41495e3f4a8c425c663a06a3454f8f" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Mozilla Public License, version 2.0\n\n1. Definitions\n\n1.1. \"Contributor\"\n\n means each individual or legal entity that creates, contributes to the\n creation of, or owns Covered Software.\n\n1.2. \"Contributor Version\"\n\n means the combination of the Contributions of others (if any) used by a\n Contributor and that particular Contributor's Contribution.\n\n1.3. \"Contribution\"\n\n means Covered Software of a particular Contributor.\n\n1.4. \"Covered Software\"\n\n means Source Code Form to which the initial Contributor has attached the\n notice in Exhibit A, the Executable Form of such Source Code Form, and\n Modifications of such Source Code Form, in each case including portions\n thereof.\n\n1.5. \"Incompatible With Secondary Licenses\"\n means\n\n a. that the initial Contributor has attached the notice described in\n Exhibit B to the Covered Software; or\n\n b. that the Covered Software was made available under the terms of\n version 1.1 or earlier of the License, but not also under the terms of\n a Secondary License.\n\n1.6. \"Executable Form\"\n\n means any form of the work other than Source Code Form.\n\n1.7. \"Larger Work\"\n\n means a work that combines Covered Software with other material, in a\n separate file or files, that is not Covered Software.\n\n1.8. \"License\"\n\n means this document.\n\n1.9. \"Licensable\"\n\n means having the right to grant, to the maximum extent possible, whether\n at the time of the initial grant or subsequently, any and all of the\n rights conveyed by this License.\n\n1.10. \"Modifications\"\n\n means any of the following:\n\n a. any file in Source Code Form that results from an addition to,\n deletion from, or modification of the contents of Covered Software; or\n\n b. any new file in Source Code Form that contains any Covered Software.\n\n1.11. \"Patent Claims\" of a Contributor\n\n means any patent claim(s), including without limitation, method,\n process, and apparatus claims, in any patent Licensable by such\n Contributor that would be infringed, but for the grant of the License,\n by the making, using, selling, offering for sale, having made, import,\n or transfer of either its Contributions or its Contributor Version.\n\n1.12. \"Secondary License\"\n\n means either the GNU General Public License, Version 2.0, the GNU Lesser\n General Public License, Version 2.1, the GNU Affero General Public\n License, Version 3.0, or any later versions of those licenses.\n\n1.13. \"Source Code Form\"\n\n means the form of the work preferred for making modifications.\n\n1.14. \"You\" (or \"Your\")\n\n means an individual or a legal entity exercising rights under this\n License. For legal entities, \"You\" includes any entity that controls, is\n controlled by, or is under common control with You. For purposes of this\n definition, \"control\" means (a) the power, direct or indirect, to cause\n the direction or management of such entity, whether by contract or\n otherwise, or (b) ownership of more than fifty percent (50%) of the\n outstanding shares or beneficial ownership of such entity.\n\n\n2. License Grants and Conditions\n\n2.1. Grants\n\n Each Contributor hereby grants You a world-wide, royalty-free,\n non-exclusive license:\n\n a. under intellectual property rights (other than patent or trademark)\n Licensable by such Contributor to use, reproduce, make available,\n modify, display, perform, distribute, and otherwise exploit its\n Contributions, either on an unmodified basis, with Modifications, or\n as part of a Larger Work; and\n\n b. under Patent Claims of such Contributor to make, use, sell, offer for\n sale, have made, import, and otherwise transfer either its\n Contributions or its Contributor Version.\n\n2.2. Effective Date\n\n The licenses granted in Section 2.1 with respect to any Contribution\n become effective for each Contribution on the date the Contributor first\n distributes such Contribution.\n\n2.3. Limitations on Grant Scope\n\n The licenses granted in this Section 2 are the only rights granted under\n this License. No additional rights or licenses will be implied from the\n distribution or licensing of Covered Software under this License.\n Notwithstanding Section 2.1(b) above, no patent license is granted by a\n Contributor:\n\n a. for any code that a Contributor has removed from Covered Software; or\n\n b. for infringements caused by: (i) Your and any other third party's\n modifications of Covered Software, or (ii) the combination of its\n Contributions with other software (except as part of its Contributor\n Version); or\n\n c. under Patent Claims infringed by Covered Software in the absence of\n its Contributions.\n\n This License does not grant any rights in the trademarks, service marks,\n or logos of any Contributor (except as may be necessary to comply with\n the notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\n No Contributor makes additional grants as a result of Your choice to\n distribute the Covered Software under a subsequent version of this\n License (see Section 10.2) or under the terms of a Secondary License (if\n permitted under the terms of Section 3.3).\n\n2.5. Representation\n\n Each Contributor represents that the Contributor believes its\n Contributions are its original creation(s) or it has sufficient rights to\n grant the rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\n This License is not intended to limit any rights You have under\n applicable copyright doctrines of fair use, fair dealing, or other\n equivalents.\n\n2.7. Conditions\n\n Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in\n Section 2.1.\n\n\n3. Responsibilities\n\n3.1. Distribution of Source Form\n\n All distribution of Covered Software in Source Code Form, including any\n Modifications that You create or to which You contribute, must be under\n the terms of this License. You must inform recipients that the Source\n Code Form of the Covered Software is governed by the terms of this\n License, and how they can obtain a copy of this License. You may not\n attempt to alter or restrict the recipients' rights in the Source Code\n Form.\n\n3.2. Distribution of Executable Form\n\n If You distribute Covered Software in Executable Form then:\n\n a. such Covered Software must also be made available in Source Code Form,\n as described in Section 3.1, and You must inform recipients of the\n Executable Form how they can obtain a copy of such Source Code Form by\n reasonable means in a timely manner, at a charge no more than the cost\n of distribution to the recipient; and\n\n b. You may distribute such Executable Form under the terms of this\n License, or sublicense it under different terms, provided that the\n license for the Executable Form does not attempt to limit or alter the\n recipients' rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\n You may create and distribute a Larger Work under terms of Your choice,\n provided that You also comply with the requirements of this License for\n the Covered Software. If the Larger Work is a combination of Covered\n Software with a work governed by one or more Secondary Licenses, and the\n Covered Software is not Incompatible With Secondary Licenses, this\n License permits You to additionally distribute such Covered Software\n under the terms of such Secondary License(s), so that the recipient of\n the Larger Work may, at their option, further distribute the Covered\n Software under the terms of either this License or such Secondary\n License(s).\n\n3.4. Notices\n\n You may not remove or alter the substance of any license notices\n (including copyright notices, patent notices, disclaimers of warranty, or\n limitations of liability) contained within the Source Code Form of the\n Covered Software, except that You may alter any license notices to the\n extent required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\n You may choose to offer, and to charge a fee for, warranty, support,\n indemnity or liability obligations to one or more recipients of Covered\n Software. However, You may do so only on Your own behalf, and not on\n behalf of any Contributor. You must make it absolutely clear that any\n such warranty, support, indemnity, or liability obligation is offered by\n You alone, and You hereby agree to indemnify every Contributor for any\n liability incurred by such Contributor as a result of warranty, support,\n indemnity or liability terms You offer. You may include additional\n disclaimers of warranty and limitations of liability specific to any\n jurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n\n If it is impossible for You to comply with any of the terms of this License\n with respect to some or all of the Covered Software due to statute,\n judicial order, or regulation then You must: (a) comply with the terms of\n this License to the maximum extent possible; and (b) describe the\n limitations and the code they affect. Such description must be placed in a\n text file included with all distributions of the Covered Software under\n this License. Except to the extent prohibited by statute or regulation,\n such description must be sufficiently detailed for a recipient of ordinary\n skill to be able to understand it.\n\n5. Termination\n\n5.1. The rights granted under this License will terminate automatically if You\n fail to comply with any of its terms. However, if You become compliant,\n then the rights granted under this License from a particular Contributor\n are reinstated (a) provisionally, unless and until such Contributor\n explicitly and finally terminates Your grants, and (b) on an ongoing\n basis, if such Contributor fails to notify You of the non-compliance by\n some reasonable means prior to 60 days after You have come back into\n compliance. Moreover, Your grants from a particular Contributor are\n reinstated on an ongoing basis if such Contributor notifies You of the\n non-compliance by some reasonable means, this is the first time You have\n received notice of non-compliance with this License from such\n Contributor, and You become compliant prior to 30 days after Your receipt\n of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\n infringement claim (excluding declaratory judgment actions,\n counter-claims, and cross-claims) alleging that a Contributor Version\n directly or indirectly infringes any patent, then the rights granted to\n You by any and all Contributors for the Covered Software under Section\n 2.1 of this License shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user\n license agreements (excluding distributors and resellers) which have been\n validly granted by You or Your distributors under this License prior to\n termination shall survive termination.\n\n6. Disclaimer of Warranty\n\n Covered Software is provided under this License on an \"as is\" basis,\n without warranty of any kind, either expressed, implied, or statutory,\n including, without limitation, warranties that the Covered Software is free\n of defects, merchantable, fit for a particular purpose or non-infringing.\n The entire risk as to the quality and performance of the Covered Software\n is with You. Should any Covered Software prove defective in any respect,\n You (not any Contributor) assume the cost of any necessary servicing,\n repair, or correction. This disclaimer of warranty constitutes an essential\n part of this License. No use of any Covered Software is authorized under\n this License except under this disclaimer.\n\n7. Limitation of Liability\n\n Under no circumstances and under no legal theory, whether tort (including\n negligence), contract, or otherwise, shall any Contributor, or anyone who\n distributes Covered Software as permitted above, be liable to You for any\n direct, indirect, special, incidental, or consequential damages of any\n character including, without limitation, damages for lost profits, loss of\n goodwill, work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses, even if such party shall have been\n informed of the possibility of such damages. This limitation of liability\n shall not apply to liability for death or personal injury resulting from\n such party's negligence to the extent applicable law prohibits such\n limitation. Some jurisdictions do not allow the exclusion or limitation of\n incidental or consequential damages, so this exclusion and limitation may\n not apply to You.\n\n8. Litigation\n\n Any litigation relating to this License may be brought only in the courts\n of a jurisdiction where the defendant maintains its principal place of\n business and such litigation shall be governed by laws of that\n jurisdiction, without reference to its conflict-of-law provisions. Nothing\n in this Section shall prevent a party's ability to bring cross-claims or\n counter-claims.\n\n9. Miscellaneous\n\n This License represents the complete agreement concerning the subject\n matter hereof. If any provision of this License is held to be\n unenforceable, such provision shall be reformed only to the extent\n necessary to make it enforceable. Any law or regulation which provides that\n the language of a contract shall be construed against the drafter shall not\n be used to construe this License against a Contributor.\n\n\n10. Versions of the License\n\n10.1. New Versions\n\n Mozilla Foundation is the license steward. Except as provided in Section\n 10.3, no one other than the license steward has the right to modify or\n publish new versions of this License. Each version will be given a\n distinguishing version number.\n\n10.2. Effect of New Versions\n\n You may distribute the Covered Software under the terms of the version\n of the License under which You originally received the Covered Software,\n or under the terms of any subsequent version published by the license\n steward.\n\n10.3. Modified Versions\n\n If you create software not governed by this License, and you want to\n create a new license for such software, you may create and use a\n modified version of this License if you rename the license and remove\n any references to the name of the license steward (except to note that\n such modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary\n Licenses If You choose to distribute Source Code Form that is\n Incompatible With Secondary Licenses under the terms of this version of\n the License, the notice described in Exhibit B of this License must be\n attached.\n\nExhibit A - Source Code Form License Notice\n\n This Source Code Form is subject to the\n terms of the Mozilla Public License, v.\n 2.0. If a copy of the MPL was not\n distributed with this file, You can\n obtain one at\n http://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular file,\nthen You may include the notice in a location (such as a LICENSE file in a\nrelevant directory) where a recipient would be likely to look for such a\nnotice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - \"Incompatible With Secondary Licenses\" Notice\n\n This Source Code Form is \"Incompatible\n With Secondary Licenses\", as defined by\n the Mozilla Public License, v. 2.0.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/hashicorp/go-cleanhttp/@v/v0.5.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.13" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2021-02-03 18:51:13 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/hashicorp/go-cleanhttp@v0.5.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/hashicorp/go-cleanhttp" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.13" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/hashicorp/go-multierror", + "version": "v1.1.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "8b0f7be49feac0a3dd00ed5c94e7b62fcdf7d6dffdfdf9b06cf67a241e9e3283" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Mozilla Public License, version 2.0\n\n1. Definitions\n\n1.1. “Contributor”\n\n means each individual or legal entity that creates, contributes to the\n creation of, or owns Covered Software.\n\n1.2. “Contributor Version”\n\n means the combination of the Contributions of others (if any) used by a\n Contributor and that particular Contributor’s Contribution.\n\n1.3. “Contribution”\n\n means Covered Software of a particular Contributor.\n\n1.4. “Covered Software”\n\n means Source Code Form to which the initial Contributor has attached the\n notice in Exhibit A, the Executable Form of such Source Code Form, and\n Modifications of such Source Code Form, in each case including portions\n thereof.\n\n1.5. “Incompatible With Secondary Licenses”\n means\n\n a. that the initial Contributor has attached the notice described in\n Exhibit B to the Covered Software; or\n\n b. that the Covered Software was made available under the terms of version\n 1.1 or earlier of the License, but not also under the terms of a\n Secondary License.\n\n1.6. “Executable Form”\n\n means any form of the work other than Source Code Form.\n\n1.7. “Larger Work”\n\n means a work that combines Covered Software with other material, in a separate\n file or files, that is not Covered Software.\n\n1.8. “License”\n\n means this document.\n\n1.9. “Licensable”\n\n means having the right to grant, to the maximum extent possible, whether at the\n time of the initial grant or subsequently, any and all of the rights conveyed by\n this License.\n\n1.10. “Modifications”\n\n means any of the following:\n\n a. any file in Source Code Form that results from an addition to, deletion\n from, or modification of the contents of Covered Software; or\n\n b. any new file in Source Code Form that contains any Covered Software.\n\n1.11. “Patent Claims” of a Contributor\n\n means any patent claim(s), including without limitation, method, process,\n and apparatus claims, in any patent Licensable by such Contributor that\n would be infringed, but for the grant of the License, by the making,\n using, selling, offering for sale, having made, import, or transfer of\n either its Contributions or its Contributor Version.\n\n1.12. “Secondary License”\n\n means either the GNU General Public License, Version 2.0, the GNU Lesser\n General Public License, Version 2.1, the GNU Affero General Public\n License, Version 3.0, or any later versions of those licenses.\n\n1.13. “Source Code Form”\n\n means the form of the work preferred for making modifications.\n\n1.14. “You” (or “Your”)\n\n means an individual or a legal entity exercising rights under this\n License. For legal entities, “You” includes any entity that controls, is\n controlled by, or is under common control with You. For purposes of this\n definition, “control” means (a) the power, direct or indirect, to cause\n the direction or management of such entity, whether by contract or\n otherwise, or (b) ownership of more than fifty percent (50%) of the\n outstanding shares or beneficial ownership of such entity.\n\n\n2. License Grants and Conditions\n\n2.1. Grants\n\n Each Contributor hereby grants You a world-wide, royalty-free,\n non-exclusive license:\n\n a. under intellectual property rights (other than patent or trademark)\n Licensable by such Contributor to use, reproduce, make available,\n modify, display, perform, distribute, and otherwise exploit its\n Contributions, either on an unmodified basis, with Modifications, or as\n part of a Larger Work; and\n\n b. under Patent Claims of such Contributor to make, use, sell, offer for\n sale, have made, import, and otherwise transfer either its Contributions\n or its Contributor Version.\n\n2.2. Effective Date\n\n The licenses granted in Section 2.1 with respect to any Contribution become\n effective for each Contribution on the date the Contributor first distributes\n such Contribution.\n\n2.3. Limitations on Grant Scope\n\n The licenses granted in this Section 2 are the only rights granted under this\n License. No additional rights or licenses will be implied from the distribution\n or licensing of Covered Software under this License. Notwithstanding Section\n 2.1(b) above, no patent license is granted by a Contributor:\n\n a. for any code that a Contributor has removed from Covered Software; or\n\n b. for infringements caused by: (i) Your and any other third party’s\n modifications of Covered Software, or (ii) the combination of its\n Contributions with other software (except as part of its Contributor\n Version); or\n\n c. under Patent Claims infringed by Covered Software in the absence of its\n Contributions.\n\n This License does not grant any rights in the trademarks, service marks, or\n logos of any Contributor (except as may be necessary to comply with the\n notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\n No Contributor makes additional grants as a result of Your choice to\n distribute the Covered Software under a subsequent version of this License\n (see Section 10.2) or under the terms of a Secondary License (if permitted\n under the terms of Section 3.3).\n\n2.5. Representation\n\n Each Contributor represents that the Contributor believes its Contributions\n are its original creation(s) or it has sufficient rights to grant the\n rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\n This License is not intended to limit any rights You have under applicable\n copyright doctrines of fair use, fair dealing, or other equivalents.\n\n2.7. Conditions\n\n Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in\n Section 2.1.\n\n\n3. Responsibilities\n\n3.1. Distribution of Source Form\n\n All distribution of Covered Software in Source Code Form, including any\n Modifications that You create or to which You contribute, must be under the\n terms of this License. You must inform recipients that the Source Code Form\n of the Covered Software is governed by the terms of this License, and how\n they can obtain a copy of this License. You may not attempt to alter or\n restrict the recipients’ rights in the Source Code Form.\n\n3.2. Distribution of Executable Form\n\n If You distribute Covered Software in Executable Form then:\n\n a. such Covered Software must also be made available in Source Code Form,\n as described in Section 3.1, and You must inform recipients of the\n Executable Form how they can obtain a copy of such Source Code Form by\n reasonable means in a timely manner, at a charge no more than the cost\n of distribution to the recipient; and\n\n b. You may distribute such Executable Form under the terms of this License,\n or sublicense it under different terms, provided that the license for\n the Executable Form does not attempt to limit or alter the recipients’\n rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\n You may create and distribute a Larger Work under terms of Your choice,\n provided that You also comply with the requirements of this License for the\n Covered Software. If the Larger Work is a combination of Covered Software\n with a work governed by one or more Secondary Licenses, and the Covered\n Software is not Incompatible With Secondary Licenses, this License permits\n You to additionally distribute such Covered Software under the terms of\n such Secondary License(s), so that the recipient of the Larger Work may, at\n their option, further distribute the Covered Software under the terms of\n either this License or such Secondary License(s).\n\n3.4. Notices\n\n You may not remove or alter the substance of any license notices (including\n copyright notices, patent notices, disclaimers of warranty, or limitations\n of liability) contained within the Source Code Form of the Covered\n Software, except that You may alter any license notices to the extent\n required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\n You may choose to offer, and to charge a fee for, warranty, support,\n indemnity or liability obligations to one or more recipients of Covered\n Software. However, You may do so only on Your own behalf, and not on behalf\n of any Contributor. You must make it absolutely clear that any such\n warranty, support, indemnity, or liability obligation is offered by You\n alone, and You hereby agree to indemnify every Contributor for any\n liability incurred by such Contributor as a result of warranty, support,\n indemnity or liability terms You offer. You may include additional\n disclaimers of warranty and limitations of liability specific to any\n jurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n\n If it is impossible for You to comply with any of the terms of this License\n with respect to some or all of the Covered Software due to statute, judicial\n order, or regulation then You must: (a) comply with the terms of this License\n to the maximum extent possible; and (b) describe the limitations and the code\n they affect. Such description must be placed in a text file included with all\n distributions of the Covered Software under this License. Except to the\n extent prohibited by statute or regulation, such description must be\n sufficiently detailed for a recipient of ordinary skill to be able to\n understand it.\n\n5. Termination\n\n5.1. The rights granted under this License will terminate automatically if You\n fail to comply with any of its terms. However, if You become compliant,\n then the rights granted under this License from a particular Contributor\n are reinstated (a) provisionally, unless and until such Contributor\n explicitly and finally terminates Your grants, and (b) on an ongoing basis,\n if such Contributor fails to notify You of the non-compliance by some\n reasonable means prior to 60 days after You have come back into compliance.\n Moreover, Your grants from a particular Contributor are reinstated on an\n ongoing basis if such Contributor notifies You of the non-compliance by\n some reasonable means, this is the first time You have received notice of\n non-compliance with this License from such Contributor, and You become\n compliant prior to 30 days after Your receipt of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\n infringement claim (excluding declaratory judgment actions, counter-claims,\n and cross-claims) alleging that a Contributor Version directly or\n indirectly infringes any patent, then the rights granted to You by any and\n all Contributors for the Covered Software under Section 2.1 of this License\n shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user\n license agreements (excluding distributors and resellers) which have been\n validly granted by You or Your distributors under this License prior to\n termination shall survive termination.\n\n6. Disclaimer of Warranty\n\n Covered Software is provided under this License on an “as is” basis, without\n warranty of any kind, either expressed, implied, or statutory, including,\n without limitation, warranties that the Covered Software is free of defects,\n merchantable, fit for a particular purpose or non-infringing. The entire\n risk as to the quality and performance of the Covered Software is with You.\n Should any Covered Software prove defective in any respect, You (not any\n Contributor) assume the cost of any necessary servicing, repair, or\n correction. This disclaimer of warranty constitutes an essential part of this\n License. No use of any Covered Software is authorized under this License\n except under this disclaimer.\n\n7. Limitation of Liability\n\n Under no circumstances and under no legal theory, whether tort (including\n negligence), contract, or otherwise, shall any Contributor, or anyone who\n distributes Covered Software as permitted above, be liable to You for any\n direct, indirect, special, incidental, or consequential damages of any\n character including, without limitation, damages for lost profits, loss of\n goodwill, work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses, even if such party shall have been\n informed of the possibility of such damages. This limitation of liability\n shall not apply to liability for death or personal injury resulting from such\n party’s negligence to the extent applicable law prohibits such limitation.\n Some jurisdictions do not allow the exclusion or limitation of incidental or\n consequential damages, so this exclusion and limitation may not apply to You.\n\n8. Litigation\n\n Any litigation relating to this License may be brought only in the courts of\n a jurisdiction where the defendant maintains its principal place of business\n and such litigation shall be governed by laws of that jurisdiction, without\n reference to its conflict-of-law provisions. Nothing in this Section shall\n prevent a party’s ability to bring cross-claims or counter-claims.\n\n9. Miscellaneous\n\n This License represents the complete agreement concerning the subject matter\n hereof. If any provision of this License is held to be unenforceable, such\n provision shall be reformed only to the extent necessary to make it\n enforceable. Any law or regulation which provides that the language of a\n contract shall be construed against the drafter shall not be used to construe\n this License against a Contributor.\n\n\n10. Versions of the License\n\n10.1. New Versions\n\n Mozilla Foundation is the license steward. Except as provided in Section\n 10.3, no one other than the license steward has the right to modify or\n publish new versions of this License. Each version will be given a\n distinguishing version number.\n\n10.2. Effect of New Versions\n\n You may distribute the Covered Software under the terms of the version of\n the License under which You originally received the Covered Software, or\n under the terms of any subsequent version published by the license\n steward.\n\n10.3. Modified Versions\n\n If you create software not governed by this License, and you want to\n create a new license for such software, you may create and use a modified\n version of this License if you rename the license and remove any\n references to the name of the license steward (except to note that such\n modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses\n If You choose to distribute Source Code Form that is Incompatible With\n Secondary Licenses under the terms of this version of the License, the\n notice described in Exhibit B of this License must be attached.\n\nExhibit A - Source Code Form License Notice\n\n This Source Code Form is subject to the\n terms of the Mozilla Public License, v.\n 2.0. If a copy of the MPL was not\n distributed with this file, You can\n obtain one at\n http://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular file, then\nYou may include the notice in a location (such as a LICENSE file in a relevant\ndirectory) where a recipient would be likely to look for such a notice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - “Incompatible With Secondary Licenses” Notice\n\n This Source Code Form is “Incompatible\n With Secondary Licenses”, as defined by\n the Mozilla Public License, v. 2.0.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/hashicorp/go-multierror/@v/v1.1.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.13" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2021-03-11 20:17:12 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/hashicorp/go-multierror@v1.1.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/hashicorp/go-multierror" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.13" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/hashicorp/go-retryablehttp", + "version": "v0.7.8", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "ae38927217b275df82c6fba606c22b14a971de24b48eb67b2efcc51859ae29bc" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2015 HashiCorp, Inc.\n\nMozilla Public License, version 2.0\n\n1. Definitions\n\n1.1. \"Contributor\"\n\n means each individual or legal entity that creates, contributes to the\n creation of, or owns Covered Software.\n\n1.2. \"Contributor Version\"\n\n means the combination of the Contributions of others (if any) used by a\n Contributor and that particular Contributor's Contribution.\n\n1.3. \"Contribution\"\n\n means Covered Software of a particular Contributor.\n\n1.4. \"Covered Software\"\n\n means Source Code Form to which the initial Contributor has attached the\n notice in Exhibit A, the Executable Form of such Source Code Form, and\n Modifications of such Source Code Form, in each case including portions\n thereof.\n\n1.5. \"Incompatible With Secondary Licenses\"\n means\n\n a. that the initial Contributor has attached the notice described in\n Exhibit B to the Covered Software; or\n\n b. that the Covered Software was made available under the terms of\n version 1.1 or earlier of the License, but not also under the terms of\n a Secondary License.\n\n1.6. \"Executable Form\"\n\n means any form of the work other than Source Code Form.\n\n1.7. \"Larger Work\"\n\n means a work that combines Covered Software with other material, in a\n separate file or files, that is not Covered Software.\n\n1.8. \"License\"\n\n means this document.\n\n1.9. \"Licensable\"\n\n means having the right to grant, to the maximum extent possible, whether\n at the time of the initial grant or subsequently, any and all of the\n rights conveyed by this License.\n\n1.10. \"Modifications\"\n\n means any of the following:\n\n a. any file in Source Code Form that results from an addition to,\n deletion from, or modification of the contents of Covered Software; or\n\n b. any new file in Source Code Form that contains any Covered Software.\n\n1.11. \"Patent Claims\" of a Contributor\n\n means any patent claim(s), including without limitation, method,\n process, and apparatus claims, in any patent Licensable by such\n Contributor that would be infringed, but for the grant of the License,\n by the making, using, selling, offering for sale, having made, import,\n or transfer of either its Contributions or its Contributor Version.\n\n1.12. \"Secondary License\"\n\n means either the GNU General Public License, Version 2.0, the GNU Lesser\n General Public License, Version 2.1, the GNU Affero General Public\n License, Version 3.0, or any later versions of those licenses.\n\n1.13. \"Source Code Form\"\n\n means the form of the work preferred for making modifications.\n\n1.14. \"You\" (or \"Your\")\n\n means an individual or a legal entity exercising rights under this\n License. For legal entities, \"You\" includes any entity that controls, is\n controlled by, or is under common control with You. For purposes of this\n definition, \"control\" means (a) the power, direct or indirect, to cause\n the direction or management of such entity, whether by contract or\n otherwise, or (b) ownership of more than fifty percent (50%) of the\n outstanding shares or beneficial ownership of such entity.\n\n\n2. License Grants and Conditions\n\n2.1. Grants\n\n Each Contributor hereby grants You a world-wide, royalty-free,\n non-exclusive license:\n\n a. under intellectual property rights (other than patent or trademark)\n Licensable by such Contributor to use, reproduce, make available,\n modify, display, perform, distribute, and otherwise exploit its\n Contributions, either on an unmodified basis, with Modifications, or\n as part of a Larger Work; and\n\n b. under Patent Claims of such Contributor to make, use, sell, offer for\n sale, have made, import, and otherwise transfer either its\n Contributions or its Contributor Version.\n\n2.2. Effective Date\n\n The licenses granted in Section 2.1 with respect to any Contribution\n become effective for each Contribution on the date the Contributor first\n distributes such Contribution.\n\n2.3. Limitations on Grant Scope\n\n The licenses granted in this Section 2 are the only rights granted under\n this License. No additional rights or licenses will be implied from the\n distribution or licensing of Covered Software under this License.\n Notwithstanding Section 2.1(b) above, no patent license is granted by a\n Contributor:\n\n a. for any code that a Contributor has removed from Covered Software; or\n\n b. for infringements caused by: (i) Your and any other third party's\n modifications of Covered Software, or (ii) the combination of its\n Contributions with other software (except as part of its Contributor\n Version); or\n\n c. under Patent Claims infringed by Covered Software in the absence of\n its Contributions.\n\n This License does not grant any rights in the trademarks, service marks,\n or logos of any Contributor (except as may be necessary to comply with\n the notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\n No Contributor makes additional grants as a result of Your choice to\n distribute the Covered Software under a subsequent version of this\n License (see Section 10.2) or under the terms of a Secondary License (if\n permitted under the terms of Section 3.3).\n\n2.5. Representation\n\n Each Contributor represents that the Contributor believes its\n Contributions are its original creation(s) or it has sufficient rights to\n grant the rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\n This License is not intended to limit any rights You have under\n applicable copyright doctrines of fair use, fair dealing, or other\n equivalents.\n\n2.7. Conditions\n\n Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in\n Section 2.1.\n\n\n3. Responsibilities\n\n3.1. Distribution of Source Form\n\n All distribution of Covered Software in Source Code Form, including any\n Modifications that You create or to which You contribute, must be under\n the terms of this License. You must inform recipients that the Source\n Code Form of the Covered Software is governed by the terms of this\n License, and how they can obtain a copy of this License. You may not\n attempt to alter or restrict the recipients' rights in the Source Code\n Form.\n\n3.2. Distribution of Executable Form\n\n If You distribute Covered Software in Executable Form then:\n\n a. such Covered Software must also be made available in Source Code Form,\n as described in Section 3.1, and You must inform recipients of the\n Executable Form how they can obtain a copy of such Source Code Form by\n reasonable means in a timely manner, at a charge no more than the cost\n of distribution to the recipient; and\n\n b. You may distribute such Executable Form under the terms of this\n License, or sublicense it under different terms, provided that the\n license for the Executable Form does not attempt to limit or alter the\n recipients' rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\n You may create and distribute a Larger Work under terms of Your choice,\n provided that You also comply with the requirements of this License for\n the Covered Software. If the Larger Work is a combination of Covered\n Software with a work governed by one or more Secondary Licenses, and the\n Covered Software is not Incompatible With Secondary Licenses, this\n License permits You to additionally distribute such Covered Software\n under the terms of such Secondary License(s), so that the recipient of\n the Larger Work may, at their option, further distribute the Covered\n Software under the terms of either this License or such Secondary\n License(s).\n\n3.4. Notices\n\n You may not remove or alter the substance of any license notices\n (including copyright notices, patent notices, disclaimers of warranty, or\n limitations of liability) contained within the Source Code Form of the\n Covered Software, except that You may alter any license notices to the\n extent required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\n You may choose to offer, and to charge a fee for, warranty, support,\n indemnity or liability obligations to one or more recipients of Covered\n Software. However, You may do so only on Your own behalf, and not on\n behalf of any Contributor. You must make it absolutely clear that any\n such warranty, support, indemnity, or liability obligation is offered by\n You alone, and You hereby agree to indemnify every Contributor for any\n liability incurred by such Contributor as a result of warranty, support,\n indemnity or liability terms You offer. You may include additional\n disclaimers of warranty and limitations of liability specific to any\n jurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n\n If it is impossible for You to comply with any of the terms of this License\n with respect to some or all of the Covered Software due to statute,\n judicial order, or regulation then You must: (a) comply with the terms of\n this License to the maximum extent possible; and (b) describe the\n limitations and the code they affect. Such description must be placed in a\n text file included with all distributions of the Covered Software under\n this License. Except to the extent prohibited by statute or regulation,\n such description must be sufficiently detailed for a recipient of ordinary\n skill to be able to understand it.\n\n5. Termination\n\n5.1. The rights granted under this License will terminate automatically if You\n fail to comply with any of its terms. However, if You become compliant,\n then the rights granted under this License from a particular Contributor\n are reinstated (a) provisionally, unless and until such Contributor\n explicitly and finally terminates Your grants, and (b) on an ongoing\n basis, if such Contributor fails to notify You of the non-compliance by\n some reasonable means prior to 60 days after You have come back into\n compliance. Moreover, Your grants from a particular Contributor are\n reinstated on an ongoing basis if such Contributor notifies You of the\n non-compliance by some reasonable means, this is the first time You have\n received notice of non-compliance with this License from such\n Contributor, and You become compliant prior to 30 days after Your receipt\n of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\n infringement claim (excluding declaratory judgment actions,\n counter-claims, and cross-claims) alleging that a Contributor Version\n directly or indirectly infringes any patent, then the rights granted to\n You by any and all Contributors for the Covered Software under Section\n 2.1 of this License shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user\n license agreements (excluding distributors and resellers) which have been\n validly granted by You or Your distributors under this License prior to\n termination shall survive termination.\n\n6. Disclaimer of Warranty\n\n Covered Software is provided under this License on an \"as is\" basis,\n without warranty of any kind, either expressed, implied, or statutory,\n including, without limitation, warranties that the Covered Software is free\n of defects, merchantable, fit for a particular purpose or non-infringing.\n The entire risk as to the quality and performance of the Covered Software\n is with You. Should any Covered Software prove defective in any respect,\n You (not any Contributor) assume the cost of any necessary servicing,\n repair, or correction. This disclaimer of warranty constitutes an essential\n part of this License. No use of any Covered Software is authorized under\n this License except under this disclaimer.\n\n7. Limitation of Liability\n\n Under no circumstances and under no legal theory, whether tort (including\n negligence), contract, or otherwise, shall any Contributor, or anyone who\n distributes Covered Software as permitted above, be liable to You for any\n direct, indirect, special, incidental, or consequential damages of any\n character including, without limitation, damages for lost profits, loss of\n goodwill, work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses, even if such party shall have been\n informed of the possibility of such damages. This limitation of liability\n shall not apply to liability for death or personal injury resulting from\n such party's negligence to the extent applicable law prohibits such\n limitation. Some jurisdictions do not allow the exclusion or limitation of\n incidental or consequential damages, so this exclusion and limitation may\n not apply to You.\n\n8. Litigation\n\n Any litigation relating to this License may be brought only in the courts\n of a jurisdiction where the defendant maintains its principal place of\n business and such litigation shall be governed by laws of that\n jurisdiction, without reference to its conflict-of-law provisions. Nothing\n in this Section shall prevent a party's ability to bring cross-claims or\n counter-claims.\n\n9. Miscellaneous\n\n This License represents the complete agreement concerning the subject\n matter hereof. If any provision of this License is held to be\n unenforceable, such provision shall be reformed only to the extent\n necessary to make it enforceable. Any law or regulation which provides that\n the language of a contract shall be construed against the drafter shall not\n be used to construe this License against a Contributor.\n\n\n10. Versions of the License\n\n10.1. New Versions\n\n Mozilla Foundation is the license steward. Except as provided in Section\n 10.3, no one other than the license steward has the right to modify or\n publish new versions of this License. Each version will be given a\n distinguishing version number.\n\n10.2. Effect of New Versions\n\n You may distribute the Covered Software under the terms of the version\n of the License under which You originally received the Covered Software,\n or under the terms of any subsequent version published by the license\n steward.\n\n10.3. Modified Versions\n\n If you create software not governed by this License, and you want to\n create a new license for such software, you may create and use a\n modified version of this License if you rename the license and remove\n any references to the name of the license steward (except to note that\n such modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary\n Licenses If You choose to distribute Source Code Form that is\n Incompatible With Secondary Licenses under the terms of this version of\n the License, the notice described in Exhibit B of this License must be\n attached.\n\nExhibit A - Source Code Form License Notice\n\n This Source Code Form is subject to the\n terms of the Mozilla Public License, v.\n 2.0. If a copy of the MPL was not\n distributed with this file, You can\n obtain one at\n http://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular file,\nthen You may include the notice in a location (such as a LICENSE file in a\nrelevant directory) where a recipient would be likely to look for such a\nnotice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - \"Incompatible With Secondary Licenses\" Notice\n\n This Source Code Form is \"Incompatible\n With Secondary Licenses\", as defined by\n the Mozilla Public License, v. 2.0.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", + "type": "library", + "bom-ref": "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/hashicorp/go-retryablehttp/@v/v0.7.8.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-06-18 14:25:10 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/hashicorp/go-retryablehttp@v0.7.8" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/hashicorp/go-retryablehttp" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/hashicorp/go-rootcerts", + "version": "v1.0.2", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "a6a52f9e9ad59cce5b7fb00e8ab75b6f4d4ae1c711df5f557f8a54dcae4419cf" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Mozilla Public License, version 2.0\n\n1. Definitions\n\n1.1. \"Contributor\"\n\n means each individual or legal entity that creates, contributes to the\n creation of, or owns Covered Software.\n\n1.2. \"Contributor Version\"\n\n means the combination of the Contributions of others (if any) used by a\n Contributor and that particular Contributor's Contribution.\n\n1.3. \"Contribution\"\n\n means Covered Software of a particular Contributor.\n\n1.4. \"Covered Software\"\n\n means Source Code Form to which the initial Contributor has attached the\n notice in Exhibit A, the Executable Form of such Source Code Form, and\n Modifications of such Source Code Form, in each case including portions\n thereof.\n\n1.5. \"Incompatible With Secondary Licenses\"\n means\n\n a. that the initial Contributor has attached the notice described in\n Exhibit B to the Covered Software; or\n\n b. that the Covered Software was made available under the terms of\n version 1.1 or earlier of the License, but not also under the terms of\n a Secondary License.\n\n1.6. \"Executable Form\"\n\n means any form of the work other than Source Code Form.\n\n1.7. \"Larger Work\"\n\n means a work that combines Covered Software with other material, in a\n separate file or files, that is not Covered Software.\n\n1.8. \"License\"\n\n means this document.\n\n1.9. \"Licensable\"\n\n means having the right to grant, to the maximum extent possible, whether\n at the time of the initial grant or subsequently, any and all of the\n rights conveyed by this License.\n\n1.10. \"Modifications\"\n\n means any of the following:\n\n a. any file in Source Code Form that results from an addition to,\n deletion from, or modification of the contents of Covered Software; or\n\n b. any new file in Source Code Form that contains any Covered Software.\n\n1.11. \"Patent Claims\" of a Contributor\n\n means any patent claim(s), including without limitation, method,\n process, and apparatus claims, in any patent Licensable by such\n Contributor that would be infringed, but for the grant of the License,\n by the making, using, selling, offering for sale, having made, import,\n or transfer of either its Contributions or its Contributor Version.\n\n1.12. \"Secondary License\"\n\n means either the GNU General Public License, Version 2.0, the GNU Lesser\n General Public License, Version 2.1, the GNU Affero General Public\n License, Version 3.0, or any later versions of those licenses.\n\n1.13. \"Source Code Form\"\n\n means the form of the work preferred for making modifications.\n\n1.14. \"You\" (or \"Your\")\n\n means an individual or a legal entity exercising rights under this\n License. For legal entities, \"You\" includes any entity that controls, is\n controlled by, or is under common control with You. For purposes of this\n definition, \"control\" means (a) the power, direct or indirect, to cause\n the direction or management of such entity, whether by contract or\n otherwise, or (b) ownership of more than fifty percent (50%) of the\n outstanding shares or beneficial ownership of such entity.\n\n\n2. License Grants and Conditions\n\n2.1. Grants\n\n Each Contributor hereby grants You a world-wide, royalty-free,\n non-exclusive license:\n\n a. under intellectual property rights (other than patent or trademark)\n Licensable by such Contributor to use, reproduce, make available,\n modify, display, perform, distribute, and otherwise exploit its\n Contributions, either on an unmodified basis, with Modifications, or\n as part of a Larger Work; and\n\n b. under Patent Claims of such Contributor to make, use, sell, offer for\n sale, have made, import, and otherwise transfer either its\n Contributions or its Contributor Version.\n\n2.2. Effective Date\n\n The licenses granted in Section 2.1 with respect to any Contribution\n become effective for each Contribution on the date the Contributor first\n distributes such Contribution.\n\n2.3. Limitations on Grant Scope\n\n The licenses granted in this Section 2 are the only rights granted under\n this License. No additional rights or licenses will be implied from the\n distribution or licensing of Covered Software under this License.\n Notwithstanding Section 2.1(b) above, no patent license is granted by a\n Contributor:\n\n a. for any code that a Contributor has removed from Covered Software; or\n\n b. for infringements caused by: (i) Your and any other third party's\n modifications of Covered Software, or (ii) the combination of its\n Contributions with other software (except as part of its Contributor\n Version); or\n\n c. under Patent Claims infringed by Covered Software in the absence of\n its Contributions.\n\n This License does not grant any rights in the trademarks, service marks,\n or logos of any Contributor (except as may be necessary to comply with\n the notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\n No Contributor makes additional grants as a result of Your choice to\n distribute the Covered Software under a subsequent version of this\n License (see Section 10.2) or under the terms of a Secondary License (if\n permitted under the terms of Section 3.3).\n\n2.5. Representation\n\n Each Contributor represents that the Contributor believes its\n Contributions are its original creation(s) or it has sufficient rights to\n grant the rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\n This License is not intended to limit any rights You have under\n applicable copyright doctrines of fair use, fair dealing, or other\n equivalents.\n\n2.7. Conditions\n\n Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in\n Section 2.1.\n\n\n3. Responsibilities\n\n3.1. Distribution of Source Form\n\n All distribution of Covered Software in Source Code Form, including any\n Modifications that You create or to which You contribute, must be under\n the terms of this License. You must inform recipients that the Source\n Code Form of the Covered Software is governed by the terms of this\n License, and how they can obtain a copy of this License. You may not\n attempt to alter or restrict the recipients' rights in the Source Code\n Form.\n\n3.2. Distribution of Executable Form\n\n If You distribute Covered Software in Executable Form then:\n\n a. such Covered Software must also be made available in Source Code Form,\n as described in Section 3.1, and You must inform recipients of the\n Executable Form how they can obtain a copy of such Source Code Form by\n reasonable means in a timely manner, at a charge no more than the cost\n of distribution to the recipient; and\n\n b. You may distribute such Executable Form under the terms of this\n License, or sublicense it under different terms, provided that the\n license for the Executable Form does not attempt to limit or alter the\n recipients' rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\n You may create and distribute a Larger Work under terms of Your choice,\n provided that You also comply with the requirements of this License for\n the Covered Software. If the Larger Work is a combination of Covered\n Software with a work governed by one or more Secondary Licenses, and the\n Covered Software is not Incompatible With Secondary Licenses, this\n License permits You to additionally distribute such Covered Software\n under the terms of such Secondary License(s), so that the recipient of\n the Larger Work may, at their option, further distribute the Covered\n Software under the terms of either this License or such Secondary\n License(s).\n\n3.4. Notices\n\n You may not remove or alter the substance of any license notices\n (including copyright notices, patent notices, disclaimers of warranty, or\n limitations of liability) contained within the Source Code Form of the\n Covered Software, except that You may alter any license notices to the\n extent required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\n You may choose to offer, and to charge a fee for, warranty, support,\n indemnity or liability obligations to one or more recipients of Covered\n Software. However, You may do so only on Your own behalf, and not on\n behalf of any Contributor. You must make it absolutely clear that any\n such warranty, support, indemnity, or liability obligation is offered by\n You alone, and You hereby agree to indemnify every Contributor for any\n liability incurred by such Contributor as a result of warranty, support,\n indemnity or liability terms You offer. You may include additional\n disclaimers of warranty and limitations of liability specific to any\n jurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n\n If it is impossible for You to comply with any of the terms of this License\n with respect to some or all of the Covered Software due to statute,\n judicial order, or regulation then You must: (a) comply with the terms of\n this License to the maximum extent possible; and (b) describe the\n limitations and the code they affect. Such description must be placed in a\n text file included with all distributions of the Covered Software under\n this License. Except to the extent prohibited by statute or regulation,\n such description must be sufficiently detailed for a recipient of ordinary\n skill to be able to understand it.\n\n5. Termination\n\n5.1. The rights granted under this License will terminate automatically if You\n fail to comply with any of its terms. However, if You become compliant,\n then the rights granted under this License from a particular Contributor\n are reinstated (a) provisionally, unless and until such Contributor\n explicitly and finally terminates Your grants, and (b) on an ongoing\n basis, if such Contributor fails to notify You of the non-compliance by\n some reasonable means prior to 60 days after You have come back into\n compliance. Moreover, Your grants from a particular Contributor are\n reinstated on an ongoing basis if such Contributor notifies You of the\n non-compliance by some reasonable means, this is the first time You have\n received notice of non-compliance with this License from such\n Contributor, and You become compliant prior to 30 days after Your receipt\n of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\n infringement claim (excluding declaratory judgment actions,\n counter-claims, and cross-claims) alleging that a Contributor Version\n directly or indirectly infringes any patent, then the rights granted to\n You by any and all Contributors for the Covered Software under Section\n 2.1 of this License shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user\n license agreements (excluding distributors and resellers) which have been\n validly granted by You or Your distributors under this License prior to\n termination shall survive termination.\n\n6. Disclaimer of Warranty\n\n Covered Software is provided under this License on an \"as is\" basis,\n without warranty of any kind, either expressed, implied, or statutory,\n including, without limitation, warranties that the Covered Software is free\n of defects, merchantable, fit for a particular purpose or non-infringing.\n The entire risk as to the quality and performance of the Covered Software\n is with You. Should any Covered Software prove defective in any respect,\n You (not any Contributor) assume the cost of any necessary servicing,\n repair, or correction. This disclaimer of warranty constitutes an essential\n part of this License. No use of any Covered Software is authorized under\n this License except under this disclaimer.\n\n7. Limitation of Liability\n\n Under no circumstances and under no legal theory, whether tort (including\n negligence), contract, or otherwise, shall any Contributor, or anyone who\n distributes Covered Software as permitted above, be liable to You for any\n direct, indirect, special, incidental, or consequential damages of any\n character including, without limitation, damages for lost profits, loss of\n goodwill, work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses, even if such party shall have been\n informed of the possibility of such damages. This limitation of liability\n shall not apply to liability for death or personal injury resulting from\n such party's negligence to the extent applicable law prohibits such\n limitation. Some jurisdictions do not allow the exclusion or limitation of\n incidental or consequential damages, so this exclusion and limitation may\n not apply to You.\n\n8. Litigation\n\n Any litigation relating to this License may be brought only in the courts\n of a jurisdiction where the defendant maintains its principal place of\n business and such litigation shall be governed by laws of that\n jurisdiction, without reference to its conflict-of-law provisions. Nothing\n in this Section shall prevent a party's ability to bring cross-claims or\n counter-claims.\n\n9. Miscellaneous\n\n This License represents the complete agreement concerning the subject\n matter hereof. If any provision of this License is held to be\n unenforceable, such provision shall be reformed only to the extent\n necessary to make it enforceable. Any law or regulation which provides that\n the language of a contract shall be construed against the drafter shall not\n be used to construe this License against a Contributor.\n\n\n10. Versions of the License\n\n10.1. New Versions\n\n Mozilla Foundation is the license steward. Except as provided in Section\n 10.3, no one other than the license steward has the right to modify or\n publish new versions of this License. Each version will be given a\n distinguishing version number.\n\n10.2. Effect of New Versions\n\n You may distribute the Covered Software under the terms of the version\n of the License under which You originally received the Covered Software,\n or under the terms of any subsequent version published by the license\n steward.\n\n10.3. Modified Versions\n\n If you create software not governed by this License, and you want to\n create a new license for such software, you may create and use a\n modified version of this License if you rename the license and remove\n any references to the name of the license steward (except to note that\n such modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary\n Licenses If You choose to distribute Source Code Form that is\n Incompatible With Secondary Licenses under the terms of this version of\n the License, the notice described in Exhibit B of this License must be\n attached.\n\nExhibit A - Source Code Form License Notice\n\n This Source Code Form is subject to the\n terms of the Mozilla Public License, v.\n 2.0. If a copy of the MPL was not\n distributed with this file, You can\n obtain one at\n http://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular file,\nthen You may include the notice in a location (such as a LICENSE file in a\nrelevant directory) where a recipient would be likely to look for such a\nnotice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - \"Incompatible With Secondary Licenses\" Notice\n\n This Source Code Form is \"Incompatible\n With Secondary Licenses\", as defined by\n the Mozilla Public License, v. 2.0.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/hashicorp/go-rootcerts@v1.0.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/hashicorp/go-rootcerts@v1.0.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/hashicorp/go-rootcerts/@v/v1.0.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.12" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2019-12-10 09:55:28 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/hashicorp/go-rootcerts@v1.0.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/hashicorp/go-rootcerts" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.12" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/hashicorp/go-secure-stdlib/parseutil", + "version": "v0.2.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "2e5d35de685d9ac543ba821755f06dbe0189b170d8913c35928a0d728097b84d" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2020 HashiCorp, Inc.\n\nMozilla Public License, version 2.0\n\n1. Definitions\n\n1.1. \"Contributor\"\n\n means each individual or legal entity that creates, contributes to the\n creation of, or owns Covered Software.\n\n1.2. \"Contributor Version\"\n\n means the combination of the Contributions of others (if any) used by a\n Contributor and that particular Contributor's Contribution.\n\n1.3. \"Contribution\"\n\n means Covered Software of a particular Contributor.\n\n1.4. \"Covered Software\"\n\n means Source Code Form to which the initial Contributor has attached the\n notice in Exhibit A, the Executable Form of such Source Code Form, and\n Modifications of such Source Code Form, in each case including portions\n thereof.\n\n1.5. \"Incompatible With Secondary Licenses\"\n means\n\n a. that the initial Contributor has attached the notice described in\n Exhibit B to the Covered Software; or\n\n b. that the Covered Software was made available under the terms of\n version 1.1 or earlier of the License, but not also under the terms of\n a Secondary License.\n\n1.6. \"Executable Form\"\n\n means any form of the work other than Source Code Form.\n\n1.7. \"Larger Work\"\n\n means a work that combines Covered Software with other material, in a\n separate file or files, that is not Covered Software.\n\n1.8. \"License\"\n\n means this document.\n\n1.9. \"Licensable\"\n\n means having the right to grant, to the maximum extent possible, whether\n at the time of the initial grant or subsequently, any and all of the\n rights conveyed by this License.\n\n1.10. \"Modifications\"\n\n means any of the following:\n\n a. any file in Source Code Form that results from an addition to,\n deletion from, or modification of the contents of Covered Software; or\n\n b. any new file in Source Code Form that contains any Covered Software.\n\n1.11. \"Patent Claims\" of a Contributor\n\n means any patent claim(s), including without limitation, method,\n process, and apparatus claims, in any patent Licensable by such\n Contributor that would be infringed, but for the grant of the License,\n by the making, using, selling, offering for sale, having made, import,\n or transfer of either its Contributions or its Contributor Version.\n\n1.12. \"Secondary License\"\n\n means either the GNU General Public License, Version 2.0, the GNU Lesser\n General Public License, Version 2.1, the GNU Affero General Public\n License, Version 3.0, or any later versions of those licenses.\n\n1.13. \"Source Code Form\"\n\n means the form of the work preferred for making modifications.\n\n1.14. \"You\" (or \"Your\")\n\n means an individual or a legal entity exercising rights under this\n License. For legal entities, \"You\" includes any entity that controls, is\n controlled by, or is under common control with You. For purposes of this\n definition, \"control\" means (a) the power, direct or indirect, to cause\n the direction or management of such entity, whether by contract or\n otherwise, or (b) ownership of more than fifty percent (50%) of the\n outstanding shares or beneficial ownership of such entity.\n\n\n2. License Grants and Conditions\n\n2.1. Grants\n\n Each Contributor hereby grants You a world-wide, royalty-free,\n non-exclusive license:\n\n a. under intellectual property rights (other than patent or trademark)\n Licensable by such Contributor to use, reproduce, make available,\n modify, display, perform, distribute, and otherwise exploit its\n Contributions, either on an unmodified basis, with Modifications, or\n as part of a Larger Work; and\n\n b. under Patent Claims of such Contributor to make, use, sell, offer for\n sale, have made, import, and otherwise transfer either its\n Contributions or its Contributor Version.\n\n2.2. Effective Date\n\n The licenses granted in Section 2.1 with respect to any Contribution\n become effective for each Contribution on the date the Contributor first\n distributes such Contribution.\n\n2.3. Limitations on Grant Scope\n\n The licenses granted in this Section 2 are the only rights granted under\n this License. No additional rights or licenses will be implied from the\n distribution or licensing of Covered Software under this License.\n Notwithstanding Section 2.1(b) above, no patent license is granted by a\n Contributor:\n\n a. for any code that a Contributor has removed from Covered Software; or\n\n b. for infringements caused by: (i) Your and any other third party's\n modifications of Covered Software, or (ii) the combination of its\n Contributions with other software (except as part of its Contributor\n Version); or\n\n c. under Patent Claims infringed by Covered Software in the absence of\n its Contributions.\n\n This License does not grant any rights in the trademarks, service marks,\n or logos of any Contributor (except as may be necessary to comply with\n the notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\n No Contributor makes additional grants as a result of Your choice to\n distribute the Covered Software under a subsequent version of this\n License (see Section 10.2) or under the terms of a Secondary License (if\n permitted under the terms of Section 3.3).\n\n2.5. Representation\n\n Each Contributor represents that the Contributor believes its\n Contributions are its original creation(s) or it has sufficient rights to\n grant the rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\n This License is not intended to limit any rights You have under\n applicable copyright doctrines of fair use, fair dealing, or other\n equivalents.\n\n2.7. Conditions\n\n Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in\n Section 2.1.\n\n\n3. Responsibilities\n\n3.1. Distribution of Source Form\n\n All distribution of Covered Software in Source Code Form, including any\n Modifications that You create or to which You contribute, must be under\n the terms of this License. You must inform recipients that the Source\n Code Form of the Covered Software is governed by the terms of this\n License, and how they can obtain a copy of this License. You may not\n attempt to alter or restrict the recipients' rights in the Source Code\n Form.\n\n3.2. Distribution of Executable Form\n\n If You distribute Covered Software in Executable Form then:\n\n a. such Covered Software must also be made available in Source Code Form,\n as described in Section 3.1, and You must inform recipients of the\n Executable Form how they can obtain a copy of such Source Code Form by\n reasonable means in a timely manner, at a charge no more than the cost\n of distribution to the recipient; and\n\n b. You may distribute such Executable Form under the terms of this\n License, or sublicense it under different terms, provided that the\n license for the Executable Form does not attempt to limit or alter the\n recipients' rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\n You may create and distribute a Larger Work under terms of Your choice,\n provided that You also comply with the requirements of this License for\n the Covered Software. If the Larger Work is a combination of Covered\n Software with a work governed by one or more Secondary Licenses, and the\n Covered Software is not Incompatible With Secondary Licenses, this\n License permits You to additionally distribute such Covered Software\n under the terms of such Secondary License(s), so that the recipient of\n the Larger Work may, at their option, further distribute the Covered\n Software under the terms of either this License or such Secondary\n License(s).\n\n3.4. Notices\n\n You may not remove or alter the substance of any license notices\n (including copyright notices, patent notices, disclaimers of warranty, or\n limitations of liability) contained within the Source Code Form of the\n Covered Software, except that You may alter any license notices to the\n extent required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\n You may choose to offer, and to charge a fee for, warranty, support,\n indemnity or liability obligations to one or more recipients of Covered\n Software. However, You may do so only on Your own behalf, and not on\n behalf of any Contributor. You must make it absolutely clear that any\n such warranty, support, indemnity, or liability obligation is offered by\n You alone, and You hereby agree to indemnify every Contributor for any\n liability incurred by such Contributor as a result of warranty, support,\n indemnity or liability terms You offer. You may include additional\n disclaimers of warranty and limitations of liability specific to any\n jurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n\n If it is impossible for You to comply with any of the terms of this License\n with respect to some or all of the Covered Software due to statute,\n judicial order, or regulation then You must: (a) comply with the terms of\n this License to the maximum extent possible; and (b) describe the\n limitations and the code they affect. Such description must be placed in a\n text file included with all distributions of the Covered Software under\n this License. Except to the extent prohibited by statute or regulation,\n such description must be sufficiently detailed for a recipient of ordinary\n skill to be able to understand it.\n\n5. Termination\n\n5.1. The rights granted under this License will terminate automatically if You\n fail to comply with any of its terms. However, if You become compliant,\n then the rights granted under this License from a particular Contributor\n are reinstated (a) provisionally, unless and until such Contributor\n explicitly and finally terminates Your grants, and (b) on an ongoing\n basis, if such Contributor fails to notify You of the non-compliance by\n some reasonable means prior to 60 days after You have come back into\n compliance. Moreover, Your grants from a particular Contributor are\n reinstated on an ongoing basis if such Contributor notifies You of the\n non-compliance by some reasonable means, this is the first time You have\n received notice of non-compliance with this License from such\n Contributor, and You become compliant prior to 30 days after Your receipt\n of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\n infringement claim (excluding declaratory judgment actions,\n counter-claims, and cross-claims) alleging that a Contributor Version\n directly or indirectly infringes any patent, then the rights granted to\n You by any and all Contributors for the Covered Software under Section\n 2.1 of this License shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user\n license agreements (excluding distributors and resellers) which have been\n validly granted by You or Your distributors under this License prior to\n termination shall survive termination.\n\n6. Disclaimer of Warranty\n\n Covered Software is provided under this License on an \"as is\" basis,\n without warranty of any kind, either expressed, implied, or statutory,\n including, without limitation, warranties that the Covered Software is free\n of defects, merchantable, fit for a particular purpose or non-infringing.\n The entire risk as to the quality and performance of the Covered Software\n is with You. Should any Covered Software prove defective in any respect,\n You (not any Contributor) assume the cost of any necessary servicing,\n repair, or correction. This disclaimer of warranty constitutes an essential\n part of this License. No use of any Covered Software is authorized under\n this License except under this disclaimer.\n\n7. Limitation of Liability\n\n Under no circumstances and under no legal theory, whether tort (including\n negligence), contract, or otherwise, shall any Contributor, or anyone who\n distributes Covered Software as permitted above, be liable to You for any\n direct, indirect, special, incidental, or consequential damages of any\n character including, without limitation, damages for lost profits, loss of\n goodwill, work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses, even if such party shall have been\n informed of the possibility of such damages. This limitation of liability\n shall not apply to liability for death or personal injury resulting from\n such party's negligence to the extent applicable law prohibits such\n limitation. Some jurisdictions do not allow the exclusion or limitation of\n incidental or consequential damages, so this exclusion and limitation may\n not apply to You.\n\n8. Litigation\n\n Any litigation relating to this License may be brought only in the courts\n of a jurisdiction where the defendant maintains its principal place of\n business and such litigation shall be governed by laws of that\n jurisdiction, without reference to its conflict-of-law provisions. Nothing\n in this Section shall prevent a party's ability to bring cross-claims or\n counter-claims.\n\n9. Miscellaneous\n\n This License represents the complete agreement concerning the subject\n matter hereof. If any provision of this License is held to be\n unenforceable, such provision shall be reformed only to the extent\n necessary to make it enforceable. Any law or regulation which provides that\n the language of a contract shall be construed against the drafter shall not\n be used to construe this License against a Contributor.\n\n\n10. Versions of the License\n\n10.1. New Versions\n\n Mozilla Foundation is the license steward. Except as provided in Section\n 10.3, no one other than the license steward has the right to modify or\n publish new versions of this License. Each version will be given a\n distinguishing version number.\n\n10.2. Effect of New Versions\n\n You may distribute the Covered Software under the terms of the version\n of the License under which You originally received the Covered Software,\n or under the terms of any subsequent version published by the license\n steward.\n\n10.3. Modified Versions\n\n If you create software not governed by this License, and you want to\n create a new license for such software, you may create and use a\n modified version of this License if you rename the license and remove\n any references to the name of the license steward (except to note that\n such modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary\n Licenses If You choose to distribute Source Code Form that is\n Incompatible With Secondary Licenses under the terms of this version of\n the License, the notice described in Exhibit B of this License must be\n attached.\n\nExhibit A - Source Code Form License Notice\n\n This Source Code Form is subject to the\n terms of the Mozilla Public License, v.\n 2.0. If a copy of the MPL was not\n distributed with this file, You can\n obtain one at\n http://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular file,\nthen You may include the notice in a location (such as a LICENSE file in a\nrelevant directory) where a recipient would be likely to look for such a\nnotice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - \"Incompatible With Secondary Licenses\" Notice\n\n This Source Code Form is \"Incompatible\n With Secondary Licenses\", as defined by\n the Mozilla Public License, v. 2.0.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/hashicorp/go-secure-stdlib/parseutil/@v/v0.2.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.20" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-03-06 22:34:24 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/hashicorp/go-secure-stdlib/parseutil" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.20" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/hashicorp/go-secure-stdlib/strutil", + "version": "v0.1.2", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "1a8bb647dfa297ddc1a97db92c02822ee33ecbd5364f8865c2f4f5ca9adc9dae" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Mozilla Public License, version 2.0\n\n1. Definitions\n\n1.1. \"Contributor\"\n\n means each individual or legal entity that creates, contributes to the\n creation of, or owns Covered Software.\n\n1.2. \"Contributor Version\"\n\n means the combination of the Contributions of others (if any) used by a\n Contributor and that particular Contributor's Contribution.\n\n1.3. \"Contribution\"\n\n means Covered Software of a particular Contributor.\n\n1.4. \"Covered Software\"\n\n means Source Code Form to which the initial Contributor has attached the\n notice in Exhibit A, the Executable Form of such Source Code Form, and\n Modifications of such Source Code Form, in each case including portions\n thereof.\n\n1.5. \"Incompatible With Secondary Licenses\"\n means\n\n a. that the initial Contributor has attached the notice described in\n Exhibit B to the Covered Software; or\n\n b. that the Covered Software was made available under the terms of\n version 1.1 or earlier of the License, but not also under the terms of\n a Secondary License.\n\n1.6. \"Executable Form\"\n\n means any form of the work other than Source Code Form.\n\n1.7. \"Larger Work\"\n\n means a work that combines Covered Software with other material, in a\n separate file or files, that is not Covered Software.\n\n1.8. \"License\"\n\n means this document.\n\n1.9. \"Licensable\"\n\n means having the right to grant, to the maximum extent possible, whether\n at the time of the initial grant or subsequently, any and all of the\n rights conveyed by this License.\n\n1.10. \"Modifications\"\n\n means any of the following:\n\n a. any file in Source Code Form that results from an addition to,\n deletion from, or modification of the contents of Covered Software; or\n\n b. any new file in Source Code Form that contains any Covered Software.\n\n1.11. \"Patent Claims\" of a Contributor\n\n means any patent claim(s), including without limitation, method,\n process, and apparatus claims, in any patent Licensable by such\n Contributor that would be infringed, but for the grant of the License,\n by the making, using, selling, offering for sale, having made, import,\n or transfer of either its Contributions or its Contributor Version.\n\n1.12. \"Secondary License\"\n\n means either the GNU General Public License, Version 2.0, the GNU Lesser\n General Public License, Version 2.1, the GNU Affero General Public\n License, Version 3.0, or any later versions of those licenses.\n\n1.13. \"Source Code Form\"\n\n means the form of the work preferred for making modifications.\n\n1.14. \"You\" (or \"Your\")\n\n means an individual or a legal entity exercising rights under this\n License. For legal entities, \"You\" includes any entity that controls, is\n controlled by, or is under common control with You. For purposes of this\n definition, \"control\" means (a) the power, direct or indirect, to cause\n the direction or management of such entity, whether by contract or\n otherwise, or (b) ownership of more than fifty percent (50%) of the\n outstanding shares or beneficial ownership of such entity.\n\n\n2. License Grants and Conditions\n\n2.1. Grants\n\n Each Contributor hereby grants You a world-wide, royalty-free,\n non-exclusive license:\n\n a. under intellectual property rights (other than patent or trademark)\n Licensable by such Contributor to use, reproduce, make available,\n modify, display, perform, distribute, and otherwise exploit its\n Contributions, either on an unmodified basis, with Modifications, or\n as part of a Larger Work; and\n\n b. under Patent Claims of such Contributor to make, use, sell, offer for\n sale, have made, import, and otherwise transfer either its\n Contributions or its Contributor Version.\n\n2.2. Effective Date\n\n The licenses granted in Section 2.1 with respect to any Contribution\n become effective for each Contribution on the date the Contributor first\n distributes such Contribution.\n\n2.3. Limitations on Grant Scope\n\n The licenses granted in this Section 2 are the only rights granted under\n this License. No additional rights or licenses will be implied from the\n distribution or licensing of Covered Software under this License.\n Notwithstanding Section 2.1(b) above, no patent license is granted by a\n Contributor:\n\n a. for any code that a Contributor has removed from Covered Software; or\n\n b. for infringements caused by: (i) Your and any other third party's\n modifications of Covered Software, or (ii) the combination of its\n Contributions with other software (except as part of its Contributor\n Version); or\n\n c. under Patent Claims infringed by Covered Software in the absence of\n its Contributions.\n\n This License does not grant any rights in the trademarks, service marks,\n or logos of any Contributor (except as may be necessary to comply with\n the notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\n No Contributor makes additional grants as a result of Your choice to\n distribute the Covered Software under a subsequent version of this\n License (see Section 10.2) or under the terms of a Secondary License (if\n permitted under the terms of Section 3.3).\n\n2.5. Representation\n\n Each Contributor represents that the Contributor believes its\n Contributions are its original creation(s) or it has sufficient rights to\n grant the rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\n This License is not intended to limit any rights You have under\n applicable copyright doctrines of fair use, fair dealing, or other\n equivalents.\n\n2.7. Conditions\n\n Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in\n Section 2.1.\n\n\n3. Responsibilities\n\n3.1. Distribution of Source Form\n\n All distribution of Covered Software in Source Code Form, including any\n Modifications that You create or to which You contribute, must be under\n the terms of this License. You must inform recipients that the Source\n Code Form of the Covered Software is governed by the terms of this\n License, and how they can obtain a copy of this License. You may not\n attempt to alter or restrict the recipients' rights in the Source Code\n Form.\n\n3.2. Distribution of Executable Form\n\n If You distribute Covered Software in Executable Form then:\n\n a. such Covered Software must also be made available in Source Code Form,\n as described in Section 3.1, and You must inform recipients of the\n Executable Form how they can obtain a copy of such Source Code Form by\n reasonable means in a timely manner, at a charge no more than the cost\n of distribution to the recipient; and\n\n b. You may distribute such Executable Form under the terms of this\n License, or sublicense it under different terms, provided that the\n license for the Executable Form does not attempt to limit or alter the\n recipients' rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\n You may create and distribute a Larger Work under terms of Your choice,\n provided that You also comply with the requirements of this License for\n the Covered Software. If the Larger Work is a combination of Covered\n Software with a work governed by one or more Secondary Licenses, and the\n Covered Software is not Incompatible With Secondary Licenses, this\n License permits You to additionally distribute such Covered Software\n under the terms of such Secondary License(s), so that the recipient of\n the Larger Work may, at their option, further distribute the Covered\n Software under the terms of either this License or such Secondary\n License(s).\n\n3.4. Notices\n\n You may not remove or alter the substance of any license notices\n (including copyright notices, patent notices, disclaimers of warranty, or\n limitations of liability) contained within the Source Code Form of the\n Covered Software, except that You may alter any license notices to the\n extent required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\n You may choose to offer, and to charge a fee for, warranty, support,\n indemnity or liability obligations to one or more recipients of Covered\n Software. However, You may do so only on Your own behalf, and not on\n behalf of any Contributor. You must make it absolutely clear that any\n such warranty, support, indemnity, or liability obligation is offered by\n You alone, and You hereby agree to indemnify every Contributor for any\n liability incurred by such Contributor as a result of warranty, support,\n indemnity or liability terms You offer. You may include additional\n disclaimers of warranty and limitations of liability specific to any\n jurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n\n If it is impossible for You to comply with any of the terms of this License\n with respect to some or all of the Covered Software due to statute,\n judicial order, or regulation then You must: (a) comply with the terms of\n this License to the maximum extent possible; and (b) describe the\n limitations and the code they affect. Such description must be placed in a\n text file included with all distributions of the Covered Software under\n this License. Except to the extent prohibited by statute or regulation,\n such description must be sufficiently detailed for a recipient of ordinary\n skill to be able to understand it.\n\n5. Termination\n\n5.1. The rights granted under this License will terminate automatically if You\n fail to comply with any of its terms. However, if You become compliant,\n then the rights granted under this License from a particular Contributor\n are reinstated (a) provisionally, unless and until such Contributor\n explicitly and finally terminates Your grants, and (b) on an ongoing\n basis, if such Contributor fails to notify You of the non-compliance by\n some reasonable means prior to 60 days after You have come back into\n compliance. Moreover, Your grants from a particular Contributor are\n reinstated on an ongoing basis if such Contributor notifies You of the\n non-compliance by some reasonable means, this is the first time You have\n received notice of non-compliance with this License from such\n Contributor, and You become compliant prior to 30 days after Your receipt\n of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\n infringement claim (excluding declaratory judgment actions,\n counter-claims, and cross-claims) alleging that a Contributor Version\n directly or indirectly infringes any patent, then the rights granted to\n You by any and all Contributors for the Covered Software under Section\n 2.1 of this License shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user\n license agreements (excluding distributors and resellers) which have been\n validly granted by You or Your distributors under this License prior to\n termination shall survive termination.\n\n6. Disclaimer of Warranty\n\n Covered Software is provided under this License on an \"as is\" basis,\n without warranty of any kind, either expressed, implied, or statutory,\n including, without limitation, warranties that the Covered Software is free\n of defects, merchantable, fit for a particular purpose or non-infringing.\n The entire risk as to the quality and performance of the Covered Software\n is with You. Should any Covered Software prove defective in any respect,\n You (not any Contributor) assume the cost of any necessary servicing,\n repair, or correction. This disclaimer of warranty constitutes an essential\n part of this License. No use of any Covered Software is authorized under\n this License except under this disclaimer.\n\n7. Limitation of Liability\n\n Under no circumstances and under no legal theory, whether tort (including\n negligence), contract, or otherwise, shall any Contributor, or anyone who\n distributes Covered Software as permitted above, be liable to You for any\n direct, indirect, special, incidental, or consequential damages of any\n character including, without limitation, damages for lost profits, loss of\n goodwill, work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses, even if such party shall have been\n informed of the possibility of such damages. This limitation of liability\n shall not apply to liability for death or personal injury resulting from\n such party's negligence to the extent applicable law prohibits such\n limitation. Some jurisdictions do not allow the exclusion or limitation of\n incidental or consequential damages, so this exclusion and limitation may\n not apply to You.\n\n8. Litigation\n\n Any litigation relating to this License may be brought only in the courts\n of a jurisdiction where the defendant maintains its principal place of\n business and such litigation shall be governed by laws of that\n jurisdiction, without reference to its conflict-of-law provisions. Nothing\n in this Section shall prevent a party's ability to bring cross-claims or\n counter-claims.\n\n9. Miscellaneous\n\n This License represents the complete agreement concerning the subject\n matter hereof. If any provision of this License is held to be\n unenforceable, such provision shall be reformed only to the extent\n necessary to make it enforceable. Any law or regulation which provides that\n the language of a contract shall be construed against the drafter shall not\n be used to construe this License against a Contributor.\n\n\n10. Versions of the License\n\n10.1. New Versions\n\n Mozilla Foundation is the license steward. Except as provided in Section\n 10.3, no one other than the license steward has the right to modify or\n publish new versions of this License. Each version will be given a\n distinguishing version number.\n\n10.2. Effect of New Versions\n\n You may distribute the Covered Software under the terms of the version\n of the License under which You originally received the Covered Software,\n or under the terms of any subsequent version published by the license\n steward.\n\n10.3. Modified Versions\n\n If you create software not governed by this License, and you want to\n create a new license for such software, you may create and use a\n modified version of this License if you rename the license and remove\n any references to the name of the license steward (except to note that\n such modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary\n Licenses If You choose to distribute Source Code Form that is\n Incompatible With Secondary Licenses under the terms of this version of\n the License, the notice described in Exhibit B of this License must be\n attached.\n\nExhibit A - Source Code Form License Notice\n\n This Source Code Form is subject to the\n terms of the Mozilla Public License, v.\n 2.0. If a copy of the MPL was not\n distributed with this file, You can\n obtain one at\n http://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular file,\nthen You may include the notice in a location (such as a LICENSE file in a\nrelevant directory) where a recipient would be likely to look for such a\nnotice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - \"Incompatible With Secondary Licenses\" Notice\n\n This Source Code Form is \"Incompatible\n With Secondary Licenses\", as defined by\n the Mozilla Public License, v. 2.0.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/hashicorp/go-secure-stdlib/strutil/@v/v0.1.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.16" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2021-11-22 19:44:14 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/hashicorp/go-secure-stdlib/strutil" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.16" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/hashicorp/go-sockaddr", + "version": "v1.0.7", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "15941b1186b5a71910ed62e9c9727a71b8e94fcab462041a2bf25a917a86c96c" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2016 HashiCorp, Inc.\n\nMozilla Public License Version 2.0\n==================================\n\n1. Definitions\n--------------\n\n1.1. \"Contributor\"\n means each individual or legal entity that creates, contributes to\n the creation of, or owns Covered Software.\n\n1.2. \"Contributor Version\"\n means the combination of the Contributions of others (if any) used\n by a Contributor and that particular Contributor's Contribution.\n\n1.3. \"Contribution\"\n means Covered Software of a particular Contributor.\n\n1.4. \"Covered Software\"\n means Source Code Form to which the initial Contributor has attached\n the notice in Exhibit A, the Executable Form of such Source Code\n Form, and Modifications of such Source Code Form, in each case\n including portions thereof.\n\n1.5. \"Incompatible With Secondary Licenses\"\n means\n\n (a) that the initial Contributor has attached the notice described\n in Exhibit B to the Covered Software; or\n\n (b) that the Covered Software was made available under the terms of\n version 1.1 or earlier of the License, but not also under the\n terms of a Secondary License.\n\n1.6. \"Executable Form\"\n means any form of the work other than Source Code Form.\n\n1.7. \"Larger Work\"\n means a work that combines Covered Software with other material, in\n a separate file or files, that is not Covered Software.\n\n1.8. \"License\"\n means this document.\n\n1.9. \"Licensable\"\n means having the right to grant, to the maximum extent possible,\n whether at the time of the initial grant or subsequently, any and\n all of the rights conveyed by this License.\n\n1.10. \"Modifications\"\n means any of the following:\n\n (a) any file in Source Code Form that results from an addition to,\n deletion from, or modification of the contents of Covered\n Software; or\n\n (b) any new file in Source Code Form that contains any Covered\n Software.\n\n1.11. \"Patent Claims\" of a Contributor\n means any patent claim(s), including without limitation, method,\n process, and apparatus claims, in any patent Licensable by such\n Contributor that would be infringed, but for the grant of the\n License, by the making, using, selling, offering for sale, having\n made, import, or transfer of either its Contributions or its\n Contributor Version.\n\n1.12. \"Secondary License\"\n means either the GNU General Public License, Version 2.0, the GNU\n Lesser General Public License, Version 2.1, the GNU Affero General\n Public License, Version 3.0, or any later versions of those\n licenses.\n\n1.13. \"Source Code Form\"\n means the form of the work preferred for making modifications.\n\n1.14. \"You\" (or \"Your\")\n means an individual or a legal entity exercising rights under this\n License. For legal entities, \"You\" includes any entity that\n controls, is controlled by, or is under common control with You. For\n purposes of this definition, \"control\" means (a) the power, direct\n or indirect, to cause the direction or management of such entity,\n whether by contract or otherwise, or (b) ownership of more than\n fifty percent (50%) of the outstanding shares or beneficial\n ownership of such entity.\n\n2. License Grants and Conditions\n--------------------------------\n\n2.1. Grants\n\nEach Contributor hereby grants You a world-wide, royalty-free,\nnon-exclusive license:\n\n(a) under intellectual property rights (other than patent or trademark)\n Licensable by such Contributor to use, reproduce, make available,\n modify, display, perform, distribute, and otherwise exploit its\n Contributions, either on an unmodified basis, with Modifications, or\n as part of a Larger Work; and\n\n(b) under Patent Claims of such Contributor to make, use, sell, offer\n for sale, have made, import, and otherwise transfer either its\n Contributions or its Contributor Version.\n\n2.2. Effective Date\n\nThe licenses granted in Section 2.1 with respect to any Contribution\nbecome effective for each Contribution on the date the Contributor first\ndistributes such Contribution.\n\n2.3. Limitations on Grant Scope\n\nThe licenses granted in this Section 2 are the only rights granted under\nthis License. No additional rights or licenses will be implied from the\ndistribution or licensing of Covered Software under this License.\nNotwithstanding Section 2.1(b) above, no patent license is granted by a\nContributor:\n\n(a) for any code that a Contributor has removed from Covered Software;\n or\n\n(b) for infringements caused by: (i) Your and any other third party's\n modifications of Covered Software, or (ii) the combination of its\n Contributions with other software (except as part of its Contributor\n Version); or\n\n(c) under Patent Claims infringed by Covered Software in the absence of\n its Contributions.\n\nThis License does not grant any rights in the trademarks, service marks,\nor logos of any Contributor (except as may be necessary to comply with\nthe notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\nNo Contributor makes additional grants as a result of Your choice to\ndistribute the Covered Software under a subsequent version of this\nLicense (see Section 10.2) or under the terms of a Secondary License (if\npermitted under the terms of Section 3.3).\n\n2.5. Representation\n\nEach Contributor represents that the Contributor believes its\nContributions are its original creation(s) or it has sufficient rights\nto grant the rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\nThis License is not intended to limit any rights You have under\napplicable copyright doctrines of fair use, fair dealing, or other\nequivalents.\n\n2.7. Conditions\n\nSections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted\nin Section 2.1.\n\n3. Responsibilities\n-------------------\n\n3.1. Distribution of Source Form\n\nAll distribution of Covered Software in Source Code Form, including any\nModifications that You create or to which You contribute, must be under\nthe terms of this License. You must inform recipients that the Source\nCode Form of the Covered Software is governed by the terms of this\nLicense, and how they can obtain a copy of this License. You may not\nattempt to alter or restrict the recipients' rights in the Source Code\nForm.\n\n3.2. Distribution of Executable Form\n\nIf You distribute Covered Software in Executable Form then:\n\n(a) such Covered Software must also be made available in Source Code\n Form, as described in Section 3.1, and You must inform recipients of\n the Executable Form how they can obtain a copy of such Source Code\n Form by reasonable means in a timely manner, at a charge no more\n than the cost of distribution to the recipient; and\n\n(b) You may distribute such Executable Form under the terms of this\n License, or sublicense it under different terms, provided that the\n license for the Executable Form does not attempt to limit or alter\n the recipients' rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\nYou may create and distribute a Larger Work under terms of Your choice,\nprovided that You also comply with the requirements of this License for\nthe Covered Software. If the Larger Work is a combination of Covered\nSoftware with a work governed by one or more Secondary Licenses, and the\nCovered Software is not Incompatible With Secondary Licenses, this\nLicense permits You to additionally distribute such Covered Software\nunder the terms of such Secondary License(s), so that the recipient of\nthe Larger Work may, at their option, further distribute the Covered\nSoftware under the terms of either this License or such Secondary\nLicense(s).\n\n3.4. Notices\n\nYou may not remove or alter the substance of any license notices\n(including copyright notices, patent notices, disclaimers of warranty,\nor limitations of liability) contained within the Source Code Form of\nthe Covered Software, except that You may alter any license notices to\nthe extent required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\nYou may choose to offer, and to charge a fee for, warranty, support,\nindemnity or liability obligations to one or more recipients of Covered\nSoftware. However, You may do so only on Your own behalf, and not on\nbehalf of any Contributor. You must make it absolutely clear that any\nsuch warranty, support, indemnity, or liability obligation is offered by\nYou alone, and You hereby agree to indemnify every Contributor for any\nliability incurred by such Contributor as a result of warranty, support,\nindemnity or liability terms You offer. You may include additional\ndisclaimers of warranty and limitations of liability specific to any\njurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n---------------------------------------------------\n\nIf it is impossible for You to comply with any of the terms of this\nLicense with respect to some or all of the Covered Software due to\nstatute, judicial order, or regulation then You must: (a) comply with\nthe terms of this License to the maximum extent possible; and (b)\ndescribe the limitations and the code they affect. Such description must\nbe placed in a text file included with all distributions of the Covered\nSoftware under this License. Except to the extent prohibited by statute\nor regulation, such description must be sufficiently detailed for a\nrecipient of ordinary skill to be able to understand it.\n\n5. Termination\n--------------\n\n5.1. The rights granted under this License will terminate automatically\nif You fail to comply with any of its terms. However, if You become\ncompliant, then the rights granted under this License from a particular\nContributor are reinstated (a) provisionally, unless and until such\nContributor explicitly and finally terminates Your grants, and (b) on an\nongoing basis, if such Contributor fails to notify You of the\nnon-compliance by some reasonable means prior to 60 days after You have\ncome back into compliance. Moreover, Your grants from a particular\nContributor are reinstated on an ongoing basis if such Contributor\nnotifies You of the non-compliance by some reasonable means, this is the\nfirst time You have received notice of non-compliance with this License\nfrom such Contributor, and You become compliant prior to 30 days after\nYour receipt of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\ninfringement claim (excluding declaratory judgment actions,\ncounter-claims, and cross-claims) alleging that a Contributor Version\ndirectly or indirectly infringes any patent, then the rights granted to\nYou by any and all Contributors for the Covered Software under Section\n2.1 of this License shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all\nend user license agreements (excluding distributors and resellers) which\nhave been validly granted by You or Your distributors under this License\nprior to termination shall survive termination.\n\n************************************************************************\n* *\n* 6. Disclaimer of Warranty *\n* ------------------------- *\n* *\n* Covered Software is provided under this License on an \"as is\" *\n* basis, without warranty of any kind, either expressed, implied, or *\n* statutory, including, without limitation, warranties that the *\n* Covered Software is free of defects, merchantable, fit for a *\n* particular purpose or non-infringing. The entire risk as to the *\n* quality and performance of the Covered Software is with You. *\n* Should any Covered Software prove defective in any respect, You *\n* (not any Contributor) assume the cost of any necessary servicing, *\n* repair, or correction. This disclaimer of warranty constitutes an *\n* essential part of this License. No use of any Covered Software is *\n* authorized under this License except under this disclaimer. *\n* *\n************************************************************************\n\n************************************************************************\n* *\n* 7. Limitation of Liability *\n* -------------------------- *\n* *\n* Under no circumstances and under no legal theory, whether tort *\n* (including negligence), contract, or otherwise, shall any *\n* Contributor, or anyone who distributes Covered Software as *\n* permitted above, be liable to You for any direct, indirect, *\n* special, incidental, or consequential damages of any character *\n* including, without limitation, damages for lost profits, loss of *\n* goodwill, work stoppage, computer failure or malfunction, or any *\n* and all other commercial damages or losses, even if such party *\n* shall have been informed of the possibility of such damages. This *\n* limitation of liability shall not apply to liability for death or *\n* personal injury resulting from such party's negligence to the *\n* extent applicable law prohibits such limitation. Some *\n* jurisdictions do not allow the exclusion or limitation of *\n* incidental or consequential damages, so this exclusion and *\n* limitation may not apply to You. *\n* *\n************************************************************************\n\n8. Litigation\n-------------\n\nAny litigation relating to this License may be brought only in the\ncourts of a jurisdiction where the defendant maintains its principal\nplace of business and such litigation shall be governed by laws of that\njurisdiction, without reference to its conflict-of-law provisions.\nNothing in this Section shall prevent a party's ability to bring\ncross-claims or counter-claims.\n\n9. Miscellaneous\n----------------\n\nThis License represents the complete agreement concerning the subject\nmatter hereof. If any provision of this License is held to be\nunenforceable, such provision shall be reformed only to the extent\nnecessary to make it enforceable. Any law or regulation which provides\nthat the language of a contract shall be construed against the drafter\nshall not be used to construe this License against a Contributor.\n\n10. Versions of the License\n---------------------------\n\n10.1. New Versions\n\nMozilla Foundation is the license steward. Except as provided in Section\n10.3, no one other than the license steward has the right to modify or\npublish new versions of this License. Each version will be given a\ndistinguishing version number.\n\n10.2. Effect of New Versions\n\nYou may distribute the Covered Software under the terms of the version\nof the License under which You originally received the Covered Software,\nor under the terms of any subsequent version published by the license\nsteward.\n\n10.3. Modified Versions\n\nIf you create software not governed by this License, and you want to\ncreate a new license for such software, you may create and use a\nmodified version of this License if you rename the license and remove\nany references to the name of the license steward (except to note that\nsuch modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary\nLicenses\n\nIf You choose to distribute Source Code Form that is Incompatible With\nSecondary Licenses under the terms of this version of the License, the\nnotice described in Exhibit B of this License must be attached.\n\nExhibit A - Source Code Form License Notice\n-------------------------------------------\n\n This Source Code Form is subject to the terms of the Mozilla Public\n License, v. 2.0. If a copy of the MPL was not distributed with this\n file, You can obtain one at http://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular\nfile, then You may include the notice in a location (such as a LICENSE\nfile in a relevant directory) where a recipient would be likely to look\nfor such a notice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - \"Incompatible With Secondary Licenses\" Notice\n---------------------------------------------------------\n\n This Source Code Form is \"Incompatible With Secondary Licenses\", as\n defined by the Mozilla Public License, v. 2.0.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/hashicorp/go-sockaddr@v1.0.7", + "type": "library", + "bom-ref": "pkg:golang/github.com/hashicorp/go-sockaddr@v1.0.7", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/hashicorp/go-sockaddr/@v/v1.0.7.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.19" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-09-19 09:47:04 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/hashicorp/go-sockaddr@v1.0.7" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/hashicorp/go-sockaddr" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.19" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/hashicorp/hcl", + "version": "v1.0.1-vault-7", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "5d886d9fa8a3052023ea7e18a8069fed104f4b8234e8022d368ae9cbe32840d3" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Mozilla Public License, version 2.0\n\n1. Definitions\n\n1.1. “Contributor”\n\n means each individual or legal entity that creates, contributes to the\n creation of, or owns Covered Software.\n\n1.2. “Contributor Version”\n\n means the combination of the Contributions of others (if any) used by a\n Contributor and that particular Contributor’s Contribution.\n\n1.3. “Contribution”\n\n means Covered Software of a particular Contributor.\n\n1.4. “Covered Software”\n\n means Source Code Form to which the initial Contributor has attached the\n notice in Exhibit A, the Executable Form of such Source Code Form, and\n Modifications of such Source Code Form, in each case including portions\n thereof.\n\n1.5. “Incompatible With Secondary Licenses”\n means\n\n a. that the initial Contributor has attached the notice described in\n Exhibit B to the Covered Software; or\n\n b. that the Covered Software was made available under the terms of version\n 1.1 or earlier of the License, but not also under the terms of a\n Secondary License.\n\n1.6. “Executable Form”\n\n means any form of the work other than Source Code Form.\n\n1.7. “Larger Work”\n\n means a work that combines Covered Software with other material, in a separate\n file or files, that is not Covered Software.\n\n1.8. “License”\n\n means this document.\n\n1.9. “Licensable”\n\n means having the right to grant, to the maximum extent possible, whether at the\n time of the initial grant or subsequently, any and all of the rights conveyed by\n this License.\n\n1.10. “Modifications”\n\n means any of the following:\n\n a. any file in Source Code Form that results from an addition to, deletion\n from, or modification of the contents of Covered Software; or\n\n b. any new file in Source Code Form that contains any Covered Software.\n\n1.11. “Patent Claims” of a Contributor\n\n means any patent claim(s), including without limitation, method, process,\n and apparatus claims, in any patent Licensable by such Contributor that\n would be infringed, but for the grant of the License, by the making,\n using, selling, offering for sale, having made, import, or transfer of\n either its Contributions or its Contributor Version.\n\n1.12. “Secondary License”\n\n means either the GNU General Public License, Version 2.0, the GNU Lesser\n General Public License, Version 2.1, the GNU Affero General Public\n License, Version 3.0, or any later versions of those licenses.\n\n1.13. “Source Code Form”\n\n means the form of the work preferred for making modifications.\n\n1.14. “You” (or “Your”)\n\n means an individual or a legal entity exercising rights under this\n License. For legal entities, “You” includes any entity that controls, is\n controlled by, or is under common control with You. For purposes of this\n definition, “control” means (a) the power, direct or indirect, to cause\n the direction or management of such entity, whether by contract or\n otherwise, or (b) ownership of more than fifty percent (50%) of the\n outstanding shares or beneficial ownership of such entity.\n\n\n2. License Grants and Conditions\n\n2.1. Grants\n\n Each Contributor hereby grants You a world-wide, royalty-free,\n non-exclusive license:\n\n a. under intellectual property rights (other than patent or trademark)\n Licensable by such Contributor to use, reproduce, make available,\n modify, display, perform, distribute, and otherwise exploit its\n Contributions, either on an unmodified basis, with Modifications, or as\n part of a Larger Work; and\n\n b. under Patent Claims of such Contributor to make, use, sell, offer for\n sale, have made, import, and otherwise transfer either its Contributions\n or its Contributor Version.\n\n2.2. Effective Date\n\n The licenses granted in Section 2.1 with respect to any Contribution become\n effective for each Contribution on the date the Contributor first distributes\n such Contribution.\n\n2.3. Limitations on Grant Scope\n\n The licenses granted in this Section 2 are the only rights granted under this\n License. No additional rights or licenses will be implied from the distribution\n or licensing of Covered Software under this License. Notwithstanding Section\n 2.1(b) above, no patent license is granted by a Contributor:\n\n a. for any code that a Contributor has removed from Covered Software; or\n\n b. for infringements caused by: (i) Your and any other third party’s\n modifications of Covered Software, or (ii) the combination of its\n Contributions with other software (except as part of its Contributor\n Version); or\n\n c. under Patent Claims infringed by Covered Software in the absence of its\n Contributions.\n\n This License does not grant any rights in the trademarks, service marks, or\n logos of any Contributor (except as may be necessary to comply with the\n notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\n No Contributor makes additional grants as a result of Your choice to\n distribute the Covered Software under a subsequent version of this License\n (see Section 10.2) or under the terms of a Secondary License (if permitted\n under the terms of Section 3.3).\n\n2.5. Representation\n\n Each Contributor represents that the Contributor believes its Contributions\n are its original creation(s) or it has sufficient rights to grant the\n rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\n This License is not intended to limit any rights You have under applicable\n copyright doctrines of fair use, fair dealing, or other equivalents.\n\n2.7. Conditions\n\n Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in\n Section 2.1.\n\n\n3. Responsibilities\n\n3.1. Distribution of Source Form\n\n All distribution of Covered Software in Source Code Form, including any\n Modifications that You create or to which You contribute, must be under the\n terms of this License. You must inform recipients that the Source Code Form\n of the Covered Software is governed by the terms of this License, and how\n they can obtain a copy of this License. You may not attempt to alter or\n restrict the recipients’ rights in the Source Code Form.\n\n3.2. Distribution of Executable Form\n\n If You distribute Covered Software in Executable Form then:\n\n a. such Covered Software must also be made available in Source Code Form,\n as described in Section 3.1, and You must inform recipients of the\n Executable Form how they can obtain a copy of such Source Code Form by\n reasonable means in a timely manner, at a charge no more than the cost\n of distribution to the recipient; and\n\n b. You may distribute such Executable Form under the terms of this License,\n or sublicense it under different terms, provided that the license for\n the Executable Form does not attempt to limit or alter the recipients’\n rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\n You may create and distribute a Larger Work under terms of Your choice,\n provided that You also comply with the requirements of this License for the\n Covered Software. If the Larger Work is a combination of Covered Software\n with a work governed by one or more Secondary Licenses, and the Covered\n Software is not Incompatible With Secondary Licenses, this License permits\n You to additionally distribute such Covered Software under the terms of\n such Secondary License(s), so that the recipient of the Larger Work may, at\n their option, further distribute the Covered Software under the terms of\n either this License or such Secondary License(s).\n\n3.4. Notices\n\n You may not remove or alter the substance of any license notices (including\n copyright notices, patent notices, disclaimers of warranty, or limitations\n of liability) contained within the Source Code Form of the Covered\n Software, except that You may alter any license notices to the extent\n required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\n You may choose to offer, and to charge a fee for, warranty, support,\n indemnity or liability obligations to one or more recipients of Covered\n Software. However, You may do so only on Your own behalf, and not on behalf\n of any Contributor. You must make it absolutely clear that any such\n warranty, support, indemnity, or liability obligation is offered by You\n alone, and You hereby agree to indemnify every Contributor for any\n liability incurred by such Contributor as a result of warranty, support,\n indemnity or liability terms You offer. You may include additional\n disclaimers of warranty and limitations of liability specific to any\n jurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n\n If it is impossible for You to comply with any of the terms of this License\n with respect to some or all of the Covered Software due to statute, judicial\n order, or regulation then You must: (a) comply with the terms of this License\n to the maximum extent possible; and (b) describe the limitations and the code\n they affect. Such description must be placed in a text file included with all\n distributions of the Covered Software under this License. Except to the\n extent prohibited by statute or regulation, such description must be\n sufficiently detailed for a recipient of ordinary skill to be able to\n understand it.\n\n5. Termination\n\n5.1. The rights granted under this License will terminate automatically if You\n fail to comply with any of its terms. However, if You become compliant,\n then the rights granted under this License from a particular Contributor\n are reinstated (a) provisionally, unless and until such Contributor\n explicitly and finally terminates Your grants, and (b) on an ongoing basis,\n if such Contributor fails to notify You of the non-compliance by some\n reasonable means prior to 60 days after You have come back into compliance.\n Moreover, Your grants from a particular Contributor are reinstated on an\n ongoing basis if such Contributor notifies You of the non-compliance by\n some reasonable means, this is the first time You have received notice of\n non-compliance with this License from such Contributor, and You become\n compliant prior to 30 days after Your receipt of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\n infringement claim (excluding declaratory judgment actions, counter-claims,\n and cross-claims) alleging that a Contributor Version directly or\n indirectly infringes any patent, then the rights granted to You by any and\n all Contributors for the Covered Software under Section 2.1 of this License\n shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user\n license agreements (excluding distributors and resellers) which have been\n validly granted by You or Your distributors under this License prior to\n termination shall survive termination.\n\n6. Disclaimer of Warranty\n\n Covered Software is provided under this License on an “as is” basis, without\n warranty of any kind, either expressed, implied, or statutory, including,\n without limitation, warranties that the Covered Software is free of defects,\n merchantable, fit for a particular purpose or non-infringing. The entire\n risk as to the quality and performance of the Covered Software is with You.\n Should any Covered Software prove defective in any respect, You (not any\n Contributor) assume the cost of any necessary servicing, repair, or\n correction. This disclaimer of warranty constitutes an essential part of this\n License. No use of any Covered Software is authorized under this License\n except under this disclaimer.\n\n7. Limitation of Liability\n\n Under no circumstances and under no legal theory, whether tort (including\n negligence), contract, or otherwise, shall any Contributor, or anyone who\n distributes Covered Software as permitted above, be liable to You for any\n direct, indirect, special, incidental, or consequential damages of any\n character including, without limitation, damages for lost profits, loss of\n goodwill, work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses, even if such party shall have been\n informed of the possibility of such damages. This limitation of liability\n shall not apply to liability for death or personal injury resulting from such\n party’s negligence to the extent applicable law prohibits such limitation.\n Some jurisdictions do not allow the exclusion or limitation of incidental or\n consequential damages, so this exclusion and limitation may not apply to You.\n\n8. Litigation\n\n Any litigation relating to this License may be brought only in the courts of\n a jurisdiction where the defendant maintains its principal place of business\n and such litigation shall be governed by laws of that jurisdiction, without\n reference to its conflict-of-law provisions. Nothing in this Section shall\n prevent a party’s ability to bring cross-claims or counter-claims.\n\n9. Miscellaneous\n\n This License represents the complete agreement concerning the subject matter\n hereof. If any provision of this License is held to be unenforceable, such\n provision shall be reformed only to the extent necessary to make it\n enforceable. Any law or regulation which provides that the language of a\n contract shall be construed against the drafter shall not be used to construe\n this License against a Contributor.\n\n\n10. Versions of the License\n\n10.1. New Versions\n\n Mozilla Foundation is the license steward. Except as provided in Section\n 10.3, no one other than the license steward has the right to modify or\n publish new versions of this License. Each version will be given a\n distinguishing version number.\n\n10.2. Effect of New Versions\n\n You may distribute the Covered Software under the terms of the version of\n the License under which You originally received the Covered Software, or\n under the terms of any subsequent version published by the license\n steward.\n\n10.3. Modified Versions\n\n If you create software not governed by this License, and you want to\n create a new license for such software, you may create and use a modified\n version of this License if you rename the license and remove any\n references to the name of the license steward (except to note that such\n modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses\n If You choose to distribute Source Code Form that is Incompatible With\n Secondary Licenses under the terms of this version of the License, the\n notice described in Exhibit B of this License must be attached.\n\nExhibit A - Source Code Form License Notice\n\n This Source Code Form is subject to the\n terms of the Mozilla Public License, v.\n 2.0. If a copy of the MPL was not\n distributed with this file, You can\n obtain one at\n http://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular file, then\nYou may include the notice in a location (such as a LICENSE file in a relevant\ndirectory) where a recipient would be likely to look for such a notice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - “Incompatible With Secondary Licenses” Notice\n\n This Source Code Form is “Incompatible\n With Secondary Licenses”, as defined by\n the Mozilla Public License, v. 2.0.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/hashicorp/hcl@v1.0.1-vault-7", + "type": "library", + "bom-ref": "pkg:golang/github.com/hashicorp/hcl@v1.0.1-vault-7", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/hashicorp/hcl/@v/v1.0.1-vault-7.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.15" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-11-07 22:23:56 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/hashicorp/hcl@v1.0.1-vault-7" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/hashicorp/hcl" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.15" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/hashicorp/vault/api", + "version": "v1.22.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "214640d9c0efaf83a4dfe36d2b63aafebfa525e5e4782ac7466a9dc967e99863" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2015 HashiCorp, Inc.\n\nMozilla Public License, version 2.0\n\n1. Definitions\n\n1.1. \"Contributor\"\n\n means each individual or legal entity that creates, contributes to the\n creation of, or owns Covered Software.\n\n1.2. \"Contributor Version\"\n\n means the combination of the Contributions of others (if any) used by a\n Contributor and that particular Contributor's Contribution.\n\n1.3. \"Contribution\"\n\n means Covered Software of a particular Contributor.\n\n1.4. \"Covered Software\"\n\n means Source Code Form to which the initial Contributor has attached the\n notice in Exhibit A, the Executable Form of such Source Code Form, and\n Modifications of such Source Code Form, in each case including portions\n thereof.\n\n1.5. \"Incompatible With Secondary Licenses\"\n means\n\n a. that the initial Contributor has attached the notice described in\n Exhibit B to the Covered Software; or\n\n b. that the Covered Software was made available under the terms of\n version 1.1 or earlier of the License, but not also under the terms of\n a Secondary License.\n\n1.6. \"Executable Form\"\n\n means any form of the work other than Source Code Form.\n\n1.7. \"Larger Work\"\n\n means a work that combines Covered Software with other material, in a\n separate file or files, that is not Covered Software.\n\n1.8. \"License\"\n\n means this document.\n\n1.9. \"Licensable\"\n\n means having the right to grant, to the maximum extent possible, whether\n at the time of the initial grant or subsequently, any and all of the\n rights conveyed by this License.\n\n1.10. \"Modifications\"\n\n means any of the following:\n\n a. any file in Source Code Form that results from an addition to,\n deletion from, or modification of the contents of Covered Software; or\n\n b. any new file in Source Code Form that contains any Covered Software.\n\n1.11. \"Patent Claims\" of a Contributor\n\n means any patent claim(s), including without limitation, method,\n process, and apparatus claims, in any patent Licensable by such\n Contributor that would be infringed, but for the grant of the License,\n by the making, using, selling, offering for sale, having made, import,\n or transfer of either its Contributions or its Contributor Version.\n\n1.12. \"Secondary License\"\n\n means either the GNU General Public License, Version 2.0, the GNU Lesser\n General Public License, Version 2.1, the GNU Affero General Public\n License, Version 3.0, or any later versions of those licenses.\n\n1.13. \"Source Code Form\"\n\n means the form of the work preferred for making modifications.\n\n1.14. \"You\" (or \"Your\")\n\n means an individual or a legal entity exercising rights under this\n License. For legal entities, \"You\" includes any entity that controls, is\n controlled by, or is under common control with You. For purposes of this\n definition, \"control\" means (a) the power, direct or indirect, to cause\n the direction or management of such entity, whether by contract or\n otherwise, or (b) ownership of more than fifty percent (50%) of the\n outstanding shares or beneficial ownership of such entity.\n\n\n2. License Grants and Conditions\n\n2.1. Grants\n\n Each Contributor hereby grants You a world-wide, royalty-free,\n non-exclusive license:\n\n a. under intellectual property rights (other than patent or trademark)\n Licensable by such Contributor to use, reproduce, make available,\n modify, display, perform, distribute, and otherwise exploit its\n Contributions, either on an unmodified basis, with Modifications, or\n as part of a Larger Work; and\n\n b. under Patent Claims of such Contributor to make, use, sell, offer for\n sale, have made, import, and otherwise transfer either its\n Contributions or its Contributor Version.\n\n2.2. Effective Date\n\n The licenses granted in Section 2.1 with respect to any Contribution\n become effective for each Contribution on the date the Contributor first\n distributes such Contribution.\n\n2.3. Limitations on Grant Scope\n\n The licenses granted in this Section 2 are the only rights granted under\n this License. No additional rights or licenses will be implied from the\n distribution or licensing of Covered Software under this License.\n Notwithstanding Section 2.1(b) above, no patent license is granted by a\n Contributor:\n\n a. for any code that a Contributor has removed from Covered Software; or\n\n b. for infringements caused by: (i) Your and any other third party's\n modifications of Covered Software, or (ii) the combination of its\n Contributions with other software (except as part of its Contributor\n Version); or\n\n c. under Patent Claims infringed by Covered Software in the absence of\n its Contributions.\n\n This License does not grant any rights in the trademarks, service marks,\n or logos of any Contributor (except as may be necessary to comply with\n the notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\n No Contributor makes additional grants as a result of Your choice to\n distribute the Covered Software under a subsequent version of this\n License (see Section 10.2) or under the terms of a Secondary License (if\n permitted under the terms of Section 3.3).\n\n2.5. Representation\n\n Each Contributor represents that the Contributor believes its\n Contributions are its original creation(s) or it has sufficient rights to\n grant the rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\n This License is not intended to limit any rights You have under\n applicable copyright doctrines of fair use, fair dealing, or other\n equivalents.\n\n2.7. Conditions\n\n Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in\n Section 2.1.\n\n\n3. Responsibilities\n\n3.1. Distribution of Source Form\n\n All distribution of Covered Software in Source Code Form, including any\n Modifications that You create or to which You contribute, must be under\n the terms of this License. You must inform recipients that the Source\n Code Form of the Covered Software is governed by the terms of this\n License, and how they can obtain a copy of this License. You may not\n attempt to alter or restrict the recipients' rights in the Source Code\n Form.\n\n3.2. Distribution of Executable Form\n\n If You distribute Covered Software in Executable Form then:\n\n a. such Covered Software must also be made available in Source Code Form,\n as described in Section 3.1, and You must inform recipients of the\n Executable Form how they can obtain a copy of such Source Code Form by\n reasonable means in a timely manner, at a charge no more than the cost\n of distribution to the recipient; and\n\n b. You may distribute such Executable Form under the terms of this\n License, or sublicense it under different terms, provided that the\n license for the Executable Form does not attempt to limit or alter the\n recipients' rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\n You may create and distribute a Larger Work under terms of Your choice,\n provided that You also comply with the requirements of this License for\n the Covered Software. If the Larger Work is a combination of Covered\n Software with a work governed by one or more Secondary Licenses, and the\n Covered Software is not Incompatible With Secondary Licenses, this\n License permits You to additionally distribute such Covered Software\n under the terms of such Secondary License(s), so that the recipient of\n the Larger Work may, at their option, further distribute the Covered\n Software under the terms of either this License or such Secondary\n License(s).\n\n3.4. Notices\n\n You may not remove or alter the substance of any license notices\n (including copyright notices, patent notices, disclaimers of warranty, or\n limitations of liability) contained within the Source Code Form of the\n Covered Software, except that You may alter any license notices to the\n extent required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\n You may choose to offer, and to charge a fee for, warranty, support,\n indemnity or liability obligations to one or more recipients of Covered\n Software. However, You may do so only on Your own behalf, and not on\n behalf of any Contributor. You must make it absolutely clear that any\n such warranty, support, indemnity, or liability obligation is offered by\n You alone, and You hereby agree to indemnify every Contributor for any\n liability incurred by such Contributor as a result of warranty, support,\n indemnity or liability terms You offer. You may include additional\n disclaimers of warranty and limitations of liability specific to any\n jurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n\n If it is impossible for You to comply with any of the terms of this License\n with respect to some or all of the Covered Software due to statute,\n judicial order, or regulation then You must: (a) comply with the terms of\n this License to the maximum extent possible; and (b) describe the\n limitations and the code they affect. Such description must be placed in a\n text file included with all distributions of the Covered Software under\n this License. Except to the extent prohibited by statute or regulation,\n such description must be sufficiently detailed for a recipient of ordinary\n skill to be able to understand it.\n\n5. Termination\n\n5.1. The rights granted under this License will terminate automatically if You\n fail to comply with any of its terms. However, if You become compliant,\n then the rights granted under this License from a particular Contributor\n are reinstated (a) provisionally, unless and until such Contributor\n explicitly and finally terminates Your grants, and (b) on an ongoing\n basis, if such Contributor fails to notify You of the non-compliance by\n some reasonable means prior to 60 days after You have come back into\n compliance. Moreover, Your grants from a particular Contributor are\n reinstated on an ongoing basis if such Contributor notifies You of the\n non-compliance by some reasonable means, this is the first time You have\n received notice of non-compliance with this License from such\n Contributor, and You become compliant prior to 30 days after Your receipt\n of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\n infringement claim (excluding declaratory judgment actions,\n counter-claims, and cross-claims) alleging that a Contributor Version\n directly or indirectly infringes any patent, then the rights granted to\n You by any and all Contributors for the Covered Software under Section\n 2.1 of this License shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user\n license agreements (excluding distributors and resellers) which have been\n validly granted by You or Your distributors under this License prior to\n termination shall survive termination.\n\n6. Disclaimer of Warranty\n\n Covered Software is provided under this License on an \"as is\" basis,\n without warranty of any kind, either expressed, implied, or statutory,\n including, without limitation, warranties that the Covered Software is free\n of defects, merchantable, fit for a particular purpose or non-infringing.\n The entire risk as to the quality and performance of the Covered Software\n is with You. Should any Covered Software prove defective in any respect,\n You (not any Contributor) assume the cost of any necessary servicing,\n repair, or correction. This disclaimer of warranty constitutes an essential\n part of this License. No use of any Covered Software is authorized under\n this License except under this disclaimer.\n\n7. Limitation of Liability\n\n Under no circumstances and under no legal theory, whether tort (including\n negligence), contract, or otherwise, shall any Contributor, or anyone who\n distributes Covered Software as permitted above, be liable to You for any\n direct, indirect, special, incidental, or consequential damages of any\n character including, without limitation, damages for lost profits, loss of\n goodwill, work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses, even if such party shall have been\n informed of the possibility of such damages. This limitation of liability\n shall not apply to liability for death or personal injury resulting from\n such party's negligence to the extent applicable law prohibits such\n limitation. Some jurisdictions do not allow the exclusion or limitation of\n incidental or consequential damages, so this exclusion and limitation may\n not apply to You.\n\n8. Litigation\n\n Any litigation relating to this License may be brought only in the courts\n of a jurisdiction where the defendant maintains its principal place of\n business and such litigation shall be governed by laws of that\n jurisdiction, without reference to its conflict-of-law provisions. Nothing\n in this Section shall prevent a party's ability to bring cross-claims or\n counter-claims.\n\n9. Miscellaneous\n\n This License represents the complete agreement concerning the subject\n matter hereof. If any provision of this License is held to be\n unenforceable, such provision shall be reformed only to the extent\n necessary to make it enforceable. Any law or regulation which provides that\n the language of a contract shall be construed against the drafter shall not\n be used to construe this License against a Contributor.\n\n\n10. Versions of the License\n\n10.1. New Versions\n\n Mozilla Foundation is the license steward. Except as provided in Section\n 10.3, no one other than the license steward has the right to modify or\n publish new versions of this License. Each version will be given a\n distinguishing version number.\n\n10.2. Effect of New Versions\n\n You may distribute the Covered Software under the terms of the version\n of the License under which You originally received the Covered Software,\n or under the terms of any subsequent version published by the license\n steward.\n\n10.3. Modified Versions\n\n If you create software not governed by this License, and you want to\n create a new license for such software, you may create and use a\n modified version of this License if you rename the license and remove\n any references to the name of the license steward (except to note that\n such modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary\n Licenses If You choose to distribute Source Code Form that is\n Incompatible With Secondary Licenses under the terms of this version of\n the License, the notice described in Exhibit B of this License must be\n attached.\n\nExhibit A - Source Code Form License Notice\n\n This Source Code Form is subject to the\n terms of the Mozilla Public License, v.\n 2.0. If a copy of the MPL was not\n distributed with this file, You can\n obtain one at\n http://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular file,\nthen You may include the notice in a location (such as a LICENSE file in a\nrelevant directory) where a recipient would be likely to look for such a\nnotice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - \"Incompatible With Secondary Licenses\" Notice\n\n This Source Code Form is \"Incompatible\n With Secondary Licenses\", as defined by\n the Mozilla Public License, v. 2.0.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/hashicorp/vault/api@v1.22.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/hashicorp/vault/api@v1.22.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/hashicorp/vault/api/@v/v1.22.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-10-02 22:02:29 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/hashicorp/vault/api@v1.22.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/hashicorp/vault/api" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/in-toto/attestation", + "version": "v1.2.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "afbf46e3980e9b33e2b2680e6cb48bfab65317152064b390248e8ba1f4d98179" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2021 in-toto Developers\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/in-toto/attestation@v1.2.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/in-toto/attestation@v1.2.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/in-toto/attestation/@v/v1.2.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-03-18 17:35:22 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/in-toto/attestation@v1.2.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/in-toto/attestation" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "65" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "5" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "58" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "2" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 242 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 289 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 294 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 297 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 307 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 212 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 215 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 257 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 286 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 301 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 337 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 338 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 352 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 355 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 382 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 385 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 407 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 410 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 423 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 426 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 444 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 464 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 467 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 98 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "attachAttestationNewBundle", + "line": 89, + "column": 72, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attest", + "module": "function", + "function": "validateStatement", + "line": 242, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attest", + "module": "function", + "function": "validateStatement", + "line": 238, + "column": 17, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/download", + "module": "function", + "function": "AttestationCmd", + "line": 65, + "column": 8, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/sign", + "module": "function", + "function": "signDigestBundle", + "line": 172, + "column": 21, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/sign", + "module": "function", + "function": "signDigestBundle", + "line": 165, + "column": 13, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/sign", + "module": "function", + "function": "signDigestBundle", + "line": 171, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/sign", + "module": "function", + "function": "signDigestBundle", + "line": 170, + "column": 16, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/in-toto/in-toto-golang", + "version": "v0.11.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "bb73e34e7c052a3a796b5602730f12260d06fad31e29f5685ac59e14c0c232dc" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2018 New York University\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/in-toto/in-toto-golang@v0.11.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/in-toto/in-toto-golang@v0.11.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/in-toto/in-toto-golang/@v/v0.11.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-04 16:16:22 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/in-toto/in-toto-golang@v0.11.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/in-toto/in-toto-golang" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "27" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "8" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "19" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 281 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 302 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 303 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 353 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 354 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 368 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 383 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 384 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 408 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 424 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 425 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 465 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 466 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/policy/attestation.go", + "line": 25 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/verify", + "module": "function", + "function": "transformOutput", + "line": 281, + "column": 34, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/attestation", + "module": "function", + "function": "generateSLSAProvenanceStatementSLSA1", + "line": 354, + "column": 19, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/attestation", + "module": "function", + "function": "generateLinkStatement", + "line": 383, + "column": 19, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/attestation", + "module": "function", + "function": "generateLinkStatement", + "line": 368, + "column": 11, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/attestation", + "module": "function", + "function": "generateSLSAProvenanceStatementSLSA02", + "line": 303, + "column": 19, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/attestation", + "module": "function", + "function": "generateOpenVexStatement", + "line": 408, + "column": 19, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/attestation", + "module": "function", + "function": "generateSPDXStatement", + "line": 425, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/attestation", + "module": "function", + "function": "generateSLSAProvenanceStatementSLSA1", + "line": 353, + "column": 19, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/jedisct1/go-minisign", + "version": "v0.0.0-20230811132847-661be99b8267", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "8759d201b185a865739fa27297547f88270150737883e816d6ef42a014eb6fd1" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2018-2023 Frank Denis\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/jedisct1/go-minisign@v0.0.0-20230811132847-661be99b8267", + "type": "library", + "bom-ref": "pkg:golang/github.com/jedisct1/go-minisign@v0.0.0-20230811132847-661be99b8267", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/jedisct1/go-minisign/@v/v0.0.0-20230811132847-661be99b8267.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.20" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-08-11 13:28:47 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/jedisct1/go-minisign@v0.0.0-20230811132847-661be99b8267" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/jedisct1/go-minisign" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.20" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/jellydator/ttlcache/v3", + "version": "v3.4.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "1f0f44823ca6ce2403df21ac41d7f516a15da69ed88c531de12ae0e44265803e" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2022 Jellydator\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/jellydator/ttlcache/v3@v3.4.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/jellydator/ttlcache/v3@v3.4.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/jellydator/ttlcache/v3/@v/v3.4.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-06-17 18:28:59 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/jellydator/ttlcache/v3@v3.4.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/jellydator/ttlcache/v3" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/json-iterator/go", + "version": "v1.1.12", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "7b7d0b4aac28a1969efd4c2511b476f39d8677c86342f2681e64f84e784d181a" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2016 json-iterator\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/json-iterator/go@v1.1.12", + "type": "library", + "bom-ref": "pkg:golang/github.com/json-iterator/go@v1.1.12", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/json-iterator/go/@v/v1.1.12.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.12" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2021-09-11 02:17:26 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/json-iterator/go@v1.1.12" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/json-iterator/go" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.12" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/kelseyhightower/envconfig", + "version": "v1.4.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "71c719465ea64296aae354cfa7943189d47e49addac4c6c90cd6fffc5417e868" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2013 Kelsey Hightower\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies\nof the Software, and to permit persons to whom the Software is furnished to do\nso, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/kelseyhightower/envconfig@v1.4.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/kelseyhightower/envconfig@v1.4.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/kelseyhightower/envconfig/@v/v1.4.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2019-05-24 18:54:28 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/kelseyhightower/envconfig@v1.4.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/kelseyhightower/envconfig" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "2" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/test/cmd/getoidctoken/main.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/test/cmd/getoidctoken/main.go", + "line": 52 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/test/cmd/getoidctoken", + "module": "function", + "function": "main", + "line": 52, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/test/cmd/getoidctoken/main.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/klauspost/compress", + "version": "v1.18.6", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "7303e0f39156ac66abef4ad692dbc6423f3f86d863df0a65d0f183a20c64ad24" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2012 The Go Authors. All rights reserved.\nCopyright (c) 2019 Klaus Post. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n------------------\n\nFiles: gzhttp/*\n\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright 2016-2017 The New York Times Company\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n------------------\n\nFiles: s2/cmd/internal/readahead/*\n\nThe MIT License (MIT)\n\nCopyright (c) 2015 Klaus Post\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n---------------------\nFiles: snappy/*\nFiles: internal/snapref/*\n\nCopyright (c) 2011 The Snappy-Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n-----------------\n\nFiles: s2/cmd/internal/filepathx/*\n\nCopyright 2016 The filepathx Authors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/klauspost/compress@v1.18.6", + "type": "library", + "bom-ref": "pkg:golang/github.com/klauspost/compress@v1.18.6", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/klauspost/compress/@v/v1.18.6.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-30 15:57:39 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/klauspost/compress@v1.18.6" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/klauspost/compress" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/kylelemons/godebug", + "version": "v1.1.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "f7fd2b446c4d1dca29e5b86d5b235e11f392f09216939f34f9f36a6a057f440c" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/kylelemons/godebug/@v/v1.1.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.11" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2019-05-05 01:16:37 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/kylelemons/godebug@v1.1.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/kylelemons/godebug" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.11" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/lestrrat-go/blackmagic", + "version": "v1.0.4", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "e80585c8a34d8f4cc45d061f4cc3df66b01751651f4c86791021141096a28edc" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2021 lestrrat-go\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/lestrrat-go/blackmagic@v1.0.4", + "type": "library", + "bom-ref": "pkg:golang/github.com/lestrrat-go/blackmagic@v1.0.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/lestrrat-go/blackmagic/@v/v1.0.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-06-09 05:38:50 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/lestrrat-go/blackmagic@v1.0.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/lestrrat-go/blackmagic" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/lestrrat-go/dsig", + "version": "v1.2.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "443d9e39a89dc8fbe973b2094283b742ae76456772f19709b3c96b3a7a1ad4a7" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2025 lestrrat-go\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/lestrrat-go/dsig@v1.2.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/lestrrat-go/dsig@v1.2.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/lestrrat-go/dsig/@v/v1.2.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-07 13:53:36 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/lestrrat-go/dsig@v1.2.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/lestrrat-go/dsig" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/lestrrat-go/httpcc", + "version": "v1.0.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "aa296da7732de7afb9e463d509b4dd33d325aa1bf3cae2fa5bf34c0c0f2f0391" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2020 lestrrat-go\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/lestrrat-go/httpcc/@v/v1.0.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.16" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2022-03-29 04:21:01 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/lestrrat-go/httpcc@v1.0.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/lestrrat-go/httpcc" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.16" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/lestrrat-go/httprc/v3", + "version": "v3.0.5", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "99232d9195bdd99f7c33962834dced6d11b16d71ea97bb528ad0af6b1be8f65d" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2022 lestrrat\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/lestrrat-go/httprc/v3@v3.0.5", + "type": "library", + "bom-ref": "pkg:golang/github.com/lestrrat-go/httprc/v3@v3.0.5", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/lestrrat-go/httprc/v3/@v/v3.0.5.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-03-30 00:14:45 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/lestrrat-go/httprc/v3@v3.0.5" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/lestrrat-go/httprc/v3" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/lestrrat-go/jwx/v3", + "version": "v3.1.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "bb0fcc37633f5e2bb8161c1c2301f5d59b21f495b1f525b38002e5effb881245" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2015 lestrrat\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/lestrrat-go/jwx/v3@v3.1.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/lestrrat-go/jwx/v3@v3.1.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/lestrrat-go/jwx/v3/@v/v3.1.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-07 01:03:40 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/lestrrat-go/jwx/v3@v3.1.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/lestrrat-go/jwx/v3" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/lestrrat-go/option/v2", + "version": "v2.0.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "a12c92b26ccca11d2247308309a51fb02cf1407504ba139589039bcb2ed2e958" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2021 lestrrat-go\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/lestrrat-go/option/v2@v2.0.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/lestrrat-go/option/v2@v2.0.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/lestrrat-go/option/v2/@v/v2.0.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-06-09 05:55:07 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/lestrrat-go/option/v2@v2.0.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/lestrrat-go/option/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/letsencrypt/boulder", + "version": "v0.20260309.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "c86f258fca4d3d9f2d6aade835d4e97c14be782ef821a12e89ec2acd5a578961" + } + ], + "purl": "pkg:golang/github.com/letsencrypt/boulder@v0.20260309.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/letsencrypt/boulder@v0.20260309.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/letsencrypt/boulder/@v/v0.20260309.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-03-09 22:04:19 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/letsencrypt/boulder@v0.20260309.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/letsencrypt/boulder" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "encrypt" + ] + }, + { + "group": "", + "name": "github.com/mitchellh/go-homedir", + "version": "v1.1.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "49fc9a094a580a7d5595fe08518883f5f3d7e00e7026b90bcc8cf5375ab4a6bd" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2013 Mitchell Hashimoto\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/mitchellh/go-homedir/@v/v1.1.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2019-01-27 04:21:35 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/mitchellh/go-homedir@v1.1.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/mitchellh/go-homedir" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/mitchellh/go-wordwrap", + "version": "v1.0.1", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "47ad971c92f3bcc15105b72b4fb9bb5a0984d5e3b24d2b02b7e8737acb6f363d" + } + ], + "purl": "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/mitchellh/go-wordwrap/@v/v1.0.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.14" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2020-09-25 18:08:01 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/mitchellh/go-wordwrap@v1.0.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.md" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/mitchellh/go-wordwrap" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.14" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "4" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "2" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 22 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/templates/term", + "module": "method", + "function": "Write", + "line": 115, + "column": 13, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/templates", + "module": "method", + "function": "PrintHelpFlag", + "line": 58, + "column": 20, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/mitchellh/mapstructure", + "version": "v1.5.1-0.20231216201459-8508981c8b6c", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "6c552d56b280e030b6c802a24b23bf414732edef91455d904d63b384fa29051a" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2013 Mitchell Hashimoto\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.1-0.20231216201459-8508981c8b6c", + "type": "library", + "bom-ref": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.1-0.20231216201459-8508981c8b6c", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/mitchellh/mapstructure/@v/v1.5.1-0.20231216201459-8508981c8b6c.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.14" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-12-16 20:14:59 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/mitchellh/mapstructure@v1.5.1-0.20231216201459-8508981c8b6c" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/mitchellh/mapstructure" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.14" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/moby/term", + "version": "v0.5.2", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "7777638c50ab8e707e7e5f0d26ec7e109ceed26b2c7143fe7fc8adf213e414b7" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n https://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n Copyright 2013-2018 Docker, Inc.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n https://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/moby/term@v0.5.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/moby/term@v0.5.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/moby/term/@v/v0.5.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.18" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-01-02 15:40:12 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/moby/term@v0.5.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/moby/term" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.18" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "8" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "4" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/spinner.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/spinner.go", + "line": 41 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/templates/term", + "module": "function", + "function": "GetSize", + "line": 94, + "column": 53, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/templates/term", + "module": "function", + "function": "GetWordWrapperLimit", + "line": 100, + "column": 6, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/templates/term", + "module": "function", + "function": "GetSize", + "line": 89, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/templates/term", + "module": "function", + "function": "GetSize", + "line": 94, + "column": 30, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/templates/term", + "module": "function", + "function": "NewResponsiveWriter", + "line": 52, + "column": 6, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/term/term_writer.go" + }, + { + "package": "github.com/sigstore/cosign/v3/internal/ui", + "module": "function", + "function": "NewSpinner", + "line": 41, + "column": 7, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/ui/spinner.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/modern-go/concurrent", + "version": "v0.0.0-20180306012644-bacd9c7ef1dd", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "e9d242d2600fe2291821bbf273b7e28e358975d4322e7f08837241e42aa807d4" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", + "type": "library", + "bom-ref": "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/modern-go/concurrent/@v/v0.0.0-20180306012644-bacd9c7ef1dd.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2018-03-06 01:26:44 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/modern-go/concurrent" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/modern-go/reflect2", + "version": "v1.0.3-0.20250322232337-35a7c28c31ee", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "c96b9ebe780c389a42cb9d8559632f502f30b3b9bf2c9b236330dad3fafc96e9" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", + "type": "library", + "bom-ref": "pkg:golang/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/modern-go/reflect2/@v/v1.0.3-0.20250322232337-35a7c28c31ee.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.12" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-03-22 23:23:37 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/modern-go/reflect2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.12" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/mozillazg/docker-credential-acr-helper", + "version": "v0.4.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "da48a271bdce94fcad9a5342f571a42ef542f9fd2a4e2270ddffe686679e4018" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2022 mozillazg\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/mozillazg/docker-credential-acr-helper@v0.4.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/mozillazg/docker-credential-acr-helper@v0.4.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/mozillazg/docker-credential-acr-helper/@v/v0.4.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.18" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-09-01 06:21:35 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/mozillazg/docker-credential-acr-helper@v0.4.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/mozillazg/docker-credential-acr-helper" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.18" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "3" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "2" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 34 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "GetRegistryClientOpts", + "line": 147, + "column": 32, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/munnerz/goautoneg", + "version": "v0.0.0-20191010083416-a7dc8b61c822", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "fa7ed3f262bc1ee413705c047b39e6fc323130e891f7221d20235fb4b1350ef4" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2011, Open Knowledge Foundation Ltd.\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n Redistributions of source code must retain the above copyright\n notice, this list of conditions and the following disclaimer.\n\n Redistributions in binary form must reproduce the above copyright\n notice, this list of conditions and the following disclaimer in\n the documentation and/or other materials provided with the\n distribution.\n\n Neither the name of the Open Knowledge Foundation Ltd. nor the\n names of its contributors may be used to endorse or promote\n products derived from this software without specific prior written\n permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nHOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", + "type": "library", + "bom-ref": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/munnerz/goautoneg/@v/v0.0.0-20191010083416-a7dc8b61c822.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2019-10-10 08:34:16 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/munnerz/goautoneg" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/natefinch/atomic", + "version": "v1.0.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "37f0ff10bae58e8a83c93deb66bb149adb2ecef1e4781ff05a31d5db601945b3" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT) \n\nCopyright (c) 2015 Nate Finch\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/natefinch/atomic@v1.0.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/natefinch/atomic@v1.0.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/natefinch/atomic/@v/v1.0.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.12" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2021-06-28 18:01:37 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/natefinch/atomic@v1.0.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/natefinch/atomic" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.12" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/nozzle/throttler", + "version": "v0.0.0-20180817012639-2ea982251481", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "c8a6503bc404d9b1e5828cea58389156a4c594b4128f7d0affa4802bc11e605c" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/nozzle/throttler@v0.0.0-20180817012639-2ea982251481", + "type": "library", + "bom-ref": "pkg:golang/github.com/nozzle/throttler@v0.0.0-20180817012639-2ea982251481", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/nozzle/throttler/@v/v0.0.0-20180817012639-2ea982251481.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2018-08-17 01:26:39 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/nozzle/throttler@v0.0.0-20180817012639-2ea982251481" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/nozzle/throttler" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "18" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "17" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1212 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1227 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1944 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1982 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1987 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1991 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2006 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 773 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 778 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 785 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 790 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 794 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 809 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "VerifyImageAttestation", + "line": 1195, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "VerifyImageAttestation", + "line": 1203, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "VerifyImageAttestation", + "line": 1208, + "column": 4, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "verifyImageAttestationsSigstoreBundle", + "line": 1982, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "verifyImageAttestationsSigstoreBundle", + "line": 1987, + "column": 4, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "verifySignatures", + "line": 778, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "verifySignatures", + "line": 785, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "verifySignatures", + "line": 790, + "column": 4, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/oklog/ulid/v2", + "version": "v2.1.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "adc10a1e604129f79ff43867bd7ef2d476416318d76f470fe44c7136c4d3d504" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/oklog/ulid/v2/@v/v2.1.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.15" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-04-13 18:09:41 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/oklog/ulid/v2@v2.1.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/oklog/ulid/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.15" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/oleiade/reflections", + "version": "v1.1.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "982c71d10b1e795087b39526e478497822950bb0304bc90eebbb64cb8add8ac0" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2013 Théo Crevon\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/oleiade/reflections@v1.1.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/oleiade/reflections@v1.1.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/oleiade/reflections/@v/v1.1.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.22.6" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-08-24 16:28:28 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/oleiade/reflections@v1.1.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/oleiade/reflections" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.22.6" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/open-policy-agent/opa", + "version": "v1.17.1", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "95cb9961296a4295c5cec03a1090842e67d1e7e9cd3a96585fe7a8ef16882259" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/open-policy-agent/opa@v1.17.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/open-policy-agent/opa@v1.17.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/open-policy-agent/opa/@v/v1.17.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 10:19:19 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/open-policy-agent/opa@v1.17.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/open-policy-agent/opa" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "12" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "8" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go", + "line": 67 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/rego", + "module": "function", + "function": "ValidateJSON", + "line": 39, + "column": 23, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/rego", + "module": "function", + "function": "ValidateJSON", + "line": 61, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/rego", + "module": "function", + "function": "ValidateJSON", + "line": 54, + "column": 29, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/rego", + "module": "function", + "function": "ValidateJSON", + "line": 54, + "column": 13, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/rego", + "module": "function", + "function": "ValidateJSON", + "line": 38, + "column": 3, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/rego", + "module": "function", + "function": "ValidateJSON", + "line": 36, + "column": 7, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/rego", + "module": "function", + "function": "ValidateJSON", + "line": 37, + "column": 3, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/rego", + "module": "function", + "function": "ValidateJSON", + "line": 39, + "column": 3, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/rego/rego.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/opencontainers/go-digest", + "version": "v1.0.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "d09ce53248f44d1cd065f26456fcdb3f41c147720acc4ae7bf604d1b85b83003" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n https://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n Copyright 2019, 2020 OCI Contributors\n Copyright 2016 Docker, Inc.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n https://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/opencontainers/go-digest/@v/v1.0.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.13" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2020-05-14 01:46:00 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/opencontainers/go-digest@v1.0.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,LICENSE.docs" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/opencontainers/go-digest" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.13" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/opencontainers/image-spec", + "version": "v1.1.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "aa9a808770e671fdfac12b72c9653e90278382b1a702f7b69c20bcfbb87c4343" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n Copyright 2016 The Linux Foundation.\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/opencontainers/image-spec/@v/v1.1.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.18" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-02-24 17:26:57 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/opencontainers/image-spec@v1.1.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/opencontainers/image-spec" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.18" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/pborman/uuid", + "version": "v1.2.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "5ff34ed2eac299ac5ff555db7654fb0b6633923d882a298d9f893e82d3dd23f9" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2009,2014 Google Inc. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/pborman/uuid@v1.2.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/pborman/uuid@v1.2.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/pborman/uuid/@v/v1.2.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2019-10-24 13:36:33 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/pborman/uuid@v1.2.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/pborman/uuid" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/pelletier/go-toml/v2", + "version": "v2.2.4", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "da022a36ffaa7f14954bb70cdb12502ad2d24cb504f55f2df52b6dfa1e7a9826" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\ngo-toml v2\nCopyright (c) 2021 - 2023 Thomas Pelletier\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4", + "type": "library", + "bom-ref": "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/pelletier/go-toml/v2/@v/v2.2.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.21.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-04-07 11:11:38 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/pelletier/go-toml/v2@v2.2.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/pelletier/go-toml/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.21.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/pkg/browser", + "version": "v0.0.0-20240102092130-5ac0b6a4141c", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "eebc0be026012e78cbc54a8824d9c25a211daf76e7e885188b5e5b3659db0825" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2014, Dave Cheney \nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n list of conditions and the following disclaimer.\n\n* Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", + "type": "library", + "bom-ref": "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/pkg/browser/@v/v0.0.0-20240102092130-5ac0b6a4141c.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.14" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-01-02 09:21:30 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/pkg/browser" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.14" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/pkg/errors", + "version": "v0.9.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "6f06b0c5f1c114d57e2f6854a75ac7003b9f57720cb670d175fd6be4d20d125d" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2015, Dave Cheney \nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n list of conditions and the following disclaimer.\n\n* Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/pkg/errors@v0.9.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/pkg/errors@v0.9.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/pkg/errors/@v/v0.9.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2020-01-14 19:47:44 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/pkg/errors@v0.9.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/pkg/errors" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/protocolbuffers/txtpbfmt", + "version": "v0.0.0-20260217160748-a481f6a22f94", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "2526e4a7406f88aa2f618b7d5ee9d2f7933798b3e26c4f5b1a0f98f790ec1046" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/protocolbuffers/txtpbfmt@v0.0.0-20260217160748-a481f6a22f94", + "type": "library", + "bom-ref": "pkg:golang/github.com/protocolbuffers/txtpbfmt@v0.0.0-20260217160748-a481f6a22f94", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/protocolbuffers/txtpbfmt/@v/v0.0.0-20260217160748-a481f6a22f94.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.19" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-02-17 16:07:48 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/protocolbuffers/txtpbfmt@v0.0.0-20260217160748-a481f6a22f94" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/protocolbuffers/txtpbfmt" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.19" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/rcrowley/go-metrics", + "version": "v0.0.0-20250401214520-65e299d6c5c9", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "6c2aa7573424671306e2cf271b0899e65dd0502caaa68f58fbf64c67d56365ee" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2012 Richard Crowley. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n 1. Redistributions of source code must retain the above copyright\n notice, this list of conditions and the following disclaimer.\n\n 2. Redistributions in binary form must reproduce the above\n copyright notice, this list of conditions and the following\n disclaimer in the documentation and/or other materials provided\n with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY RICHARD CROWLEY ``AS IS'' AND ANY EXPRESS\nOR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL RICHARD CROWLEY OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR\nCONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF\nSUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS\nINTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN\nCONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)\nARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF\nTHE POSSIBILITY OF SUCH DAMAGE.\n\nThe views and conclusions contained in the software and documentation\nare those of the authors and should not be interpreted as representing\nofficial policies, either expressed or implied, of Richard Crowley.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/rcrowley/go-metrics@v0.0.0-20250401214520-65e299d6c5c9", + "type": "library", + "bom-ref": "pkg:golang/github.com/rcrowley/go-metrics@v0.0.0-20250401214520-65e299d6c5c9", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/rcrowley/go-metrics/@v/v0.0.0-20250401214520-65e299d6c5c9.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-04-01 21:45:20 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/rcrowley/go-metrics@v0.0.0-20250401214520-65e299d6c5c9" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/rcrowley/go-metrics" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/rogpeppe/go-internal", + "version": "v1.14.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "31a44a9149b95b48285e97827d3ed4648e9f93f2fb2fbb28d65096b77e594a07" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2018 The Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/rogpeppe/go-internal@v1.14.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/rogpeppe/go-internal@v1.14.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/rogpeppe/go-internal/@v/v1.14.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-02-25 12:37:03 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/rogpeppe/go-internal@v1.14.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/rogpeppe/go-internal" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/russross/blackfriday/v2", + "version": "v2.1.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "f919b1832f4acc955e4bdff68171f1ca5a978b2403611c42573e798e678e5933" + } + ], + "purl": "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/russross/blackfriday/v2/@v/v2.1.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2020-10-27 03:47:54 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/russross/blackfriday/v2@v2.1.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/russross/blackfriday/v2" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/ryanuber/go-glob", + "version": "v1.0.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "f34eddd5649d9c1d17449cca36297d3a6ea5729ff76b4bf8a881f1217cd7fd87" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2014 Ryan Uber\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/ryanuber/go-glob@v1.0.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/ryanuber/go-glob@v1.0.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/ryanuber/go-glob/@v/v1.0.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2019-01-24 19:22:32 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/ryanuber/go-glob@v1.0.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/ryanuber/go-glob" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/sagikazarmark/locafero", + "version": "v0.11.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "9d5206be0cb3c39f7949449413ab6f0a9dd8613787b35e4cbe5994f3b5b02229" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2023 Márk Sági-Kazár \n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is furnished\nto do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sagikazarmark/locafero/@v/v0.11.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-09-08 16:42:20 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sagikazarmark/locafero@v0.11.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sagikazarmark/locafero" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/sassoftware/relic", + "version": "v7.2.1+incompatible", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "0967c0c6fef7fe22d9d7badbca1204ab72bd86ce70e85a4d31d513fffa91fb39" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sassoftware/relic@v7.2.1%2Bincompatible", + "type": "library", + "bom-ref": "pkg:golang/github.com/sassoftware/relic@v7.2.1+incompatible", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sassoftware/relic/@v/v7.2.1+incompatible.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2019-07-31 17:49:13 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sassoftware/relic@v7.2.1+incompatible" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sassoftware/relic" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/secure-systems-lab/go-securesystemslib", + "version": "v0.11.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "f8f30e4e3506c078f6bdc67e4c52a56f5b5745badd584d4b6034f98bd242f344" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2021 NYU Secure Systems Lab\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/secure-systems-lab/go-securesystemslib/@v/v0.11.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-22 18:48:08 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/secure-systems-lab/go-securesystemslib@v0.11.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/secure-systems-lab/go-securesystemslib" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "26" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "6" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "16" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "4" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 290 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 312 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 317 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 319 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 322 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 326 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 48 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "attachAttestation", + "line": 115, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "attachAttestation", + "line": 112, + "column": 73, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "attachAttestation", + "line": 99, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "attachAttestation", + "line": 111, + "column": 6, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "method", + "function": "Exec", + "line": 68, + "column": 15, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/verify", + "module": "function", + "function": "AssembleNewBundle", + "line": 77, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/verify", + "module": "function", + "function": "AssembleNewBundle", + "line": 60, + "column": 53, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/verify", + "module": "function", + "function": "AssembleNewBundle", + "line": 59, + "column": 28, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/shibumi/go-pathspec", + "version": "v1.3.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "5eeb5fb25a7cd7b976235719be071f78c4091b9427536961e6d55a68c0a5de31" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/shibumi/go-pathspec@v1.3.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/shibumi/go-pathspec@v1.3.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/shibumi/go-pathspec/@v/v1.3.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.17" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2021-10-17 22:38:10 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/shibumi/go-pathspec@v1.3.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/shibumi/go-pathspec" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.17" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/sigstore/protobuf-specs", + "version": "v0.5.1", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "0d1073a45b84f8b9ef40c375d3f754ea705e2b054b18443aa36168bcdd916adb" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sigstore/protobuf-specs@v0.5.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/sigstore/protobuf-specs@v0.5.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sigstore/protobuf-specs/@v/v0.5.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-06 19:58:18 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sigstore/protobuf-specs@v0.5.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sigstore/protobuf-specs" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "229" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "22" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "36" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "171" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 210 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 212 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 222 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 225 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 256 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 257 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 261 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 265 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 271 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 453 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 455 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 456 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 465 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 466 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 467 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 470 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 473 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 477 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 478 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 480 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 483 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 484 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 486 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 487 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 488 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 490 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 493 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 515 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 520 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 521 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 526 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 527 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 530 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 542 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 543 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 545 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 546 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 548 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 550 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 568 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 569 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 573 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 575 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 576 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 577 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 580 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 583 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 584 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 585 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 592 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 594 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 596 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 597 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 599 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 312 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 336 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 368 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 383 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 390 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 418 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 420 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 506 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 512 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 513 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 524 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 525 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 526 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 527 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 528 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 530 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 533 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 534 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 551 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 573 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 575 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 576 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 577 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 578 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 631 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 645 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 664 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 666 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 668 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 251 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 257 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 263 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 276 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 281 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 282 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 285 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1813 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1953 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1957 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2039 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2047 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 86 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attest", + "module": "method", + "function": "Exec", + "line": 223, + "column": 58, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attest", + "module": "method", + "function": "Exec", + "line": 204, + "column": 87, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attest", + "module": "method", + "function": "Exec", + "line": 165, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attest", + "module": "method", + "function": "Exec", + "line": 170, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTlogEntrySummary", + "line": 456, + "column": 31, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "upgradeBundle", + "line": 77, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateContentSummary", + "line": 584, + "column": 16, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTlogEntrySummary", + "line": 515, + "column": 79, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/sigstore/rekor-tiles/v2", + "version": "v2.3.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "0c4162292c90e2717be5045535d38f6881f7726bcc90ed81eb10d98cd62780f7" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sigstore/rekor-tiles/v2@v2.3.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/sigstore/rekor-tiles/v2@v2.3.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sigstore/rekor-tiles/v2/@v/v2.3.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.8" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-10 00:18:11 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sigstore/rekor-tiles/v2@v2.3.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sigstore/rekor-tiles/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.8" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "2" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 414 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/trustedroot", + "module": "function", + "function": "getCheckpointID", + "line": 414, + "column": 16, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/sigstore/rekor", + "version": "v1.5.3", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "87718ae5d0ea09c589259509c1da4a1924a6115d861233d48c9cb75938c1c330" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sigstore/rekor@v1.5.3", + "type": "library", + "bom-ref": "pkg:golang/github.com/sigstore/rekor@v1.5.3", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sigstore/rekor/@v/v1.5.3.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-07-01 21:50:32 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sigstore/rekor@v1.5.3" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sigstore/rekor" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "232" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "29" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "184" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "19" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 492 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 493 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 494 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 495 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 497 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 498 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 499 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 504 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 505 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 506 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/rekor/rekor.go", + "line": 18 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/rekor/rekor.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/rekor/rekor.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/rekor/mock/mock_rekor_client.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 179 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 194 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 196 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 251 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 268 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 275 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 276 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 277 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 279 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 286 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 293 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 295 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 296 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 300 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 305 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 306 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 322 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 325 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 334 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 339 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 340 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 342 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 351 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 358 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 362 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 375 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 376 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 377 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 378 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 392 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1536 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1541 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1551 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1552 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1553 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1554 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1555 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1556 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1557 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1558 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1559 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1560 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1574 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1575 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1578 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1579 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1580 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1581 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1582 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1585 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1586 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1587 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1601 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1602 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1605 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1606 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1607 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1608 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1609 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1610 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1611 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1614 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1615 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1616 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 616 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 625 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 879 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTlogEntrySummary", + "line": 492, + "column": 11, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTlogEntrySummary", + "line": 493, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTlogEntrySummary", + "line": 494, + "column": 39, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "upgradeBundle", + "line": 127, + "column": 4, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "upgradeBundle", + "line": 135, + "column": 108, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTlogEntrySummary", + "line": 506, + "column": 26, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTlogEntrySummary", + "line": 504, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTlogEntrySummary", + "line": 497, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/sigstore/sigstore-go", + "version": "v1.2.2", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "308170071007243fbf94a819cedf67ff8661abfdd3dbe12e197f221ab22c6605" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sigstore/sigstore-go@v1.2.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/sigstore/sigstore-go@v1.2.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sigstore/sigstore-go/@v/v1.2.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.8" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-07-06 16:53:09 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sigstore/sigstore-go@v1.2.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sigstore/sigstore-go" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.8" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "307" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "37" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "129" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "141" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 607 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 608 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 609 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 610 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 612 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 614 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 626 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 628 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 637 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 639 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download/attestation.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/key.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 284 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 303 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 377 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 415 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 416 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 374 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 393 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 453 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 465 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 604 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 606 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 613 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 615 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 622 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 623 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 625 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 630 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 636 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 637 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 639 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 644 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 650 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 651 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 198 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 209 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 212 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 222 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 244 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 259 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 261 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 265 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 269 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 271 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 273 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 207 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 249 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 257 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 261 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 288 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 298 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 321 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 322 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 323 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 325 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 327 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 353 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 474 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 527 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 568 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_attestation.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 211 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 219 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 229 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 244 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 249 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 227 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 230 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 362 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 366 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tuf.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1340 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1344 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1453 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1463 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1754 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1805 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1818 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1824 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1935 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1946 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1948 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 2025 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 204 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 216 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 217 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 231 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 243 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 249 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 253 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 255 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 261 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 266 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 272 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 274 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 279 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 285 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 397 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 435 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_bundle.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/write.go", + "line": 400 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/conformance", + "module": "function", + "function": "main", + "line": 105, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/conformance", + "module": "function", + "function": "main", + "line": 109, + "column": 15, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/conformance/main.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "attachAttestationNewBundle", + "line": 71, + "column": 19, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "AttestationCmd", + "line": 57, + "column": 13, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "SignatureCmd", + "line": 51, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/sig.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "attachAttestationNewBundle", + "line": 78, + "column": 20, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attach", + "module": "function", + "function": "attachAttestationNewBundle", + "line": 85, + "column": 22, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "findFulcioURL", + "line": 609, + "column": 26, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/sigstore/sigstore", + "version": "v1.10.8", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "7fdf81ff889a6229af524c92c9bda6bdcef79f744ba8d9f6e20ac764cfc44fc3" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sigstore/sigstore@v1.10.8", + "type": "library", + "bom-ref": "pkg:golang/github.com/sigstore/sigstore@v1.10.8", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sigstore/sigstore/@v/v1.10.8.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-29 20:29:54 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sigstore/sigstore@v1.10.8" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sigstore/sigstore" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "255" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "64" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "122" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "69" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize/init.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/key.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/publickey/public_key.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 244 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 416 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 238 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 244 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 249 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 277 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 281 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 284 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 307 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 334 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 345 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 418 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 423 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 562 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go", + "line": 565 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go", + "line": 395 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 234 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 271 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 279 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 288 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 291 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 294 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 296 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 297 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 300 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 301 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 305 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 306 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 309 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 310 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 314 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 315 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 319 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 320 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 324 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 325 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 327 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 330 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 331 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 333 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 365 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 380 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 299 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 300 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 301 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 254 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 267 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 370 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 380 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 185 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 165 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 181 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 186 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 230 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 267 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 299 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 309 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 318 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/obsolete.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/obsolete.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pivkey/disabled.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/disabled.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/remote/remote.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 396 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 409 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1000 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1058 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1064 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1367 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 322 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 343 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 373 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 385 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 450 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 454 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 474 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 986 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 992 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 998 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 236 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 240 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 95 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attest", + "module": "method", + "function": "Exec", + "line": 116, + "column": 22, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attest", + "module": "method", + "function": "Exec", + "line": 226, + "column": 21, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "method", + "function": "Exec", + "line": 88, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "method", + "function": "Exec", + "line": 71, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/generate", + "module": "function", + "function": "GenerateKeyPairCmd", + "line": 55, + "column": 35, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/generate", + "module": "function", + "function": "GenerateKeyPairCmd", + "line": 59, + "column": 20, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/generate", + "module": "function", + "function": "GenerateCmd", + "line": 47, + "column": 15, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/generate", + "module": "function", + "function": "GenerateKeyPairCmd", + "line": 55, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/sigstore/sigstore/pkg/signature/kms/aws", + "version": "v1.10.8", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "ef701f244f07eb0e4a18214f06ee31fce1be8b56318268742ff16d57ba6b77cf" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/aws@v1.10.8", + "type": "library", + "bom-ref": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/aws@v1.10.8", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sigstore/sigstore/pkg/signature/kms/aws/@v/v1.10.8.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-29 20:29:54 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sigstore/sigstore/pkg/signature/kms/aws@v1.10.8" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sigstore/sigstore/pkg/signature/kms/aws" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "blank" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "1" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 30 + } + ] + } + }, + { + "group": "", + "name": "github.com/sigstore/sigstore/pkg/signature/kms/azure", + "version": "v1.10.8", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "6224e902cc68597845f4a94b39558287b05c90de5c60ef17d355ae7c3ab589da" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/azure@v1.10.8", + "type": "library", + "bom-ref": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/azure@v1.10.8", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sigstore/sigstore/pkg/signature/kms/azure/@v/v1.10.8.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-29 20:29:54 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sigstore/sigstore/pkg/signature/kms/azure@v1.10.8" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sigstore/sigstore/pkg/signature/kms/azure" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "blank" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "1" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 31 + } + ] + } + }, + { + "group": "", + "name": "github.com/sigstore/sigstore/pkg/signature/kms/gcp", + "version": "v1.10.8", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "6e701412414d6a6e924ef915661a6d5705b3591e694b6e0212d43e961c6eed2d" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/gcp@v1.10.8", + "type": "library", + "bom-ref": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/gcp@v1.10.8", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sigstore/sigstore/pkg/signature/kms/gcp/@v/v1.10.8.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-29 20:29:54 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sigstore/sigstore/pkg/signature/kms/gcp@v1.10.8" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sigstore/sigstore/pkg/signature/kms/gcp" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "blank" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "1" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 32 + } + ] + } + }, + { + "group": "", + "name": "github.com/sigstore/sigstore/pkg/signature/kms/hashivault", + "version": "v1.10.8", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "e880c5869831b73a9b9f3ac59327a06e3ed17d6c0a791adbdfffb1003d56a7e6" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/hashivault@v1.10.8", + "type": "library", + "bom-ref": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/hashivault@v1.10.8", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sigstore/sigstore/pkg/signature/kms/hashivault/@v/v1.10.8.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-29 20:29:54 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sigstore/sigstore/pkg/signature/kms/hashivault@v1.10.8" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sigstore/sigstore/pkg/signature/kms/hashivault" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "blank" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "1" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 33 + } + ] + } + }, + { + "group": "", + "name": "github.com/sigstore/timestamp-authority/v2", + "version": "v2.1.2", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "a3aac055971e1727a30a5223fee4ad44d21e98fd7a6d5319b5b326864ea9af45" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sigstore/timestamp-authority/v2@v2.1.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/sigstore/timestamp-authority/v2@v2.1.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sigstore/timestamp-authority/v2/@v/v2.1.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-02 21:12:45 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sigstore/timestamp-authority/v2@v2.1.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sigstore/timestamp-authority/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "5" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1466 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1467 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 78 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/internal/pkg/cosign/tsa/mock", + "module": "function", + "function": "NewTSAClient", + "line": 65, + "column": 20, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "VerifyRFC3161Timestamp", + "line": 1467, + "column": 3, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "VerifyRFC3161Timestamp", + "line": 1466, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/sirupsen/logrus", + "version": "v1.9.4", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "7ed59cf5674e7c9d1af769ec1368c5e6ee59c07f01bf6cdd78e0b8d918db5768" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2014 Simon Eskildsen\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sirupsen/logrus@v1.9.4", + "type": "library", + "bom-ref": "pkg:golang/github.com/sirupsen/logrus@v1.9.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sirupsen/logrus/@v/v1.9.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.17" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-10-23 12:47:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sirupsen/logrus@v1.9.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sirupsen/logrus" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.17" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/sourcegraph/conc", + "version": "v0.3.1-0.20240121214520-5f936abd7ae8", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "de7d42c1aab5135ff5961421b512b6b6cfd9c191218dc41e250d51b82e90ffc5" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2023 Sourcegraph\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", + "type": "library", + "bom-ref": "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/sourcegraph/conc/@v/v0.3.1-0.20240121214520-5f936abd7ae8.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.20" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-01-21 21:45:20 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/sourcegraph/conc" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.20" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/spf13/afero", + "version": "v1.15.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "342d81c94571b50b386f7b085298712b4362a199e6c60c82adfcdebaaf25c4c8" + } + ], + "purl": "pkg:golang/github.com/spf13/afero@v1.15.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/spf13/afero@v1.15.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/spf13/afero/@v/v1.15.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-09-08 16:25:29 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/spf13/afero@v1.15.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/spf13/afero" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/spf13/cast", + "version": "v1.10.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "8cd7c1f100bd200e99b98d998c3a742ad14ed8b659960e12ffb6f33faaaa787a" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2014 Steve Francia\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/spf13/cast@v1.10.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/spf13/cast@v1.10.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/spf13/cast/@v/v1.10.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.21.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-09-08 16:45:31 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/spf13/cast@v1.10.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/spf13/cast" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.21.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/spf13/cobra", + "version": "v1.10.2", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "ec2d69bc7a87c39038beb25f8cdc2f39dcd8bb41a6975e8e0acd864624d4512e" + } + ], + "purl": "pkg:golang/github.com/spf13/cobra@v1.10.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/spf13/cobra@v1.10.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/spf13/cobra/@v/v1.10.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.15" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-12-03 23:51:15 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/spf13/cobra@v1.10.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/spf13/cobra" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.15" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "839" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "71" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "629" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "139" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attach.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest_blob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/clean.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 113 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/completion.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/completion.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/completion.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/completion.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/completion.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/completion.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/completion.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/completion.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/debug.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/download.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/env.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate_key_pair.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/import_key_pair.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/initialize.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/load.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 18 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/env.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/env.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/env.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate_key_pair.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate_key_pair.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate_key_pair.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/load.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/load.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/load.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/load.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/options.go", + "line": 18 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/reference.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/reference.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/reference.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/rekor.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/rekor.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/rekor.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/save.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/save.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/save.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/save.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/security_key.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/security_key.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/security_key.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 161 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 170 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 148 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 18 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/tree.go", + "line": 17 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/tree.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/tree.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/triangulate.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/triangulate.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 19 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 182 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 193 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 230 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 232 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 237 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 242 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 257 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 293 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 295 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 297 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 299 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 301 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 302 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 306 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 308 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 311 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 314 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 316 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 318 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 320 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 322 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/piv_tool_disabled.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/piv_tool_disabled.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/pkcs11_tool_disabled.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/pkcs11_tool_disabled.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/public_key.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/save.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/tree.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/triangulate.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 23 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/upload.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 160 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 203 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 252 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 270 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 310 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 312 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 355 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 373 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 403 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 405 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 460 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/main.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 48 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 50, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 141, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 44, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 47, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 50, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 53, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 56, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 61, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/spf13/pflag", + "version": "v1.0.10", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "31c5df227251af3e026575593812dbd1b4d9a844e488084cf48c34cb7027d818" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2012 Alex Ogier. All rights reserved.\nCopyright (c) 2012 The Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/spf13/pflag@v1.0.10", + "type": "library", + "bom-ref": "pkg:golang/github.com/spf13/pflag@v1.0.10", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/spf13/pflag/@v/v1.0.10.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.12" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-09-02 06:08:29 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/spf13/pflag@v1.0.10" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/spf13/pflag" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.12" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "387" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "4" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "365" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "18" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/annotations.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attach.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 81 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 147 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest_blob.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/bundle.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 82 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/certificate.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 43 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/download.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/env.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/env.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/files.go", + "line": 54 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/fulcio.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate_key_pair.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/generate_key_pair.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 41 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/import_key_pair.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 38 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/initialize.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/load.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/oidc.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 124 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 136 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 36 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 56 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/piv_tool.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/pkcs11_tool.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 94 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/predicate.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/public_key.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/reference.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/reference.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 221 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 66 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/rekor.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/rekor.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 45 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/save.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/security_key.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/security_key.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 144 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 159 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 161 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 162 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 167 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go", + "line": 98 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signature_digest.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 108 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 110 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 115 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 128 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 134 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 146 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 149 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 158 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 163 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 78 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 87 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 92 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 58 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signingconfig.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/tree.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/tree.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/triangulate.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 107 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 109 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 112 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 114 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 127 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 57 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 62 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 64 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 90 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 93 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 95 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/trustedroot.go", + "line": 99 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 37 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/upload.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 123 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 129 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 143 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 178 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 180 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 184 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 224 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 226 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 230 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 233 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 235 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 239 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 242 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 257 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 293 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 295 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 299 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 302 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 304 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 308 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 311 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 314 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 316 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 320 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 42 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 63 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 67 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/verify.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 80 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/help_flags_printer.go", + "line": 84 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 96 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/templates/templater.go", + "line": 97 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/help/main.go", + "line": 44 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 83, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 87, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/attest.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 71, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/clean.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 43, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 49, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 114, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 122, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/sign.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "method", + "function": "AddFlags", + "line": 123, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/spf13/viper", + "version": "v1.21.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "3f4961b2cc0f1960ffd65649f67cb77d89d5ab189e82b94dac49a02e36d30806" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2014 Steve Francia\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/spf13/viper@v1.21.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/spf13/viper@v1.21.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/spf13/viper/@v/v1.21.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-09-08 16:56:14 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/spf13/viper@v1.21.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/spf13/viper" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "9" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "7" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 60 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 61 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 86 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 88 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go", + "line": 89 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go", + "line": 34 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "function", + "function": "BindViper", + "line": 61, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "function", + "function": "bindFlags", + "line": 86, + "column": 8, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "function", + "function": "bindFlags", + "line": 89, + "column": 11, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "function", + "function": "bindFlags", + "line": 88, + "column": 20, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "function", + "function": "BindViper", + "line": 59, + "column": 7, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/options", + "module": "function", + "function": "BindViper", + "line": 60, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/root.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli", + "module": "function", + "function": "SignBlob", + "line": 34, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signblob.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/spiffe/go-spiffe/v2", + "version": "v2.7.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "e3b43443dfc0a8685af102c7a7e931a47e1671aed7ec49ceb65209cb79b16775" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.7.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.7.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/spiffe/go-spiffe/v2/@v/v2.7.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-03 20:07:47 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/spiffe/go-spiffe/v2@v2.7.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/spiffe/go-spiffe/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "8" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "5" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 65 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go", + "line": 78 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/spiffe", + "module": "method", + "function": "Provide", + "line": 69, + "column": 8, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/spiffe", + "module": "method", + "function": "Provide", + "line": 65, + "column": 38, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/spiffe", + "module": "method", + "function": "Provide", + "line": 71, + "column": 15, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/spiffe", + "module": "method", + "function": "Provide", + "line": 78, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/spiffe", + "module": "method", + "function": "Provide", + "line": 71, + "column": 40, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/spiffe", + "module": "method", + "function": "Provide", + "line": 65, + "column": 17, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/spiffe/spiffe.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/subosito/gotenv", + "version": "v1.6.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "0e4e103f97365b789bcda8c6717a4dada0dfab622b863308bcc4963ca2a8d055" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2013 Alif Rachmawadi\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/subosito/gotenv@v1.6.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/subosito/gotenv@v1.6.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/subosito/gotenv/@v/v1.6.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.18" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-08-15 12:05:45 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/subosito/gotenv@v1.6.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/subosito/gotenv" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.18" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/syndtr/goleveldb", + "version": "v1.0.1-0.20220721030215-126854af5e6d", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "45109825b2300f98e6a8f23d5e800547439c0f1a9472d965eb3523ffe0784b8f" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2012 Suryandaru Triandana \nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above copyright\nnotice, this list of conditions and the following disclaimer in the\ndocumentation and/or other materials provided with the distribution.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nHOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/syndtr/goleveldb@v1.0.1-0.20220721030215-126854af5e6d", + "type": "library", + "bom-ref": "pkg:golang/github.com/syndtr/goleveldb@v1.0.1-0.20220721030215-126854af5e6d", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/syndtr/goleveldb/@v/v1.0.1-0.20220721030215-126854af5e6d.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.14" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2022-07-21 03:02:15 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/syndtr/goleveldb@v1.0.1-0.20220721030215-126854af5e6d" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/syndtr/goleveldb" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.14" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/tchap/go-patricia/v2", + "version": "v2.3.3", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "5594472806f9dc32da1be9c0f44698622684c7a633b700e52c494cb274870f89" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2014 The AUTHORS\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software is furnished to do so,\nsubject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS\nFOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\nCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\nIN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN\nCONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/tchap/go-patricia/v2@v2.3.3", + "type": "library", + "bom-ref": "pkg:golang/github.com/tchap/go-patricia/v2@v2.3.3", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/tchap/go-patricia/v2/@v/v2.3.3.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.16" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-07-01 06:30:56 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/tchap/go-patricia/v2@v2.3.3" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/tchap/go-patricia/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.16" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/theupdateframework/go-tuf", + "version": "v0.7.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "b8407b59263eed922e80ae91d618813018d07ed685ce7ed908325ca75b4252e8" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2014-2020 Prime Directive, Inc. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Prime Directive, Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/theupdateframework/go-tuf@v0.7.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/theupdateframework/go-tuf@v0.7.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/theupdateframework/go-tuf/@v/v0.7.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.20" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-11-28 14:58:45 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/theupdateframework/go-tuf@v0.7.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/theupdateframework/go-tuf" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.20" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/theupdateframework/go-tuf/v2", + "version": "v2.4.2", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "26a06b2149cd2c068dabff0698170430559f00505baa9fcc909109b1e5ca6e4b" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\r\n Version 2.0, January 2004\r\n http://www.apache.org/licenses/\r\n\r\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\r\n\r\n 1. Definitions.\r\n\r\n \"License\" shall mean the terms and conditions for use, reproduction,\r\n and distribution as defined by Sections 1 through 9 of this document.\r\n\r\n \"Licensor\" shall mean the copyright owner or entity authorized by\r\n the copyright owner that is granting the License.\r\n\r\n \"Legal Entity\" shall mean the union of the acting entity and all\r\n other entities that control, are controlled by, or are under common\r\n control with that entity. For the purposes of this definition,\r\n \"control\" means (i) the power, direct or indirect, to cause the\r\n direction or management of such entity, whether by contract or\r\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\r\n outstanding shares, or (iii) beneficial ownership of such entity.\r\n\r\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\r\n exercising permissions granted by this License.\r\n\r\n \"Source\" form shall mean the preferred form for making modifications,\r\n including but not limited to software source code, documentation\r\n source, and configuration files.\r\n\r\n \"Object\" form shall mean any form resulting from mechanical\r\n transformation or translation of a Source form, including but\r\n not limited to compiled object code, generated documentation,\r\n and conversions to other media types.\r\n\r\n \"Work\" shall mean the work of authorship, whether in Source or\r\n Object form, made available under the License, as indicated by a\r\n copyright notice that is included in or attached to the work\r\n (an example is provided in the Appendix below).\r\n\r\n \"Derivative Works\" shall mean any work, whether in Source or Object\r\n form, that is based on (or derived from) the Work and for which the\r\n editorial revisions, annotations, elaborations, or other modifications\r\n represent, as a whole, an original work of authorship. For the purposes\r\n of this License, Derivative Works shall not include works that remain\r\n separable from, or merely link (or bind by name) to the interfaces of,\r\n the Work and Derivative Works thereof.\r\n\r\n \"Contribution\" shall mean any work of authorship, including\r\n the original version of the Work and any modifications or additions\r\n to that Work or Derivative Works thereof, that is intentionally\r\n submitted to Licensor for inclusion in the Work by the copyright owner\r\n or by an individual or Legal Entity authorized to submit on behalf of\r\n the copyright owner. For the purposes of this definition, \"submitted\"\r\n means any form of electronic, verbal, or written communication sent\r\n to the Licensor or its representatives, including but not limited to\r\n communication on electronic mailing lists, source code control systems,\r\n and issue tracking systems that are managed by, or on behalf of, the\r\n Licensor for the purpose of discussing and improving the Work, but\r\n excluding communication that is conspicuously marked or otherwise\r\n designated in writing by the copyright owner as \"Not a Contribution.\"\r\n\r\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\r\n on behalf of whom a Contribution has been received by Licensor and\r\n subsequently incorporated within the Work.\r\n\r\n 2. Grant of Copyright License. Subject to the terms and conditions of\r\n this License, each Contributor hereby grants to You a perpetual,\r\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\r\n copyright license to reproduce, prepare Derivative Works of,\r\n publicly display, publicly perform, sublicense, and distribute the\r\n Work and such Derivative Works in Source or Object form.\r\n\r\n 3. Grant of Patent License. Subject to the terms and conditions of\r\n this License, each Contributor hereby grants to You a perpetual,\r\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\r\n (except as stated in this section) patent license to make, have made,\r\n use, offer to sell, sell, import, and otherwise transfer the Work,\r\n where such license applies only to those patent claims licensable\r\n by such Contributor that are necessarily infringed by their\r\n Contribution(s) alone or by combination of their Contribution(s)\r\n with the Work to which such Contribution(s) was submitted. If You\r\n institute patent litigation against any entity (including a\r\n cross-claim or counterclaim in a lawsuit) alleging that the Work\r\n or a Contribution incorporated within the Work constitutes direct\r\n or contributory patent infringement, then any patent licenses\r\n granted to You under this License for that Work shall terminate\r\n as of the date such litigation is filed.\r\n\r\n 4. Redistribution. You may reproduce and distribute copies of the\r\n Work or Derivative Works thereof in any medium, with or without\r\n modifications, and in Source or Object form, provided that You\r\n meet the following conditions:\r\n\r\n (a) You must give any other recipients of the Work or\r\n Derivative Works a copy of this License; and\r\n\r\n (b) You must cause any modified files to carry prominent notices\r\n stating that You changed the files; and\r\n\r\n (c) You must retain, in the Source form of any Derivative Works\r\n that You distribute, all copyright, patent, trademark, and\r\n attribution notices from the Source form of the Work,\r\n excluding those notices that do not pertain to any part of\r\n the Derivative Works; and\r\n\r\n (d) If the Work includes a \"NOTICE\" text file as part of its\r\n distribution, then any Derivative Works that You distribute must\r\n include a readable copy of the attribution notices contained\r\n within such NOTICE file, excluding those notices that do not\r\n pertain to any part of the Derivative Works, in at least one\r\n of the following places: within a NOTICE text file distributed\r\n as part of the Derivative Works; within the Source form or\r\n documentation, if provided along with the Derivative Works; or,\r\n within a display generated by the Derivative Works, if and\r\n wherever such third-party notices normally appear. The contents\r\n of the NOTICE file are for informational purposes only and\r\n do not modify the License. You may add Your own attribution\r\n notices within Derivative Works that You distribute, alongside\r\n or as an addendum to the NOTICE text from the Work, provided\r\n that such additional attribution notices cannot be construed\r\n as modifying the License.\r\n\r\n You may add Your own copyright statement to Your modifications and\r\n may provide additional or different license terms and conditions\r\n for use, reproduction, or distribution of Your modifications, or\r\n for any such Derivative Works as a whole, provided Your use,\r\n reproduction, and distribution of the Work otherwise complies with\r\n the conditions stated in this License.\r\n\r\n 5. Submission of Contributions. Unless You explicitly state otherwise,\r\n any Contribution intentionally submitted for inclusion in the Work\r\n by You to the Licensor shall be under the terms and conditions of\r\n this License, without any additional terms or conditions.\r\n Notwithstanding the above, nothing herein shall supersede or modify\r\n the terms of any separate license agreement you may have executed\r\n with Licensor regarding such Contributions.\r\n\r\n 6. Trademarks. This License does not grant permission to use the trade\r\n names, trademarks, service marks, or product names of the Licensor,\r\n except as required for reasonable and customary use in describing the\r\n origin of the Work and reproducing the content of the NOTICE file.\r\n\r\n 7. Disclaimer of Warranty. Unless required by applicable law or\r\n agreed to in writing, Licensor provides the Work (and each\r\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\r\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\r\n implied, including, without limitation, any warranties or conditions\r\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\r\n PARTICULAR PURPOSE. You are solely responsible for determining the\r\n appropriateness of using or redistributing the Work and assume any\r\n risks associated with Your exercise of permissions under this License.\r\n\r\n 8. Limitation of Liability. In no event and under no legal theory,\r\n whether in tort (including negligence), contract, or otherwise,\r\n unless required by applicable law (such as deliberate and grossly\r\n negligent acts) or agreed to in writing, shall any Contributor be\r\n liable to You for damages, including any direct, indirect, special,\r\n incidental, or consequential damages of any character arising as a\r\n result of this License or out of the use or inability to use the\r\n Work (including but not limited to damages for loss of goodwill,\r\n work stoppage, computer failure or malfunction, or any and all\r\n other commercial damages or losses), even if such Contributor\r\n has been advised of the possibility of such damages.\r\n\r\n 9. Accepting Warranty or Additional Liability. While redistributing\r\n the Work or Derivative Works thereof, You may choose to offer,\r\n and charge a fee for, acceptance of support, warranty, indemnity,\r\n or other liability obligations and/or rights consistent with this\r\n License. However, in accepting such obligations, You may act only\r\n on Your own behalf and on Your sole responsibility, not on behalf\r\n of any other Contributor, and only if You agree to indemnify,\r\n defend, and hold each Contributor harmless for any liability\r\n incurred by, or claims asserted against, such Contributor by reason\r\n of your accepting any such warranty or additional liability.\r\n\r\n END OF TERMS AND CONDITIONS\r\n\r\n APPENDIX: How to apply the Apache License to your work.\r\n\r\n To apply the Apache License to your work, attach the following\r\n boilerplate notice, with the fields enclosed by brackets \"[]\"\r\n replaced with your own identifying information. (Don't include\r\n the brackets!) The text should be enclosed in the appropriate\r\n comment syntax for the file format. We also recommend that a\r\n file or class name and description of purpose be included on the\r\n same \"printed page\" as the copyright notice for easier\r\n identification within third-party archives.\r\n\r\n Copyright 2024 The Update Framework Authors\r\n\r\n Licensed under the Apache License, Version 2.0 (the \"License\");\r\n you may not use this file except in compliance with the License.\r\n You may obtain a copy of the License at\r\n\r\n http://www.apache.org/licenses/LICENSE-2.0\r\n\r\n Unless required by applicable law or agreed to in writing, software\r\n distributed under the License is distributed on an \"AS IS\" BASIS,\r\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r\n See the License for the specific language governing permissions and\r\n limitations under the License." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.4.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.4.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/theupdateframework/go-tuf/v2/@v/v2.4.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-19 08:44:09 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/theupdateframework/go-tuf/v2@v2.4.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,NOTICE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/theupdateframework/go-tuf/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "framework" + ] + }, + { + "group": "", + "name": "github.com/tink-crypto/tink-go-awskms/v3", + "version": "v3.0.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "fbb317b1284bcd56d243a748d0f7b826e64ce768c3d634358ad03281dfcc0ec0" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/tink-crypto/tink-go-awskms/v3@v3.0.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/tink-crypto/tink-go-awskms/v3@v3.0.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/tink-crypto/tink-go-awskms/v3/@v/v3.0.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-03-30 13:00:56 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/tink-crypto/tink-go-awskms/v3@v3.0.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/tink-crypto/tink-go-awskms/v3" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "crypto" + ] + }, + { + "group": "", + "name": "github.com/tink-crypto/tink-go-gcpkms/v2", + "version": "v2.2.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "8d8e5837606a0ff29208733d4aa64f22924d1bfbb7cf07cb5c7830b38c76211c" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/tink-crypto/tink-go-gcpkms/v2@v2.2.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/tink-crypto/tink-go-gcpkms/v2@v2.2.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/tink-crypto/tink-go-gcpkms/v2/@v/v2.2.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.21" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-05-10 15:17:17 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/tink-crypto/tink-go-gcpkms/v2@v2.2.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/tink-crypto/tink-go-gcpkms/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.21" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "crypto" + ] + }, + { + "group": "", + "name": "github.com/tink-crypto/tink-go-hcvault/v2", + "version": "v2.5.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "dd185cc40a9e93ac549511662627ef5380982d937ad0a3107482aaa59019246d" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/tink-crypto/tink-go-hcvault/v2@v2.5.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/tink-crypto/tink-go-hcvault/v2@v2.5.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/tink-crypto/tink-go-hcvault/v2/@v/v2.5.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-14 14:15:58 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/tink-crypto/tink-go-hcvault/v2@v2.5.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/tink-crypto/tink-go-hcvault/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "crypto" + ] + }, + { + "group": "", + "name": "github.com/tink-crypto/tink-go/v2", + "version": "v2.6.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "d966c103aa5f36c01f0700c28206e8687781d97dbdc2453c5c7b46c21d98224f" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/tink-crypto/tink-go/v2@v2.6.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/tink-crypto/tink-go/v2@v2.6.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/tink-crypto/tink-go/v2/@v/v2.6.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-12-10 09:57:10 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/tink-crypto/tink-go/v2@v2.6.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/tink-crypto/tink-go/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "crypto" + ] + }, + { + "group": "", + "name": "github.com/titanous/rocacheck", + "version": "v0.0.0-20171023193734-afe73141d399", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "2ddc074cd253f7d0b97d30330f3d2e777dbc3a05f3fa089eaf271b708c767d1b" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2017, Jonathan Rudenberg\nCopyright (c) 2017, CRoCS, EnigmaBridge Ltd.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/titanous/rocacheck@v0.0.0-20171023193734-afe73141d399", + "type": "library", + "bom-ref": "pkg:golang/github.com/titanous/rocacheck@v0.0.0-20171023193734-afe73141d399", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/titanous/rocacheck/@v/v0.0.0-20171023193734-afe73141d399.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2017-10-23 19:37:34 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/titanous/rocacheck@v0.0.0-20171023193734-afe73141d399" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/titanous/rocacheck" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/tjfoc/gmsm", + "version": "v1.4.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "8f820d3e41d632b8496f7f06f89e96e13c3401bb8df1386edcf6dd5588557131" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/tjfoc/gmsm@v1.4.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/tjfoc/gmsm@v1.4.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/tjfoc/gmsm/@v/v1.4.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.14" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2021-07-09 03:07:47 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/tjfoc/gmsm@v1.4.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/tjfoc/gmsm" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.14" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/transparency-dev/formats", + "version": "v0.1.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "aad67c82846e27c153046f5cf7e063d2b9f6ad41bb786fc051392bf80c378c5c" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/transparency-dev/formats@v0.1.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/transparency-dev/formats@v0.1.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/transparency-dev/formats/@v/v0.1.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-02 14:27:22 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/transparency-dev/formats@v0.1.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/transparency-dev/formats" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/transparency-dev/merkle", + "version": "v0.0.2", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "a6a4b2f8e5de7d0d440d4566009f0c5211c1f535c6bb35404f9f0fa81a07cf50" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/transparency-dev/merkle@v0.0.2", + "type": "library", + "bom-ref": "pkg:golang/github.com/transparency-dev/merkle@v0.0.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/transparency-dev/merkle/@v/v0.0.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.19" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-05-05 09:59:12 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/transparency-dev/merkle@v0.0.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/transparency-dev/merkle" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.19" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "8" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "3" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "3" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 213 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 348 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 351 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go", + "line": 50 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "VerifyTLogEntryOffline", + "line": 351, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "ComputeLeafHash", + "line": 213, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "VerifyTLogEntryOffline", + "line": 348, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "VerifyTLogEntryOffline", + "line": 351, + "column": 34, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/valyala/fastjson", + "version": "v1.6.10", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "7ba16e6e6428b9434fef78ed30b99c6f14bac9d588a4e7e1cf7e1349f3b725a1" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2018 Aliaksandr Valialkin\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/valyala/fastjson@v1.6.10", + "type": "library", + "bom-ref": "pkg:golang/github.com/valyala/fastjson@v1.6.10", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/valyala/fastjson/@v/v1.6.10.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-02-21 12:15:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/valyala/fastjson@v1.6.10" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/valyala/fastjson" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/vektah/gqlparser/v2", + "version": "v2.5.33", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "735236f2048e54dce57dce16b8396a53bbe8427b2a23a386d9a9a404016682db" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2018 Adam Scarr\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/vektah/gqlparser/v2@v2.5.33", + "type": "library", + "bom-ref": "pkg:golang/github.com/vektah/gqlparser/v2@v2.5.33", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/vektah/gqlparser/v2/@v/v2.5.33.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.22" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-24 22:07:24 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/vektah/gqlparser/v2@v2.5.33" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/vektah/gqlparser/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.22" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "parse" + ] + }, + { + "group": "", + "name": "github.com/withfig/autocomplete-tools/integrations/cobra", + "version": "v1.2.1", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "9e6bb24a86d96f8905805cba069b695e9fc1070fb1152caf54f3fa6aea090789" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2022 Hercules Labs Inc. (Fig)\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/withfig/autocomplete-tools/integrations/cobra@v1.2.1", + "type": "library", + "bom-ref": "pkg:golang/github.com/withfig/autocomplete-tools/integrations/cobra@v1.2.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/withfig/autocomplete-tools/integrations/cobra/@v/v1.2.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.17" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2022-08-18 08:45:12 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/withfig/autocomplete-tools/integrations/cobra@v1.2.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/withfig/autocomplete-tools/integrations/cobra" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.17" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "2" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 131 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 28 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli", + "module": "function", + "function": "New", + "line": 131, + "column": 17, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go" + } + ] + } + } + }, + { + "group": "", + "name": "github.com/x448/float16", + "version": "v0.8.4", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "d780962180b2640fdc5a35ce8a8784a4778dffcdcc75b6434501e815c62c39f8" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "MIT License\n\nCopyright (c) 2019 Montgomery Edwards⁴⁴⁸ and Faye Amacker\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/x448/float16@v0.8.4", + "type": "library", + "bom-ref": "pkg:golang/github.com/x448/float16@v0.8.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/x448/float16/@v/v0.8.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.11" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2020-01-17 18:31:28 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/x448/float16@v0.8.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/x448/float16" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.11" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/xeipuuv/gojsonpointer", + "version": "v0.0.0-20190905194746-02993c407bfb", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "376cf1952ca22927b9797d6d6558911f9400d2a8a3a840eb61988f1008aadf05" + } + ], + "purl": "pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20190905194746-02993c407bfb", + "type": "library", + "bom-ref": "pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20190905194746-02993c407bfb", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/xeipuuv/gojsonpointer/@v/v0.0.0-20190905194746-02993c407bfb.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2019-09-05 19:47:46 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/xeipuuv/gojsonpointer@v0.0.0-20190905194746-02993c407bfb" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/xeipuuv/gojsonpointer" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/xeipuuv/gojsonreference", + "version": "v0.0.0-20180127040603-bd5ef7bd5415", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "1b0ae316625c170e80b7f1aceb3e328e2230cee275ffe5302f13100d54174a14" + } + ], + "purl": "pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", + "type": "library", + "bom-ref": "pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/xeipuuv/gojsonreference/@v/v0.0.0-20180127040603-bd5ef7bd5415.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2018-01-27 04:06:03 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/xeipuuv/gojsonreference" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/yashtewari/glob-intersection", + "version": "v0.2.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "2caee9202de98948e8bdec629016c9dba62697b83cc5ae5bb237f1dafd5fc289" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/yashtewari/glob-intersection@v0.2.0", + "type": "library", + "bom-ref": "pkg:golang/github.com/yashtewari/glob-intersection@v0.2.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/yashtewari/glob-intersection/@v/v0.2.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.17" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-06-22 20:17:32 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/yashtewari/glob-intersection@v0.2.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/yashtewari/glob-intersection" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.17" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "github.com/youmark/pkcs8", + "version": "v0.0.0-20240726163527-a2c0da244d78", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "68bf300827d37d27e65e3ce714149934dd77ad2263948388d5f50d02d17bae62" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2014 youmark\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", + "type": "library", + "bom-ref": "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/github.com/youmark/pkcs8/@v/v0.0.0-20240726163527-a2c0da244d78.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.17" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2024-07-26 16:35:27 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "github.com/youmark/pkcs8" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.17" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "gitlab.com/gitlab-org/api/client-go", + "version": "v1.46.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "16d83253a8361d2e7e7cc870ea72caf7a181104071e4cce7b4e88959f21a88df" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/gitlab.com/gitlab-org/api/client-go@v1.46.0", + "type": "library", + "bom-ref": "pkg:golang/gitlab.com/gitlab-org/api/client-go@v1.46.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/gitlab.com/gitlab-org/api/client-go/@v/v1.46.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-03-01 22:20:17 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/gitlab.com/gitlab-org/api/client-go@v1.46.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,license.go" + }, + { + "name": "cdx:golem:modulePath", + "value": "gitlab.com/gitlab-org/api/client-go" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "constant" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "75" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "48" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "26" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 100 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 103 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 104 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 117 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 119 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 122 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 139 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 141 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 142 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 152 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 153 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 154 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 155 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 156 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 157 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 172 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 175 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 176 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 189 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 190 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 192 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 220 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 223 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 228 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 242 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 250 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 252 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 260 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 71 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 73 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go", + "line": 78 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/gitlab", + "module": "method", + "function": "PutSecret", + "line": 116, + "column": 27, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/gitlab", + "module": "method", + "function": "PutSecret", + "line": 119, + "column": 33, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/gitlab", + "module": "method", + "function": "PutSecret", + "line": 100, + "column": 27, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/gitlab", + "module": "method", + "function": "GetSecret", + "line": 252, + "column": 28, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/gitlab", + "module": "method", + "function": "PutSecret", + "line": 152, + "column": 29, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/gitlab", + "module": "method", + "function": "PutSecret", + "line": 119, + "column": 22, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/gitlab", + "module": "method", + "function": "GetSecret", + "line": 223, + "column": 41, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/gitlab", + "module": "method", + "function": "PutSecret", + "line": 177, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/gitlab/gitlab.go" + } + ] + } + } + }, + { + "group": "", + "name": "go.opentelemetry.io/auto/sdk", + "version": "v1.2.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "2914e3f9a39a12568b8bec16d643bf0d9457c241780b9c4f6c47b766222137b6" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "type": "library", + "bom-ref": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/go.opentelemetry.io/auto/sdk/@v/v1.2.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-09-15 16:53:44 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/go.opentelemetry.io/auto/sdk@v1.2.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "go.opentelemetry.io/auto/sdk" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "telemetry" + ] + }, + { + "group": "", + "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc", + "version": "v0.68.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "4a37b78b732348f29348fbd558268bf2e801cc9c22937bb8b260a351ebaea6a8" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n--------------------------------------------------------------------------------\n\nCopyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.68.0", + "type": "library", + "bom-ref": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.68.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/@v/v0.68.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-07 08:53:54 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.68.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "telemetry" + ] + }, + { + "group": "", + "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp", + "version": "v0.68.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "06e8403d3855f0f04706f83c67367f3a4de274e761588a1dcb0cf6c447116c9a" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n--------------------------------------------------------------------------------\n\nCopyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.68.0", + "type": "library", + "bom-ref": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.68.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/@v/v0.68.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-07 08:53:54 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.68.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "telemetry" + ] + }, + { + "group": "", + "name": "go.opentelemetry.io/otel", + "version": "v1.44.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "04c8234c72fd58f4654632f6a190814cbe308421ad5dc8761f806138f200c987" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n--------------------------------------------------------------------------------\n\nCopyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/go.opentelemetry.io/otel@v1.44.0", + "type": "library", + "bom-ref": "pkg:golang/go.opentelemetry.io/otel@v1.44.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/go.opentelemetry.io/otel/@v/v1.44.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-27 16:42:37 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/go.opentelemetry.io/otel@v1.44.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "go.opentelemetry.io/otel" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "telemetry" + ] + }, + { + "group": "", + "name": "go.opentelemetry.io/otel/metric", + "version": "v1.44.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "f0eee16a710f04d804326c9b0f7b3654129c816382b00eadcc704f383022aaea" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n--------------------------------------------------------------------------------\n\nCopyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/go.opentelemetry.io/otel/metric@v1.44.0", + "type": "library", + "bom-ref": "pkg:golang/go.opentelemetry.io/otel/metric@v1.44.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/go.opentelemetry.io/otel/metric/@v/v1.44.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-27 16:42:37 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/go.opentelemetry.io/otel/metric@v1.44.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "go.opentelemetry.io/otel/metric" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "telemetry" + ] + }, + { + "group": "", + "name": "go.opentelemetry.io/otel/trace", + "version": "v1.44.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "a0b9758eb310015a3abf718082037ed551fd548cfd8944af5b9dec5b543c3c81" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n--------------------------------------------------------------------------------\n\nCopyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE." + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/go.opentelemetry.io/otel/trace@v1.44.0", + "type": "library", + "bom-ref": "pkg:golang/go.opentelemetry.io/otel/trace@v1.44.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/go.opentelemetry.io/otel/trace/@v/v1.44.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-27 16:42:37 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/go.opentelemetry.io/otel/trace@v1.44.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "go.opentelemetry.io/otel/trace" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + }, + "tags": [ + "telemetry" + ] + }, + { + "group": "", + "name": "go.uber.org/multierr", + "version": "v1.11.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "db4f90b622eacb435de8575007d4cb5da835d83b1092b6ecde1b4c15f0cdf346" + } + ], + "purl": "pkg:golang/go.uber.org/multierr@v1.11.0", + "type": "library", + "bom-ref": "pkg:golang/go.uber.org/multierr@v1.11.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/go.uber.org/multierr/@v/v1.11.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.19" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2023-03-29 23:00:37 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/go.uber.org/multierr@v1.11.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "go.uber.org/multierr" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.19" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "go.uber.org/zap", + "version": "v1.28.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "ac32e93a2d7bd6e383366fe6c4572e616c43b2a592015905757e17a2348a83f4" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2016-2024 Uber Technologies, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/go.uber.org/zap@v1.28.0", + "type": "library", + "bom-ref": "pkg:golang/go.uber.org/zap@v1.28.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/go.uber.org/zap/@v/v1.28.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.19" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-28 02:13:09 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/go.uber.org/zap@v1.28.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "go.uber.org/zap" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.19" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "go.yaml.in/yaml/v2", + "version": "v2.4.4", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "80c66a2290ed0ea39f334b8d7f2d12929461bd4af2607d19eb074c61c69c6174" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/go.yaml.in/yaml/v2@v2.4.4", + "type": "library", + "bom-ref": "pkg:golang/go.yaml.in/yaml/v2@v2.4.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/go.yaml.in/yaml/v2/@v/v2.4.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.15" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-03-06 22:01:45 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/go.yaml.in/yaml/v2@v2.4.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "3" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,LICENSE.libyaml,NOTICE" + }, + { + "name": "cdx:golem:modulePath", + "value": "go.yaml.in/yaml/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.15" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "go.yaml.in/yaml/v3", + "version": "v3.0.4", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "0e1cee38e176013cc00ef05a757c6bb9104bcd84e94f7e822af0dbdfe6811058" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\nThis project is covered by two different licenses: MIT and Apache.\n\n#### MIT License ####\n\nThe following files were ported to Go from C files of libyaml, and thus\nare still covered by their original MIT license, with the additional\ncopyright staring in 2011 when the project was ported over:\n\n apic.go emitterc.go parserc.go readerc.go scannerc.go\n writerc.go yamlh.go yamlprivateh.go\n\nCopyright (c) 2006-2010 Kirill Simonov\nCopyright (c) 2006-2011 Kirill Simonov\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies\nof the Software, and to permit persons to whom the Software is furnished to do\nso, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n### Apache License ###\n\nAll the remaining project files are covered by the Apache license:\n\nCopyright (c) 2011-2019 Canonical Ltd\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "type": "library", + "bom-ref": "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/go.yaml.in/yaml/v3/@v/v3.0.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.16" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-06-29 14:09:51 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/go.yaml.in/yaml/v3@v3.0.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,NOTICE" + }, + { + "name": "cdx:golem:modulePath", + "value": "go.yaml.in/yaml/v3" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.16" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "golang.org/x/crypto", + "version": "v0.53.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "0cd2d4e37e0ec156a493d3f3bb057cc3ada6009a5124bdefb2071fa78427b22a" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/golang.org/x/crypto@v0.53.0", + "type": "library", + "bom-ref": "pkg:golang/golang.org/x/crypto@v0.53.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/golang.org/x/crypto/@v/v0.53.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 15:52:49 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/golang.org/x/crypto@v0.53.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "golang.org/x/crypto" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "2" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 29 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/github", + "module": "function", + "function": "encryptSecretWithPublicKey", + "line": 187, + "column": 16, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go" + } + ] + } + }, + "tags": [ + "crypto" + ] + }, + { + "group": "", + "name": "golang.org/x/mod", + "version": "v0.37.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "9bc4bc55e33daf87730f08eb28ed1ad6c64fdd88de31a9914650fe7e647643fd" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/golang.org/x/mod@v0.37.0", + "type": "library", + "bom-ref": "pkg:golang/golang.org/x/mod@v0.37.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/golang.org/x/mod/@v/v0.37.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 15:10:58 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/golang.org/x/mod@v0.37.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "golang.org/x/mod" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "2" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "symbolReference" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "2" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 507 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 508 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTlogEntrySummary", + "line": 508, + "column": 41, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "populateTlogEntrySummary", + "line": 507, + "column": 56, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + } + ] + } + } + }, + { + "group": "", + "name": "golang.org/x/net", + "version": "v0.56.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "0f72aeeabf95e8944ea192b5e380f65df30715c32aff4cd27cb7a555308529e7" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/golang.org/x/net@v0.56.0", + "type": "library", + "bom-ref": "pkg:golang/golang.org/x/net@v0.56.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/golang.org/x/net/@v/v0.56.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-09 16:58:42 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/golang.org/x/net@v0.56.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "golang.org/x/net" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "golang.org/x/oauth2", + "version": "v0.36.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "60305424c4e40e7252f80e013f87990630aab6892483584e0ee3e3c2218f3bb4" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/golang.org/x/oauth2@v0.36.0", + "type": "library", + "bom-ref": "pkg:golang/golang.org/x/oauth2@v0.36.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/golang.org/x/oauth2/@v/v0.36.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-02-11 19:14:10 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/golang.org/x/oauth2@v0.36.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "golang.org/x/oauth2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "8" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "4" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "3" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 49 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go", + "line": 52 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 55 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 83 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 87 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/github", + "module": "method", + "function": "PutSecret", + "line": 52, + "column": 16, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/github", + "module": "method", + "function": "PutSecret", + "line": 49, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/git/github", + "module": "method", + "function": "PutSecret", + "line": 50, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/google", + "module": "method", + "function": "Provide", + "line": 59, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/google", + "module": "method", + "function": "Provide", + "line": 87, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/google", + "module": "method", + "function": "Provide", + "line": 55, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/google", + "module": "method", + "function": "Provide", + "line": 83, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go" + } + ] + } + } + }, + { + "group": "", + "name": "golang.org/x/sync", + "version": "v0.21.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "f71acdc1d2dfc788e429b36f6bd1692fabc437b7af9c4e3734d3494362c5dfed" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/golang.org/x/sync@v0.21.0", + "type": "library", + "bom-ref": "pkg:golang/golang.org/x/sync@v0.21.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/golang.org/x/sync/@v/v0.21.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-04 16:57:53 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/golang.org/x/sync@v0.21.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "golang.org/x/sync" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "15" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "11" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "2" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 106 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 120 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 132 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 68 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 69 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 101 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 102 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 105 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 133 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 168 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 169 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 173 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go", + "line": 34 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/copy", + "module": "function", + "function": "CopyCmd", + "line": 106, + "column": 4, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/copy", + "module": "function", + "function": "CopyCmd", + "line": 120, + "column": 3, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/copy", + "module": "function", + "function": "CopyCmd", + "line": 69, + "column": 2, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/copy", + "module": "function", + "function": "CopyCmd", + "line": 132, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/copy", + "module": "function", + "function": "CopyCmd", + "line": 68, + "column": 13, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "FetchSignatures", + "line": 105, + "column": 3, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "FetchAttestations", + "line": 173, + "column": 3, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "FetchSignatures", + "line": 101, + "column": 8, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go" + } + ] + } + } + }, + { + "group": "", + "name": "golang.org/x/sys", + "version": "v0.46.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "e062f513921487e86d28e50439a89f7e1ac07aacac7d51a2a43633001aa70a6c" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/golang.org/x/sys@v0.46.0", + "type": "library", + "bom-ref": "pkg:golang/golang.org/x/sys@v0.46.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/golang.org/x/sys/@v/v0.46.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-27 14:14:43 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/golang.org/x/sys@v0.46.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "golang.org/x/sys" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "golang.org/x/term", + "version": "v0.44.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "ef37b831dcd4ccb5e9480a053f51f46ce23d6970eabde4af6ad4f9bca7058766" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/golang.org/x/term@v0.44.0", + "type": "library", + "bom-ref": "pkg:golang/golang.org/x/term@v0.44.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/golang.org/x/term/@v/v0.44.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 15:10:55 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/golang.org/x/term@v0.44.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "golang.org/x/term" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "5" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "3" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 116 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/common.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/common.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/common.go", + "line": 43 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/internal/auth", + "module": "function", + "function": "GetOAuthFlow", + "line": 116, + "column": 8, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "GetPassFromTerm", + "line": 32, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/common.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign", + "module": "function", + "function": "GetPassFromTerm", + "line": 43, + "column": 20, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/common.go" + } + ] + } + } + }, + { + "group": "", + "name": "golang.org/x/text", + "version": "v0.38.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "61766ddd084750a613e77af694b2852158ba028d63773ad347f290d3dab2c45e" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/golang.org/x/text@v0.38.0", + "type": "library", + "bom-ref": "pkg:golang/golang.org/x/text@v0.38.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/golang.org/x/text/@v/v0.38.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 15:10:20 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/golang.org/x/text@v0.38.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "golang.org/x/text" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "golang.org/x/time", + "version": "v0.15.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "63860c690997c06419a05695164e18a42b7814b40c60a65ef68795fdfe0c4a7a" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright 2009 The Go Authors.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google LLC nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/golang.org/x/time@v0.15.0", + "type": "library", + "bom-ref": "pkg:golang/golang.org/x/time@v0.15.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/golang.org/x/time/@v/v0.15.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-02-11 19:14:29 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/golang.org/x/time@v0.15.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "golang.org/x/time" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "google.golang.org/api", + "version": "v0.284.0", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "014e387d4f9755938271df2e2da0486bf660ce03dfff4aaa637fa6ee541a69da" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2011 Google Inc. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/google.golang.org/api@v0.284.0", + "type": "library", + "bom-ref": "pkg:golang/google.golang.org/api@v0.284.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/google.golang.org/api/@v/v0.284.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.8" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-09 18:52:31 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/google.golang.org/api@v0.284.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "google.golang.org/api" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.8" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "5" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "2" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 22 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go", + "line": 75 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/google", + "module": "method", + "function": "Provide", + "line": 75, + "column": 44, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/google", + "module": "method", + "function": "Provide", + "line": 51, + "column": 13, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/providers/google", + "module": "method", + "function": "Provide", + "line": 75, + "column": 13, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/google/google.go" + } + ] + } + } + }, + { + "group": "", + "name": "google.golang.org/genproto", + "version": "v0.0.0-20260406210006-6f92a3bedf2d", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "736849d60aed9c7d3152210a1831a48c63532751f2d8badb97228e1c5d2ca913" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/google.golang.org/genproto@v0.0.0-20260406210006-6f92a3bedf2d", + "type": "library", + "bom-ref": "pkg:golang/google.golang.org/genproto@v0.0.0-20260406210006-6f92a3bedf2d", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/google.golang.org/genproto/@v/v0.0.0-20260406210006-6f92a3bedf2d.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-04-06 21:00:06 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/google.golang.org/genproto@v0.0.0-20260406210006-6f92a3bedf2d" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "google.golang.org/genproto" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "google.golang.org/genproto/googleapis/api", + "version": "v0.0.0-20260526163538-3dc84a4a5aaa", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "ab894c652ea4b248d3e47bc23eb9e7ca97033d526a4ff7f89dfc66904ee0af26" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260526163538-3dc84a4a5aaa", + "type": "library", + "bom-ref": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260526163538-3dc84a4a5aaa", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/google.golang.org/genproto/googleapis/api/@v/v0.0.0-20260526163538-3dc84a4a5aaa.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-26 16:35:38 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/google.golang.org/genproto/googleapis/api@v0.0.0-20260526163538-3dc84a4a5aaa" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "google.golang.org/genproto/googleapis/api" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "google.golang.org/genproto/googleapis/rpc", + "version": "v0.0.0-20260526163538-3dc84a4a5aaa", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "e07aa487cc9c7f0d3995dff70562fbac93927de6cbd90f83543791818831514f" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260526163538-3dc84a4a5aaa", + "type": "library", + "bom-ref": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260526163538-3dc84a4a5aaa", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/google.golang.org/genproto/googleapis/rpc/@v/v0.0.0-20260526163538-3dc84a4a5aaa.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-05-26 16:35:38 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260526163538-3dc84a4a5aaa" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "google.golang.org/genproto/googleapis/rpc" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "google.golang.org/grpc", + "version": "v1.82.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "cb34d9d53075677486f8b218688f96884f03e7e3d9dc0ae7ad2a7ccc5dfefd90" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/google.golang.org/grpc@v1.82.0", + "type": "library", + "bom-ref": "pkg:golang/google.golang.org/grpc@v1.82.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/google.golang.org/grpc/@v/v1.82.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.25.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-30 13:47:03 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/google.golang.org/grpc@v1.82.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,NOTICE.txt" + }, + { + "name": "cdx:golem:modulePath", + "value": "google.golang.org/grpc" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.25.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "google.golang.org/protobuf", + "version": "v1.36.12-0.20260120151049-f2248ac996af", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "1d37fe0ab2a7d82de0e52f15226cbab5d714bc2b246b6901ee3db75dfcc3a5ca" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2018 The Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/google.golang.org/protobuf@v1.36.12-0.20260120151049-f2248ac996af", + "type": "library", + "bom-ref": "pkg:golang/google.golang.org/protobuf@v1.36.12-0.20260120151049-f2248ac996af", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/google.golang.org/protobuf/@v/v1.36.12-0.20260120151049-f2248ac996af.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-01-20 15:10:49 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/google.golang.org/protobuf@v1.36.12-0.20260120151049-f2248ac996af" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "google.golang.org/protobuf" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "43" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "13" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "27" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "3" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 166 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 171 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go", + "line": 39 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 145 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 150 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go", + "line": 70 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 164 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 174 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 177 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 313 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 50 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go", + "line": 51 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 140 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign_blob.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify.go", + "line": 297 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 248 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 287 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 291 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 292 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 338 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 34 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 342 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 343 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 402 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 440 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 459 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 515 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 523 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 531 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 59 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/attestation/attestation.go", + "line": 72 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 151 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verifiers.go", + "line": 91 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 1814 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go", + "line": 79 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/signatures.go", + "line": 87 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attest", + "module": "method", + "function": "Exec", + "line": 166, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/attest", + "module": "method", + "function": "Exec", + "line": 171, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/attest/attest_blob.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "upgradeBundle", + "line": 150, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "function", + "function": "upgradeBundle", + "line": 70, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/bundle", + "module": "method", + "function": "Exec", + "line": 145, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/sign", + "module": "function", + "function": "signDigestBundle", + "line": 177, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/sign", + "module": "function", + "function": "signDigestBundle", + "line": 174, + "column": 19, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/sign", + "module": "function", + "function": "signDigestBundle", + "line": 164, + "column": 19, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go" + } + ] + } + } + }, + { + "group": "", + "name": "gopkg.in/evanphx/json-patch.v4", + "version": "v4.13.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "a7c118594118329ca79aa0db639f3308a085670f29456306e04b16bc3bccef63" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2014, Evan Phoenix\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without \nmodification, are permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n list of conditions and the following disclaimer.\n* Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n* Neither the name of the Evan Phoenix nor the names of its contributors \n may be used to endorse or promote products derived from this software \n without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" \nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE \nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE \nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE \nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL \nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR \nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER \nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, \nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE \nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/gopkg.in/evanphx/json-patch.v4@v4.13.0", + "type": "library", + "bom-ref": "pkg:golang/gopkg.in/evanphx/json-patch.v4@v4.13.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/gopkg.in/evanphx/json-patch.v4/@v/v4.13.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-01-28 17:43:52 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/gopkg.in/evanphx/json-patch.v4@v4.13.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "gopkg.in/evanphx/json-patch.v4" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "gopkg.in/inf.v0", + "version": "v0.9.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "7165037531bf7d8697728f8372e7dbe559dce86a7660286a5ad6f1459134997c" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Copyright (c) 2012 Péter Surányi. Portions Copyright (c) 2009 The Go\nAuthors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/gopkg.in/inf.v0@v0.9.1", + "type": "library", + "bom-ref": "pkg:golang/gopkg.in/inf.v0@v0.9.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/gopkg.in/inf.v0/@v/v0.9.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2018-03-26 17:23:32 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/gopkg.in/inf.v0@v0.9.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "gopkg.in/inf.v0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "gopkg.in/ini.v1", + "version": "v1.67.3", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "c7f7323b00a066a3a42680c827773528d1cca35d3e9cb180861fa49f7662cecb" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Apache License\nVersion 2.0, January 2004\nhttp://www.apache.org/licenses/\n\nTERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n1. Definitions.\n\n\"License\" shall mean the terms and conditions for use, reproduction, and\ndistribution as defined by Sections 1 through 9 of this document.\n\n\"Licensor\" shall mean the copyright owner or entity authorized by the copyright\nowner that is granting the License.\n\n\"Legal Entity\" shall mean the union of the acting entity and all other entities\nthat control, are controlled by, or are under common control with that entity.\nFor the purposes of this definition, \"control\" means (i) the power, direct or\nindirect, to cause the direction or management of such entity, whether by\ncontract or otherwise, or (ii) ownership of fifty percent (50%) or more of the\noutstanding shares, or (iii) beneficial ownership of such entity.\n\n\"You\" (or \"Your\") shall mean an individual or Legal Entity exercising\npermissions granted by this License.\n\n\"Source\" form shall mean the preferred form for making modifications, including\nbut not limited to software source code, documentation source, and configuration\nfiles.\n\n\"Object\" form shall mean any form resulting from mechanical transformation or\ntranslation of a Source form, including but not limited to compiled object code,\ngenerated documentation, and conversions to other media types.\n\n\"Work\" shall mean the work of authorship, whether in Source or Object form, made\navailable under the License, as indicated by a copyright notice that is included\nin or attached to the work (an example is provided in the Appendix below).\n\n\"Derivative Works\" shall mean any work, whether in Source or Object form, that\nis based on (or derived from) the Work and for which the editorial revisions,\nannotations, elaborations, or other modifications represent, as a whole, an\noriginal work of authorship. For the purposes of this License, Derivative Works\nshall not include works that remain separable from, or merely link (or bind by\nname) to the interfaces of, the Work and Derivative Works thereof.\n\n\"Contribution\" shall mean any work of authorship, including the original version\nof the Work and any modifications or additions to that Work or Derivative Works\nthereof, that is intentionally submitted to Licensor for inclusion in the Work\nby the copyright owner or by an individual or Legal Entity authorized to submit\non behalf of the copyright owner. For the purposes of this definition,\n\"submitted\" means any form of electronic, verbal, or written communication sent\nto the Licensor or its representatives, including but not limited to\ncommunication on electronic mailing lists, source code control systems, and\nissue tracking systems that are managed by, or on behalf of, the Licensor for\nthe purpose of discussing and improving the Work, but excluding communication\nthat is conspicuously marked or otherwise designated in writing by the copyright\nowner as \"Not a Contribution.\"\n\n\"Contributor\" shall mean Licensor and any individual or Legal Entity on behalf\nof whom a Contribution has been received by Licensor and subsequently\nincorporated within the Work.\n\n2. Grant of Copyright License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable copyright license to reproduce, prepare Derivative Works of,\npublicly display, publicly perform, sublicense, and distribute the Work and such\nDerivative Works in Source or Object form.\n\n3. Grant of Patent License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable (except as stated in this section) patent license to make, have\nmade, use, offer to sell, sell, import, and otherwise transfer the Work, where\nsuch license applies only to those patent claims licensable by such Contributor\nthat are necessarily infringed by their Contribution(s) alone or by combination\nof their Contribution(s) with the Work to which such Contribution(s) was\nsubmitted. If You institute patent litigation against any entity (including a\ncross-claim or counterclaim in a lawsuit) alleging that the Work or a\nContribution incorporated within the Work constitutes direct or contributory\npatent infringement, then any patent licenses granted to You under this License\nfor that Work shall terminate as of the date such litigation is filed.\n\n4. Redistribution.\n\nYou may reproduce and distribute copies of the Work or Derivative Works thereof\nin any medium, with or without modifications, and in Source or Object form,\nprovided that You meet the following conditions:\n\nYou must give any other recipients of the Work or Derivative Works a copy of\nthis License; and\nYou must cause any modified files to carry prominent notices stating that You\nchanged the files; and\nYou must retain, in the Source form of any Derivative Works that You distribute,\nall copyright, patent, trademark, and attribution notices from the Source form\nof the Work, excluding those notices that do not pertain to any part of the\nDerivative Works; and\nIf the Work includes a \"NOTICE\" text file as part of its distribution, then any\nDerivative Works that You distribute must include a readable copy of the\nattribution notices contained within such NOTICE file, excluding those notices\nthat do not pertain to any part of the Derivative Works, in at least one of the\nfollowing places: within a NOTICE text file distributed as part of the\nDerivative Works; within the Source form or documentation, if provided along\nwith the Derivative Works; or, within a display generated by the Derivative\nWorks, if and wherever such third-party notices normally appear. The contents of\nthe NOTICE file are for informational purposes only and do not modify the\nLicense. You may add Your own attribution notices within Derivative Works that\nYou distribute, alongside or as an addendum to the NOTICE text from the Work,\nprovided that such additional attribution notices cannot be construed as\nmodifying the License.\nYou may add Your own copyright statement to Your modifications and may provide\nadditional or different license terms and conditions for use, reproduction, or\ndistribution of Your modifications, or for any such Derivative Works as a whole,\nprovided Your use, reproduction, and distribution of the Work otherwise complies\nwith the conditions stated in this License.\n\n5. Submission of Contributions.\n\nUnless You explicitly state otherwise, any Contribution intentionally submitted\nfor inclusion in the Work by You to the Licensor shall be under the terms and\nconditions of this License, without any additional terms or conditions.\nNotwithstanding the above, nothing herein shall supersede or modify the terms of\nany separate license agreement you may have executed with Licensor regarding\nsuch Contributions.\n\n6. Trademarks.\n\nThis License does not grant permission to use the trade names, trademarks,\nservice marks, or product names of the Licensor, except as required for\nreasonable and customary use in describing the origin of the Work and\nreproducing the content of the NOTICE file.\n\n7. Disclaimer of Warranty.\n\nUnless required by applicable law or agreed to in writing, Licensor provides the\nWork (and each Contributor provides its Contributions) on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,\nincluding, without limitation, any warranties or conditions of TITLE,\nNON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are\nsolely responsible for determining the appropriateness of using or\nredistributing the Work and assume any risks associated with Your exercise of\npermissions under this License.\n\n8. Limitation of Liability.\n\nIn no event and under no legal theory, whether in tort (including negligence),\ncontract, or otherwise, unless required by applicable law (such as deliberate\nand grossly negligent acts) or agreed to in writing, shall any Contributor be\nliable to You for damages, including any direct, indirect, special, incidental,\nor consequential damages of any character arising as a result of this License or\nout of the use or inability to use the Work (including but not limited to\ndamages for loss of goodwill, work stoppage, computer failure or malfunction, or\nany and all other commercial damages or losses), even if such Contributor has\nbeen advised of the possibility of such damages.\n\n9. Accepting Warranty or Additional Liability.\n\nWhile redistributing the Work or Derivative Works thereof, You may choose to\noffer, and charge a fee for, acceptance of support, warranty, indemnity, or\nother liability obligations and/or rights consistent with this License. However,\nin accepting such obligations, You may act only on Your own behalf and on Your\nsole responsibility, not on behalf of any other Contributor, and only if You\nagree to indemnify, defend, and hold each Contributor harmless for any liability\nincurred by, or claims asserted against, such Contributor by reason of your\naccepting any such warranty or additional liability.\n\nEND OF TERMS AND CONDITIONS\n\nAPPENDIX: How to apply the Apache License to your work\n\nTo apply the Apache License to your work, attach the following boilerplate\nnotice, with the fields enclosed by brackets \"[]\" replaced with your own\nidentifying information. (Don't include the brackets!) The text should be\nenclosed in the appropriate comment syntax for the file format. We also\nrecommend that a file or class name and description of purpose be included on\nthe same \"printed page\" as the copyright notice for easier identification within\nthird-party archives.\n\n Copyright 2014 Unknwon\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/gopkg.in/ini.v1@v1.67.3", + "type": "library", + "bom-ref": "pkg:golang/gopkg.in/ini.v1@v1.67.3", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/gopkg.in/ini.v1/@v/v1.67.3.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.13" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-08 12:12:57 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/gopkg.in/ini.v1@v1.67.3" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "gopkg.in/ini.v1" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.13" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "gopkg.in/yaml.v3", + "version": "v3.0.1", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "2b8bb293bcfb04210faaee84f82eb861fbf5710ee4cfbac866f89498df848043" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\nThis project is covered by two different licenses: MIT and Apache.\n\n#### MIT License ####\n\nThe following files were ported to Go from C files of libyaml, and thus\nare still covered by their original MIT license, with the additional\ncopyright staring in 2011 when the project was ported over:\n\n apic.go emitterc.go parserc.go readerc.go scannerc.go\n writerc.go yamlh.go yamlprivateh.go\n\nCopyright (c) 2006-2010 Kirill Simonov\nCopyright (c) 2006-2011 Kirill Simonov\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies\nof the Software, and to permit persons to whom the Software is furnished to do\nso, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n### Apache License ###\n\nAll the remaining project files are covered by the Apache license:\n\nCopyright (c) 2011-2019 Canonical Ltd\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", + "type": "library", + "bom-ref": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/gopkg.in/yaml.v3/@v/v3.0.1.mod" + }, + { + "name": "ModuleGoVersion", + "value": "" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2022-05-27 08:35:30 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/gopkg.in/yaml.v3@v3.0.1" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,NOTICE" + }, + { + "name": "cdx:golem:modulePath", + "value": "gopkg.in/yaml.v3" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "k8s.io/api", + "version": "v0.36.2", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "1782db30ee1bae365887bc859175a1ca74afb41ed86aec55e1cf871e435118d8" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/k8s.io/api@v0.36.2", + "type": "library", + "bom-ref": "pkg:golang/k8s.io/api@v0.36.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/k8s.io/api/@v/v0.36.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.26.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-12 12:38:38 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/k8s.io/api@v0.36.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "k8s.io/api" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.26.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "11" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "10" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 118 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 125 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 46 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 74 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 137 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 138 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 188 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go", + "line": 189 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "KeyPairSecret", + "line": 85, + "column": 89, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "secret", + "line": 118, + "column": 11, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "secret", + "line": 125, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "GetKeyPairSecret", + "line": 46, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "KeyPairSecret", + "line": 74, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/signature", + "module": "function", + "function": "SignerVerifierFromKeyRef", + "line": 137, + "column": 10, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/signature", + "module": "function", + "function": "SignerVerifierFromKeyRef", + "line": 138, + "column": 33, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/signature", + "module": "function", + "function": "SignerVerifierFromKeyRef", + "line": 138, + "column": 55, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go" + } + ] + } + } + }, + { + "group": "", + "name": "k8s.io/apimachinery", + "version": "v0.36.2", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "7ef7ff1ce2d7abd448774ae70c86cdd4e101bc75dd41b2cc33c9eed0b70151fe" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/k8s.io/apimachinery@v0.36.2", + "type": "library", + "bom-ref": "pkg:golang/k8s.io/apimachinery@v0.36.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/k8s.io/apimachinery/@v/v0.36.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.26.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-12 12:17:04 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/k8s.io/apimachinery@v0.36.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "k8s.io/apimachinery" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.26.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "named" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:symbolKind", + "value": "type" + }, + { + "name": "cdx:golem:symbolKind", + "value": "variable" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "26" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "5" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "14" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "7" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 187 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 191 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 195 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 197 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 202 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 205 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 208 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go", + "line": 35 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 130 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 135 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go", + "line": 28 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 20 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 48 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 53 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 111 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 27 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 76 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 85 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 91 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/copy", + "module": "function", + "function": "parseOnlyOpt", + "line": 197, + "column": 7, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/copy", + "module": "function", + "function": "parseOnlyOpt", + "line": 202, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/copy", + "module": "function", + "function": "parseOnlyOpt", + "line": 205, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/copy", + "module": "function", + "function": "parseOnlyOpt", + "line": 208, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/copy", + "module": "function", + "function": "parseOnlyOpt", + "line": 191, + "column": 3, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/copy", + "module": "function", + "function": "parseOnlyOpt", + "line": 187, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/copy", + "module": "function", + "function": "parseOnlyOpt", + "line": 195, + "column": 18, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/copy/copy.go" + }, + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli/manifest", + "module": "function", + "function": "getImagesFromYamlManifest", + "line": 135, + "column": 13, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/manifest/verify.go" + } + ] + } + } + }, + { + "group": "", + "name": "k8s.io/client-go", + "version": "v0.36.2", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "d6f80ee0e0257cf9e82dc6fe4737b6185e6b02bd78c3caa3ad8328c97273423d" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/k8s.io/client-go@v0.36.2", + "type": "library", + "bom-ref": "pkg:golang/k8s.io/client-go@v0.36.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/k8s.io/client-go/@v/v0.36.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.26.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-06-12 13:09:41 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/k8s.io/client-go@v0.36.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "k8s.io/client-go" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.26.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "blank" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "24" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "4" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "20" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 21 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 24 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 25 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 26 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 30 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 31 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 32 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 33 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 40 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go", + "line": 44 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 47 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 75 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 77 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 85 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "GetKeyPairSecret", + "line": 47, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "KeyPairSecret", + "line": 75, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "KeyPairSecret", + "line": 77, + "column": 13, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "KeyPairSecret", + "line": 85, + "column": 12, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "checkImmutableSecretSupported", + "line": 44, + "column": 17, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "client", + "line": 32, + "column": 5, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "client", + "line": 40, + "column": 9, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go" + }, + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "client", + "line": 30, + "column": 14, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/client.go" + } + ] + } + } + }, + { + "group": "", + "name": "k8s.io/klog/v2", + "version": "v2.140.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "a3efd159f27a3f0a67167ecec801b74273b8ec116cca67c47ebcfa5f26124a9d" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Apache License\nVersion 2.0, January 2004\nhttp://www.apache.org/licenses/\n\nTERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n1. Definitions.\n\n\"License\" shall mean the terms and conditions for use, reproduction, and\ndistribution as defined by Sections 1 through 9 of this document.\n\n\"Licensor\" shall mean the copyright owner or entity authorized by the copyright\nowner that is granting the License.\n\n\"Legal Entity\" shall mean the union of the acting entity and all other entities\nthat control, are controlled by, or are under common control with that entity.\nFor the purposes of this definition, \"control\" means (i) the power, direct or\nindirect, to cause the direction or management of such entity, whether by\ncontract or otherwise, or (ii) ownership of fifty percent (50%) or more of the\noutstanding shares, or (iii) beneficial ownership of such entity.\n\n\"You\" (or \"Your\") shall mean an individual or Legal Entity exercising\npermissions granted by this License.\n\n\"Source\" form shall mean the preferred form for making modifications, including\nbut not limited to software source code, documentation source, and configuration\nfiles.\n\n\"Object\" form shall mean any form resulting from mechanical transformation or\ntranslation of a Source form, including but not limited to compiled object code,\ngenerated documentation, and conversions to other media types.\n\n\"Work\" shall mean the work of authorship, whether in Source or Object form, made\navailable under the License, as indicated by a copyright notice that is included\nin or attached to the work (an example is provided in the Appendix below).\n\n\"Derivative Works\" shall mean any work, whether in Source or Object form, that\nis based on (or derived from) the Work and for which the editorial revisions,\nannotations, elaborations, or other modifications represent, as a whole, an\noriginal work of authorship. For the purposes of this License, Derivative Works\nshall not include works that remain separable from, or merely link (or bind by\nname) to the interfaces of, the Work and Derivative Works thereof.\n\n\"Contribution\" shall mean any work of authorship, including the original version\nof the Work and any modifications or additions to that Work or Derivative Works\nthereof, that is intentionally submitted to Licensor for inclusion in the Work\nby the copyright owner or by an individual or Legal Entity authorized to submit\non behalf of the copyright owner. For the purposes of this definition,\n\"submitted\" means any form of electronic, verbal, or written communication sent\nto the Licensor or its representatives, including but not limited to\ncommunication on electronic mailing lists, source code control systems, and\nissue tracking systems that are managed by, or on behalf of, the Licensor for\nthe purpose of discussing and improving the Work, but excluding communication\nthat is conspicuously marked or otherwise designated in writing by the copyright\nowner as \"Not a Contribution.\"\n\n\"Contributor\" shall mean Licensor and any individual or Legal Entity on behalf\nof whom a Contribution has been received by Licensor and subsequently\nincorporated within the Work.\n\n2. Grant of Copyright License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable copyright license to reproduce, prepare Derivative Works of,\npublicly display, publicly perform, sublicense, and distribute the Work and such\nDerivative Works in Source or Object form.\n\n3. Grant of Patent License.\n\nSubject to the terms and conditions of this License, each Contributor hereby\ngrants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,\nirrevocable (except as stated in this section) patent license to make, have\nmade, use, offer to sell, sell, import, and otherwise transfer the Work, where\nsuch license applies only to those patent claims licensable by such Contributor\nthat are necessarily infringed by their Contribution(s) alone or by combination\nof their Contribution(s) with the Work to which such Contribution(s) was\nsubmitted. If You institute patent litigation against any entity (including a\ncross-claim or counterclaim in a lawsuit) alleging that the Work or a\nContribution incorporated within the Work constitutes direct or contributory\npatent infringement, then any patent licenses granted to You under this License\nfor that Work shall terminate as of the date such litigation is filed.\n\n4. Redistribution.\n\nYou may reproduce and distribute copies of the Work or Derivative Works thereof\nin any medium, with or without modifications, and in Source or Object form,\nprovided that You meet the following conditions:\n\nYou must give any other recipients of the Work or Derivative Works a copy of\nthis License; and\nYou must cause any modified files to carry prominent notices stating that You\nchanged the files; and\nYou must retain, in the Source form of any Derivative Works that You distribute,\nall copyright, patent, trademark, and attribution notices from the Source form\nof the Work, excluding those notices that do not pertain to any part of the\nDerivative Works; and\nIf the Work includes a \"NOTICE\" text file as part of its distribution, then any\nDerivative Works that You distribute must include a readable copy of the\nattribution notices contained within such NOTICE file, excluding those notices\nthat do not pertain to any part of the Derivative Works, in at least one of the\nfollowing places: within a NOTICE text file distributed as part of the\nDerivative Works; within the Source form or documentation, if provided along\nwith the Derivative Works; or, within a display generated by the Derivative\nWorks, if and wherever such third-party notices normally appear. The contents of\nthe NOTICE file are for informational purposes only and do not modify the\nLicense. You may add Your own attribution notices within Derivative Works that\nYou distribute, alongside or as an addendum to the NOTICE text from the Work,\nprovided that such additional attribution notices cannot be construed as\nmodifying the License.\nYou may add Your own copyright statement to Your modifications and may provide\nadditional or different license terms and conditions for use, reproduction, or\ndistribution of Your modifications, or for any such Derivative Works as a whole,\nprovided Your use, reproduction, and distribution of the Work otherwise complies\nwith the conditions stated in this License.\n\n5. Submission of Contributions.\n\nUnless You explicitly state otherwise, any Contribution intentionally submitted\nfor inclusion in the Work by You to the Licensor shall be under the terms and\nconditions of this License, without any additional terms or conditions.\nNotwithstanding the above, nothing herein shall supersede or modify the terms of\nany separate license agreement you may have executed with Licensor regarding\nsuch Contributions.\n\n6. Trademarks.\n\nThis License does not grant permission to use the trade names, trademarks,\nservice marks, or product names of the Licensor, except as required for\nreasonable and customary use in describing the origin of the Work and\nreproducing the content of the NOTICE file.\n\n7. Disclaimer of Warranty.\n\nUnless required by applicable law or agreed to in writing, Licensor provides the\nWork (and each Contributor provides its Contributions) on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,\nincluding, without limitation, any warranties or conditions of TITLE,\nNON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are\nsolely responsible for determining the appropriateness of using or\nredistributing the Work and assume any risks associated with Your exercise of\npermissions under this License.\n\n8. Limitation of Liability.\n\nIn no event and under no legal theory, whether in tort (including negligence),\ncontract, or otherwise, unless required by applicable law (such as deliberate\nand grossly negligent acts) or agreed to in writing, shall any Contributor be\nliable to You for damages, including any direct, indirect, special, incidental,\nor consequential damages of any character arising as a result of this License or\nout of the use or inability to use the Work (including but not limited to\ndamages for loss of goodwill, work stoppage, computer failure or malfunction, or\nany and all other commercial damages or losses), even if such Contributor has\nbeen advised of the possibility of such damages.\n\n9. Accepting Warranty or Additional Liability.\n\nWhile redistributing the Work or Derivative Works thereof, You may choose to\noffer, and charge a fee for, acceptance of support, warranty, indemnity, or\nother liability obligations and/or rights consistent with this License. However,\nin accepting such obligations, You may act only on Your own behalf and on Your\nsole responsibility, not on behalf of any other Contributor, and only if You\nagree to indemnify, defend, and hold each Contributor harmless for any liability\nincurred by, or claims asserted against, such Contributor by reason of your\naccepting any such warranty or additional liability.\n\nEND OF TERMS AND CONDITIONS\n\nAPPENDIX: How to apply the Apache License to your work\n\nTo apply the Apache License to your work, attach the following boilerplate\nnotice, with the fields enclosed by brackets \"[]\" replaced with your own\nidentifying information. (Don't include the brackets!) The text should be\nenclosed in the appropriate comment syntax for the file format. We also\nrecommend that a file or class name and description of purpose be included on\nthe same \"printed page\" as the copyright notice for easier identification within\nthird-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/k8s.io/klog/v2@v2.140.0", + "type": "library", + "bom-ref": "pkg:golang/k8s.io/klog/v2@v2.140.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/k8s.io/klog/v2/@v/v2.140.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.21" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-03-03 11:17:23 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/k8s.io/klog/v2@v2.140.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "k8s.io/klog/v2" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.21" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "k8s.io/kube-openapi", + "version": "v0.0.0-20260317180543-43fb72c5454a", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "b86053ee24c0e9ce8cbea52f49721a619a3dba4b1c001622d9bb6386f80a199d" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/k8s.io/kube-openapi@v0.0.0-20260317180543-43fb72c5454a", + "type": "library", + "bom-ref": "pkg:golang/k8s.io/kube-openapi@v0.0.0-20260317180543-43fb72c5454a", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/k8s.io/kube-openapi/@v/v0.0.0-20260317180543-43fb72c5454a.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23.0" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-03-17 18:05:43 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/k8s.io/kube-openapi@v0.0.0-20260317180543-43fb72c5454a" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "k8s.io/kube-openapi" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23.0" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "k8s.io/utils", + "version": "v0.0.0-20260210185600-b8788abfbbc2", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "c43c6e274c2103777423899ffc2e29a4a1f15f29d0f9fc67926407d2f4c79ee9" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"[]\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright [yyyy] [name of copyright owner]\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/k8s.io/utils@v0.0.0-20260210185600-b8788abfbbc2", + "type": "library", + "bom-ref": "pkg:golang/k8s.io/utils@v0.0.0-20260210185600-b8788abfbbc2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/k8s.io/utils/@v/v0.0.0-20260210185600-b8788abfbbc2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-02-10 18:56:00 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/k8s.io/utils@v0.0.0-20260210185600-b8788abfbbc2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "k8s.io/utils" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "2" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolReference" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "1" + }, + { + "name": "cdx:golem:symbolReferenceOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 121 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go", + "line": 28 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/pkg/cosign/kubernetes", + "module": "function", + "function": "secret", + "line": 121, + "column": 16, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go" + } + ] + } + } + }, + { + "group": "", + "name": "sigs.k8s.io/json", + "version": "v0.0.0-20250730193827-2d320260d730", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "99dcdfa4012813a0c7404374ba1f596ce0ae1db2cae703a6edd2b872d5c4f538" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "Files other than internal/golang/* licensed under:\n\n\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n\n\n------------------\n\ninternal/golang/* files licensed under:\n\n\nCopyright (c) 2009 The Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", + "type": "library", + "bom-ref": "pkg:golang/sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/sigs.k8s.io/json/@v/v0.0.0-20250730193827-2d320260d730.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-07-30 19:38:27 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "sigs.k8s.io/json" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "sigs.k8s.io/randfill", + "version": "v1.0.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "5de2e567f8e69388b51d1a29c1eeff694dc7e67d73354717e9333de1bdd0c4e6" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright 2014 The gofuzz Authors\n Copyright 2025 The Kubernetes Authors\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/sigs.k8s.io/randfill@v1.0.0", + "type": "library", + "bom-ref": "pkg:golang/sigs.k8s.io/randfill@v1.0.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/sigs.k8s.io/randfill/@v/v1.0.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.18" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-03-04 18:23:53 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/sigs.k8s.io/randfill@v1.0.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "2" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE,NOTICE" + }, + { + "name": "cdx:golem:modulePath", + "value": "sigs.k8s.io/randfill" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.18" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "sigs.k8s.io/release-utils", + "version": "v0.12.4", + "scope": "required", + "hashes": [ + { + "alg": "SHA-256", + "content": "4dcde233d0d53375bda09bbfeab108f8b9d112e872f2567bc089d085106d528a" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/sigs.k8s.io/release-utils@v0.12.4", + "type": "library", + "bom-ref": "pkg:golang/sigs.k8s.io/release-utils@v0.12.4", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/sigs.k8s.io/release-utils/@v/v0.12.4.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.24.0" + }, + { + "name": "cdx:go:indirect", + "value": "false" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-03-31 08:40:15 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/sigs.k8s.io/release-utils@v0.12.4" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "sigs.k8s.io/release-utils" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.24.0" + }, + { + "name": "cdx:golem:importDirect", + "value": "true" + }, + { + "name": "cdx:golem:importAliasKind", + "value": "default" + }, + { + "name": "cdx:golem:symbolKind", + "value": "function" + }, + { + "name": "cdx:golem:usageKind", + "value": "selector" + }, + { + "name": "cdx:golem:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:usageScopes", + "value": "runtime" + }, + { + "name": "cdx:golem:testOnly", + "value": "false" + }, + { + "name": "cdx:golem:runtimeUsageCount", + "value": "3" + }, + { + "name": "cdx:golem:occurrenceEvidenceKinds", + "value": "import,symbolCall" + }, + { + "name": "cdx:golem:importOccurrenceCount", + "value": "2" + }, + { + "name": "cdx:golem:symbolCallOccurrenceCount", + "value": "1" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.7, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.7, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ], + "occurrences": [ + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 126 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go", + "line": 29 + }, + { + "location": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/useragent.go", + "line": 21 + } + ], + "callstack": { + "frames": [ + { + "package": "github.com/sigstore/cosign/v3/cmd/cosign/cli", + "module": "function", + "function": "New", + "line": 126, + "column": 17, + "fullFilename": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/commands.go" + } + ] + } + } + }, + { + "group": "", + "name": "sigs.k8s.io/structured-merge-diff/v6", + "version": "v6.3.2", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "3375bcb1f5af9f61e140321b1968f74b4f7d628cc0b32982a3fc2b4f9a214541" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": " Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/sigs.k8s.io/structured-merge-diff/v6@v6.3.2", + "type": "library", + "bom-ref": "pkg:golang/sigs.k8s.io/structured-merge-diff/v6@v6.3.2", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/sigs.k8s.io/structured-merge-diff/v6/@v/v6.3.2.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.23" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2026-01-22 20:25:28 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/sigs.k8s.io/structured-merge-diff/v6@v6.3.2" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "sigs.k8s.io/structured-merge-diff/v6" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.23" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "group": "", + "name": "sigs.k8s.io/yaml", + "version": "v1.6.0", + "scope": "optional", + "hashes": [ + { + "alg": "SHA-256", + "content": "efde9b3ea51fcd1ff48cb025e978c79770a4ecc8b256ff1d6d37724f7fe931fe" + } + ], + "licenses": [ + { + "license": { + "name": "CUSTOM", + "text": { + "contentType": "text/plain", + "content": "The MIT License (MIT)\n\nCopyright (c) 2014 Sam Ghods\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n\nCopyright (c) 2012 The Go Authors. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n * Redistributions of source code must retain the above copyright\nnotice, this list of conditions and the following disclaimer.\n * Redistributions in binary form must reproduce the above\ncopyright notice, this list of conditions and the following disclaimer\nin the documentation and/or other materials provided with the\ndistribution.\n * Neither the name of Google Inc. nor the names of its\ncontributors may be used to endorse or promote products derived from\nthis software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\n# The forked go-yaml.v3 library under this project is covered by two\ndifferent licenses (MIT and Apache):\n\n#### MIT License ####\n\nThe following files were ported to Go from C files of libyaml, and thus\nare still covered by their original MIT license, with the additional\ncopyright staring in 2011 when the project was ported over:\n\n apic.go emitterc.go parserc.go readerc.go scannerc.go\n writerc.go yamlh.go yamlprivateh.go\n\nCopyright (c) 2006-2010 Kirill Simonov\nCopyright (c) 2006-2011 Kirill Simonov\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies\nof the Software, and to permit persons to whom the Software is furnished to do\nso, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n### Apache License ###\n\nAll the remaining project files are covered by the Apache license:\n\nCopyright (c) 2011-2019 Canonical Ltd\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n\n# The forked go-yaml.v2 library under the project is covered by an\nApache license:\n\n Apache License\n Version 2.0, January 2004\n http://www.apache.org/licenses/\n\n TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n 1. Definitions.\n\n \"License\" shall mean the terms and conditions for use, reproduction,\n and distribution as defined by Sections 1 through 9 of this document.\n\n \"Licensor\" shall mean the copyright owner or entity authorized by\n the copyright owner that is granting the License.\n\n \"Legal Entity\" shall mean the union of the acting entity and all\n other entities that control, are controlled by, or are under common\n control with that entity. For the purposes of this definition,\n \"control\" means (i) the power, direct or indirect, to cause the\n direction or management of such entity, whether by contract or\n otherwise, or (ii) ownership of fifty percent (50%) or more of the\n outstanding shares, or (iii) beneficial ownership of such entity.\n\n \"You\" (or \"Your\") shall mean an individual or Legal Entity\n exercising permissions granted by this License.\n\n \"Source\" form shall mean the preferred form for making modifications,\n including but not limited to software source code, documentation\n source, and configuration files.\n\n \"Object\" form shall mean any form resulting from mechanical\n transformation or translation of a Source form, including but\n not limited to compiled object code, generated documentation,\n and conversions to other media types.\n\n \"Work\" shall mean the work of authorship, whether in Source or\n Object form, made available under the License, as indicated by a\n copyright notice that is included in or attached to the work\n (an example is provided in the Appendix below).\n\n \"Derivative Works\" shall mean any work, whether in Source or Object\n form, that is based on (or derived from) the Work and for which the\n editorial revisions, annotations, elaborations, or other modifications\n represent, as a whole, an original work of authorship. For the purposes\n of this License, Derivative Works shall not include works that remain\n separable from, or merely link (or bind by name) to the interfaces of,\n the Work and Derivative Works thereof.\n\n \"Contribution\" shall mean any work of authorship, including\n the original version of the Work and any modifications or additions\n to that Work or Derivative Works thereof, that is intentionally\n submitted to Licensor for inclusion in the Work by the copyright owner\n or by an individual or Legal Entity authorized to submit on behalf of\n the copyright owner. For the purposes of this definition, \"submitted\"\n means any form of electronic, verbal, or written communication sent\n to the Licensor or its representatives, including but not limited to\n communication on electronic mailing lists, source code control systems,\n and issue tracking systems that are managed by, or on behalf of, the\n Licensor for the purpose of discussing and improving the Work, but\n excluding communication that is conspicuously marked or otherwise\n designated in writing by the copyright owner as \"Not a Contribution.\"\n\n \"Contributor\" shall mean Licensor and any individual or Legal Entity\n on behalf of whom a Contribution has been received by Licensor and\n subsequently incorporated within the Work.\n\n 2. Grant of Copyright License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n copyright license to reproduce, prepare Derivative Works of,\n publicly display, publicly perform, sublicense, and distribute the\n Work and such Derivative Works in Source or Object form.\n\n 3. Grant of Patent License. Subject to the terms and conditions of\n this License, each Contributor hereby grants to You a perpetual,\n worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n (except as stated in this section) patent license to make, have made,\n use, offer to sell, sell, import, and otherwise transfer the Work,\n where such license applies only to those patent claims licensable\n by such Contributor that are necessarily infringed by their\n Contribution(s) alone or by combination of their Contribution(s)\n with the Work to which such Contribution(s) was submitted. If You\n institute patent litigation against any entity (including a\n cross-claim or counterclaim in a lawsuit) alleging that the Work\n or a Contribution incorporated within the Work constitutes direct\n or contributory patent infringement, then any patent licenses\n granted to You under this License for that Work shall terminate\n as of the date such litigation is filed.\n\n 4. Redistribution. You may reproduce and distribute copies of the\n Work or Derivative Works thereof in any medium, with or without\n modifications, and in Source or Object form, provided that You\n meet the following conditions:\n\n (a) You must give any other recipients of the Work or\n Derivative Works a copy of this License; and\n\n (b) You must cause any modified files to carry prominent notices\n stating that You changed the files; and\n\n (c) You must retain, in the Source form of any Derivative Works\n that You distribute, all copyright, patent, trademark, and\n attribution notices from the Source form of the Work,\n excluding those notices that do not pertain to any part of\n the Derivative Works; and\n\n (d) If the Work includes a \"NOTICE\" text file as part of its\n distribution, then any Derivative Works that You distribute must\n include a readable copy of the attribution notices contained\n within such NOTICE file, excluding those notices that do not\n pertain to any part of the Derivative Works, in at least one\n of the following places: within a NOTICE text file distributed\n as part of the Derivative Works; within the Source form or\n documentation, if provided along with the Derivative Works; or,\n within a display generated by the Derivative Works, if and\n wherever such third-party notices normally appear. The contents\n of the NOTICE file are for informational purposes only and\n do not modify the License. You may add Your own attribution\n notices within Derivative Works that You distribute, alongside\n or as an addendum to the NOTICE text from the Work, provided\n that such additional attribution notices cannot be construed\n as modifying the License.\n\n You may add Your own copyright statement to Your modifications and\n may provide additional or different license terms and conditions\n for use, reproduction, or distribution of Your modifications, or\n for any such Derivative Works as a whole, provided Your use,\n reproduction, and distribution of the Work otherwise complies with\n the conditions stated in this License.\n\n 5. Submission of Contributions. Unless You explicitly state otherwise,\n any Contribution intentionally submitted for inclusion in the Work\n by You to the Licensor shall be under the terms and conditions of\n this License, without any additional terms or conditions.\n Notwithstanding the above, nothing herein shall supersede or modify\n the terms of any separate license agreement you may have executed\n with Licensor regarding such Contributions.\n\n 6. Trademarks. This License does not grant permission to use the trade\n names, trademarks, service marks, or product names of the Licensor,\n except as required for reasonable and customary use in describing the\n origin of the Work and reproducing the content of the NOTICE file.\n\n 7. Disclaimer of Warranty. Unless required by applicable law or\n agreed to in writing, Licensor provides the Work (and each\n Contributor provides its Contributions) on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n implied, including, without limitation, any warranties or conditions\n of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n PARTICULAR PURPOSE. You are solely responsible for determining the\n appropriateness of using or redistributing the Work and assume any\n risks associated with Your exercise of permissions under this License.\n\n 8. Limitation of Liability. In no event and under no legal theory,\n whether in tort (including negligence), contract, or otherwise,\n unless required by applicable law (such as deliberate and grossly\n negligent acts) or agreed to in writing, shall any Contributor be\n liable to You for damages, including any direct, indirect, special,\n incidental, or consequential damages of any character arising as a\n result of this License or out of the use or inability to use the\n Work (including but not limited to damages for loss of goodwill,\n work stoppage, computer failure or malfunction, or any and all\n other commercial damages or losses), even if such Contributor\n has been advised of the possibility of such damages.\n\n 9. Accepting Warranty or Additional Liability. While redistributing\n the Work or Derivative Works thereof, You may choose to offer,\n and charge a fee for, acceptance of support, warranty, indemnity,\n or other liability obligations and/or rights consistent with this\n License. However, in accepting such obligations, You may act only\n on Your own behalf and on Your sole responsibility, not on behalf\n of any other Contributor, and only if You agree to indemnify,\n defend, and hold each Contributor harmless for any liability\n incurred by, or claims asserted against, such Contributor by reason\n of your accepting any such warranty or additional liability.\n\n END OF TERMS AND CONDITIONS\n\n APPENDIX: How to apply the Apache License to your work.\n\n To apply the Apache License to your work, attach the following\n boilerplate notice, with the fields enclosed by brackets \"{}\"\n replaced with your own identifying information. (Don't include\n the brackets!) The text should be enclosed in the appropriate\n comment syntax for the file format. We also recommend that a\n file or class name and description of purpose be included on the\n same \"printed page\" as the copyright notice for easier\n identification within third-party archives.\n\n Copyright {yyyy} {name of copyright owner}\n\n Licensed under the Apache License, Version 2.0 (the \"License\");\n you may not use this file except in compliance with the License.\n You may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\n Unless required by applicable law or agreed to in writing, software\n distributed under the License is distributed on an \"AS IS\" BASIS,\n WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n See the License for the specific language governing permissions and\n limitations under the License.\n" + }, + "properties": [ + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:license:foss", + "value": "false" + }, + { + "name": "cdx:license:osiApproved", + "value": "false" + }, + { + "name": "cdx:license:fsfLibre", + "value": "false" + }, + { + "name": "cdx:license:deprecated", + "value": "false" + } + ] + } + } + ], + "purl": "pkg:golang/sigs.k8s.io/yaml@v1.6.0", + "type": "library", + "bom-ref": "pkg:golang/sigs.k8s.io/yaml@v1.6.0", + "properties": [ + { + "name": "SrcGoMod", + "value": "/Users/michelledipalma/go/pkg/mod/cache/download/sigs.k8s.io/yaml/@v/v1.6.0.mod" + }, + { + "name": "ModuleGoVersion", + "value": "1.22" + }, + { + "name": "cdx:go:indirect", + "value": "true" + }, + { + "name": "cdx:go:creation_time", + "value": "2025-07-24 18:12:28 +0000 UTC" + }, + { + "name": "cdx:go:local_dir", + "value": "/Users/michelledipalma/go/pkg/mod/sigs.k8s.io/yaml@v1.6.0" + }, + { + "name": "SrcFile", + "value": "go.mod" + }, + { + "name": "cdx:license:category", + "value": "Unstated License" + }, + { + "name": "cdx:golem:licenseFileCount", + "value": "1" + }, + { + "name": "cdx:golem:licenseFiles", + "value": "LICENSE" + }, + { + "name": "cdx:golem:modulePath", + "value": "sigs.k8s.io/yaml" + }, + { + "name": "cdx:golem:goVersion", + "value": "1.22" + } + ], + "evidence": { + "identity": [ + { + "field": "purl", + "confidence": 0.5, + "methods": [ + { + "technique": "manifest-analysis", + "confidence": 0.5, + "value": "go.mod" + } + ], + "concludedValue": "go.mod" + } + ] + } + }, + { + "type": "cryptographic-asset", + "name": "BundleAnnotationKey", + "bom-ref": "crypto/material/BundleAnnotationKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:35:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "BundleKey", + "bom-ref": "crypto/material/BundleKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:37:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "CertificateAnnotationKey", + "bom-ref": "crypto/material/CertificateAnnotationKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:33:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "certkey", + "bom-ref": "crypto/material/certkey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:35:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "ChainAnnotationKey", + "bom-ref": "crypto/material/ChainAnnotationKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:34:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "chainkey", + "bom-ref": "crypto/material/chainkey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:36:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "CosignPrivateKeyPemType", + "bom-ref": "crypto/material/CosignPrivateKeyPemType@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:43:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "ctPublicKeyStr", + "bom-ref": "crypto/material/ctPublicKeyStr@public-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "public-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/ctlog.go:28:5" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "ECPrivateKeyPemType", + "bom-ref": "crypto/material/ECPrivateKeyPemType@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:48:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "encryptedCosignPasswd", + "bom-ref": "crypto/material/encryptedCosignPasswd@password", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "password" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go:99:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "encryptedCosignPrivKey", + "bom-ref": "crypto/material/encryptedCosignPrivKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go:116:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "encryptedCosignPubKey", + "bom-ref": "crypto/material/encryptedCosignPubKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/git/github/github.go:133:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "extKeyUsageNames", + "bom-ref": "crypto/material/extKeyUsageNames@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:68:5" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "FilesystemTokenPath", + "bom-ref": "crypto/material/FilesystemTokenPath@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/providers/filesystem/filesystem.go:37:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "flowClientCredentials", + "bom-ref": "crypto/material/flowClientCredentials@credential", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "credential" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go:37:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "flowToken", + "bom-ref": "crypto/material/flowToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go:36:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "idToken", + "bom-ref": "crypto/material/idToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go:96:4" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/auth/auth.go:98:4" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "key", + "bom-ref": "crypto/material/key@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go:206:3" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyAlg", + "bom-ref": "crypto/material/keyAlg@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go:62:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go:64:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go:66:3" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyAlgorithmHelp", + "bom-ref": "crypto/material/keyAlgorithmHelp@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/signblob.go:161:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyID", + "bom-ref": "crypto/material/keyID@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go:144:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyLabel", + "bom-ref": "crypto/material/keyLabel@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go:143:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyParts", + "bom-ref": "crypto/material/keyParts@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:216:4" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "KeyReference", + "bom-ref": "crypto/material/KeyReference@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/kubernetes/secret.go:32:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyUsageNames", + "bom-ref": "crypto/material/keyUsageNames@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:53:5" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "keyvalue", + "bom-ref": "crypto/material/keyvalue@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/dockerfile/verify.go:202:3" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "PKCS#1 private key", + "bom-ref": "crypto/material/PKCS%231%20private%20key@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/x509.ParsePKCS1PrivateKey" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:152:17" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "private-key", + "bom-ref": "crypto/material/private-key@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/tls.LoadX509KeyPair" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go:246:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go:103:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:119:10" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "privateKeyExts", + "bom-ref": "crypto/material/privateKeyExts@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/options.go:41:5" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "privateKeyFileName", + "bom-ref": "crypto/material/privateKeyFileName@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go:47:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go:43:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "PrivateKeyPemType", + "bom-ref": "crypto/material/PrivateKeyPemType@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:50:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "pubKey", + "bom-ref": "crypto/material/pubKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:550:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/signature/keys.go:222:3" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "public-key", + "bom-ref": "crypto/material/public-key@public-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "public-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/x509.ParseCertificate" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go:157:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/bundle.go:67:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:279:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:285:36" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:287:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:288:25" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:291:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:291:51" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:291:88" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:294:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:295:39" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:297:10" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:298:40" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:300:10" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:301:35" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:306:38" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:307:37" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:310:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:345:42" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:345:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:345:74" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:347:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:348:41" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:350:25" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:353:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:360:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:369:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:379:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:386:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:387:58" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:389:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:390:31" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:400:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:401:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:407:59" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:437:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:439:29" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:445:113" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:445:95" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:449:64" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:54:8" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:57:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:58:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:59:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:609:26" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:60:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:613:27" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:61:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:62:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:63:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:64:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:65:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:68:28" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:69:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:70:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:71:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:72:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:73:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:74:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:75:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:76:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:77:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/inspect.go:78:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go:105:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go:106:17" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go:107:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go:108:17" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go:109:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/bundle/upgrade.go:98:24" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/fulcio/fulcio.go:24:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/fulcio/fulcio.go:28:27" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go:238:11" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go:239:7" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:249:37" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:273:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:315:14" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:317:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:549:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:319:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:316:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:281:32" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:225:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signcommon/common.go:551:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/sign/sign.go:469:58" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:506:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:323:27" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:357:24" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:338:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:511:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:371:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:500:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:362:34" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:458:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:363:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:453:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:346:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:349:43" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:357:37" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:375:50" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:433:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:434:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:436:27" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:438:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:446:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:449:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:458:28" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:460:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/common.go:74:187" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go:251:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go:203:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go:46:130" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go:104:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go:365:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go:125:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob.go:249:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go:367:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go:136:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_bundle.go:96:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/verify/verify_blob_attestation.go:316:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/key/svkeypair.go:52:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:69:24" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:83:36" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:33:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:83:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:67:14" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:89:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:52:27" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:84:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:41:14" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:66:36" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:32:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:66:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go:87:25" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go:96:10" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go:85:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/client/client.go:97:7" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/pkg/cosign/tsa/mock/mock_tsa_client.go:41:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:101:26" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:101:50" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:102:28" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:102:45" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:122:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:122:64" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:123:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:128:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:129:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:129:38" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:131:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:148:126" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:148:144" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:148:74" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:149:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:155:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:160:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:161:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:161:39" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:180:116" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:180:70" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:181:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:186:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:187:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:187:38" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:189:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:215:166" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:215:212" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:216:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:224:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:225:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:225:38" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:227:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:52:117" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:52:34" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:52:60" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:53:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:58:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:65:25" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:66:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:68:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:74:26" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:74:50" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:92:42" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:92:86" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:93:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/internal/test/cert_utils.go:95:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:191:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:193:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:199:31" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:204:25" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:205:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:205:35" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:208:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:75:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pivkey/disabled.go:47:26" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pivkey/disabled.go:51:45" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pivkey/disabled.go:83:31" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/disabled.go:40:31" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go:23:8" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go:47:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go:48:40" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go:50:38" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go:52:15" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/certextensions.go:52:41" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go:42:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/fetch.go:43:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:161:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:170:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:200:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:294:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tlog.go:96:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:134:76" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:141:7" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:145:19" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:145:36" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:36:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:37:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/tsa.go:38:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1051:54" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1053:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1054:59" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:121:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:123:21" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1241:24" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1241:58" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1245:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1248:8" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1251:5" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1254:8" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1258:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1261:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1264:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1267:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:159:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:161:25" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:163:33" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1642:100" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1642:24" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1642:49" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1642:79" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1643:17" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1643:29" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1647:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1650:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:1651:4" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:348:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:349:11" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:352:44" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:356:47" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:363:34" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:372:103" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:372:142" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:372:51" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:373:42" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:382:9" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:384:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:389:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:395:18" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:397:49" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:423:31" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:467:35" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:580:43" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:580:70" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:584:14" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:585:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:588:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:590:3" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:886:23" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:904:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:908:12" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:910:6" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify.go:992:35" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/verify_sct.go:143:54" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:102:29" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:118:32" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go:187:13" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go:188:16" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go:39:20" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go:40:22" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go:79:32" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/mutate/signature.go:87:35" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:157:32" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:169:35" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signatures.go:57:11" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/signatures.go:62:14" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "publicKeyExts", + "bom-ref": "crypto/material/publicKeyExts@public-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "public-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/options.go:44:5" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "publicKeyFileName", + "bom-ref": "crypto/material/publicKeyFileName@public-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "public-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/generate/generate_key_pair.go:48:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/importkeypair/import_key_pair.go:44:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "RepoOverrideEnvKey", + "bom-ref": "crypto/material/RepoOverrideEnvKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/remote/options.go:34:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "requiredKeys", + "bom-ref": "crypto/material/requiredKeys@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/signingconfig/signingconfig.go:195:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:543:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:440:2" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/trustedroot/trustedroot.go:489:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "RFC3161TimestampAnnotationKey", + "bom-ref": "crypto/material/RFC3161TimestampAnnotationKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:36:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "RFC3161TimestampKey", + "bom-ref": "crypto/material/RFC3161TimestampKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:38:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "rsa", + "bom-ref": "crypto/algorithm/rsa@2.5.8.1.1", + "description": "X.500 algorithms. Ambiguous, since no padding rules specified", + "cryptoProperties": { + "assetType": "algorithm", + "oid": "2.5.8.1.1", + "algorithmProperties": { + "primitive": "pke" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:strength", + "value": "acceptable" + }, + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/rsa.GenerateKey" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:119:10" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "RSAPrivateKeyPemType", + "bom-ref": "crypto/material/RSAPrivateKeyPemType@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:46:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "sha-256", + "bom-ref": "crypto/algorithm/sha-256@2.16.840.1.101.3.4.2.1", + "description": "NIST Algorithm", + "cryptoProperties": { + "assetType": "algorithm", + "oid": "2.16.840.1.101.3.4.2.1", + "algorithmProperties": { + "primitive": "hash" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:strength", + "value": "strong" + }, + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/sha256.New" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/blob/load.go:89:18" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "sigkey", + "bom-ref": "crypto/material/sigkey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/internal/signature/layer.go:34:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "SignatureAnnotationKey", + "bom-ref": "crypto/material/SignatureAnnotationKey@key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/oci/static/signature.go:32:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "SigstorePrivateKeyPemType", + "bom-ref": "crypto/material/SigstorePrivateKeyPemType@private-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "private-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/keys.go:44:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "TLS", + "bom-ref": "crypto/protocol/TLS@tls", + "description": "Cryptographic protocol detected by golem source analysis", + "cryptoProperties": { + "assetType": "protocol", + "protocolProperties": { + "type": "tls" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/tls.Config" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/cmd/cosign/cli/options/registry.go:225:44" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "tokenLabel", + "bom-ref": "crypto/material/tokenLabel@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/pkcs11key/util.go:141:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableBuildkiteAgentAccessToken", + "bom-ref": "crypto/material/VariableBuildkiteAgentAccessToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:77:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableGitHubRequestToken", + "bom-ref": "crypto/material/VariableGitHubRequestToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:71:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableGitHubToken", + "bom-ref": "crypto/material/VariableGitHubToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:70:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableGitLabToken", + "bom-ref": "crypto/material/VariableGitLabToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:76:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariablePassword", + "bom-ref": "crypto/material/VariablePassword@password", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "password" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:49:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableSigstoreCTLogPublicKeyFile", + "bom-ref": "crypto/material/VariableSigstoreCTLogPublicKeyFile@public-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "public-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:57:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableSigstoreIDToken", + "bom-ref": "crypto/material/VariableSigstoreIDToken@token", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "token" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:60:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "VariableSigstoreRekorPublicKey", + "bom-ref": "crypto/material/VariableSigstoreRekorPublicKey@public-key", + "description": "Related cryptographic material indicator detected by golem source analysis; raw values are not emitted", + "cryptoProperties": { + "assetType": "related-crypto-material", + "relatedCryptoMaterialProperties": { + "type": "public-key" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "literal" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/env/env.go:59:2" + } + ], + "tags": [ + "cryptographic-asset" + ] + }, + { + "type": "cryptographic-asset", + "name": "X.509 certificate", + "bom-ref": "crypto/certificate/X.509%20certificate@x509", + "description": "Certificate asset detected by golem source analysis", + "cryptoProperties": { + "assetType": "certificate", + "algorithmProperties": { + "primitive": "unknown" + } + }, + "properties": [ + { + "name": "cdx:golem:crypto:symbol", + "value": "crypto/x509.ParsePKIXPublicKey" + }, + { + "name": "cdx:golem:crypto:usageScope", + "value": "runtime" + }, + { + "name": "cdx:golem:crypto:sourceLocation", + "value": "/Users/michelledipalma/RedHat/claude/pm/cosign/pkg/cosign/bundle/sign.go:75:18" + } + ], + "tags": [ + "cryptographic-asset" + ] + } + ], + "dependencies": [ + { + "ref": "pkg:golang/buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go@v1.36.11-20260415201107-50325440f8f2.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", + "dependsOn": [ + "pkg:golang/github.com/google/go-cmp@v0.7.0" + ] + }, + { + "ref": "pkg:golang/cloud.google.com/go/auth@v0.20.0", + "dependsOn": [ + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/s2a-go@v0.1.9", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/golang.org/x/oauth2@v0.36.0", + "pkg:golang/golang.org/x/time@v0.15.0" + ] + }, + { + "ref": "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "dependsOn": [ + "pkg:golang/github.com/google/go-cmp@v0.7.0" + ] + }, + { + "ref": "pkg:golang/cloud.google.com/go/iam@v1.11.0", + "dependsOn": [ + "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/s2a-go@v0.1.9", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/golang.org/x/oauth2@v0.36.0", + "pkg:golang/golang.org/x/time@v0.15.0" + ] + }, + { + "ref": "pkg:golang/cloud.google.com/go/kms@v1.31.0", + "dependsOn": [ + "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/s2a-go@v0.1.9", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/golang.org/x/oauth2@v0.36.0", + "pkg:golang/golang.org/x/time@v0.15.0" + ] + }, + { + "ref": "pkg:golang/cloud.google.com/go/longrunning@v1.0.0", + "dependsOn": [ + "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/s2a-go@v0.1.9", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/golang.org/x/oauth2@v0.36.0", + "pkg:golang/golang.org/x/time@v0.15.0" + ] + }, + { + "ref": "pkg:golang/connectrpc.com/connect@v1.20.0", + "dependsOn": [ + "pkg:golang/github.com/google/go-cmp@v0.7.0" + ] + }, + { + "ref": "pkg:golang/cuelabs.dev/go/oci/ociregistry@v0.0.0-20251212221603-3adeb8663819", + "dependsOn": [ + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", + "pkg:golang/github.com/rogpeppe/go-internal@v1.14.1" + ] + }, + { + "ref": "pkg:golang/cuelang.org/go@v0.16.1", + "dependsOn": [ + "pkg:golang/cuelabs.dev/go/oci/ociregistry@v0.0.0-20251212221603-3adeb8663819", + "pkg:golang/github.com/cockroachdb/apd/v3@v3.2.1", + "pkg:golang/github.com/emicklei/proto@v1.14.3", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", + "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4", + "pkg:golang/github.com/protocolbuffers/txtpbfmt@v0.0.0-20260217160748-a481f6a22f94", + "pkg:golang/github.com/rogpeppe/go-internal@v1.14.1", + "pkg:golang/github.com/spf13/cobra@v1.10.2", + "pkg:golang/github.com/spf13/pflag@v1.0.10", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/golang.org/x/oauth2@v0.36.0" + ] + }, + { + "ref": "pkg:golang/github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider@v0.14.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.22.0", + "dependsOn": [ + "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.12.0", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.14.0", + "dependsOn": [ + "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.22.0", + "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.12.0", + "pkg:golang/github.com/AzureAD/microsoft-authentication-library-for-go@v1.7.2", + "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.12.0", + "dependsOn": [ + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.5.0", + "dependsOn": [ + "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.2.0", + "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.2.0", + "dependsOn": [ + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/Azure/azure-sdk-for-go@v68.0.0+incompatible", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/Azure/go-autorest/autorest/adal@v0.9.23", + "dependsOn": [ + "pkg:golang/github.com/Azure/go-autorest/autorest/date@v0.3.0", + "pkg:golang/github.com/Azure/go-autorest/logger@v0.2.1", + "pkg:golang/github.com/Azure/go-autorest/tracing@v0.6.0" + ] + }, + { + "ref": "pkg:golang/github.com/Azure/go-autorest/autorest/azure/auth@v0.5.12", + "dependsOn": [ + "pkg:golang/github.com/Azure/go-autorest/logger@v0.2.1", + "pkg:golang/github.com/dimchansky/utfbom@v1.1.1" + ] + }, + { + "ref": "pkg:golang/github.com/Azure/go-autorest/autorest/azure/cli@v0.4.6", + "dependsOn": [ + "pkg:golang/github.com/Azure/go-autorest/autorest/date@v0.3.0", + "pkg:golang/github.com/dimchansky/utfbom@v1.1.1", + "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0" + ] + }, + { + "ref": "pkg:golang/github.com/Azure/go-autorest/autorest/date@v0.3.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/Azure/go-autorest/autorest@v0.11.29", + "dependsOn": [ + "pkg:golang/github.com/Azure/go-autorest/logger@v0.2.1", + "pkg:golang/github.com/Azure/go-autorest/tracing@v0.6.0" + ] + }, + { + "ref": "pkg:golang/github.com/Azure/go-autorest/logger@v0.2.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/Azure/go-autorest/tracing@v0.6.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/AzureAD/microsoft-authentication-library-for-go@v1.7.2", + "dependsOn": [ + "pkg:golang/github.com/kylelemons/godebug@v1.1.0" + ] + }, + { + "ref": "pkg:golang/github.com/agnivade/levenshtein@v1.2.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/alibabacloud-go/alibabacloud-gateway-spi@v0.0.4", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/alibabacloud-go/cr-20160607@v1.0.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/alibabacloud-go/cr-20181201@v1.0.10", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/alibabacloud-go/darabonba-openapi@v0.2.1", + "dependsOn": [ + "pkg:golang/github.com/alibabacloud-go/alibabacloud-gateway-spi@v0.0.4" + ] + }, + { + "ref": "pkg:golang/github.com/alibabacloud-go/debug@v1.0.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/alibabacloud-go/endpoint-util@v1.1.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/alibabacloud-go/openapi-util@v0.1.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/alibabacloud-go/tea-utils@v1.4.5", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/alibabacloud-go/tea-xml@v1.1.3", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/alibabacloud-go/tea@v1.2.1", + "dependsOn": [ + "pkg:golang/github.com/json-iterator/go@v1.1.12" + ] + }, + { + "ref": "pkg:golang/github.com/aliyun/credentials-go@v1.3.2", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.32.25", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.24", + "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.30", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.12", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.2.0", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.31.3", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.36.6", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.43.3", + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0" + ] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.24", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.30", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.12", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.2.0", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.31.3", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.36.6", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.43.3", + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0" + ] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.29", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0" + ] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.29", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0" + ] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.29", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0" + ] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.30", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0" + ] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecr@v1.55.3", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecrpublic@v1.38.10", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.12", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.29", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0" + ] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/kms@v1.53.4", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0" + ] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.2.0", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0" + ] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.31.3", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0" + ] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.36.6", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0" + ] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.43.3", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.30", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.12", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0" + ] + }, + { + "ref": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/aws/smithy-go@v1.27.2", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/awslabs/amazon-ecr-credential-helper/ecr-login@v0.12.0", + "dependsOn": [ + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecr@v1.55.3", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecrpublic@v1.38.10", + "pkg:golang/github.com/docker/docker-credential-helpers@v0.9.5", + "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", + "pkg:golang/github.com/sirupsen/logrus@v1.9.4", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/blang/semver@v3.5.1+incompatible", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/buildkite/agent/v3@v3.130.0", + "dependsOn": [ + "pkg:golang/buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go@v1.36.11-20260415201107-50325440f8f2.1", + "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", + "pkg:golang/cloud.google.com/go/auth@v0.20.0", + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/cloud.google.com/go/kms@v1.31.0", + "pkg:golang/connectrpc.com/connect@v1.20.0", + "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.22.0", + "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.14.0", + "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.12.0", + "pkg:golang/github.com/AzureAD/microsoft-authentication-library-for-go@v1.7.2", + "pkg:golang/github.com/agnivade/levenshtein@v1.2.1", + "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.32.25", + "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.24", + "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.30", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.12", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.29", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/kms@v1.53.4", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.2.0", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.31.3", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.36.6", + "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.43.3", + "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.42.0", + "pkg:golang/github.com/aws/smithy-go@v1.27.2", + "pkg:golang/github.com/buildkite/go-pipeline@v0.17.1", + "pkg:golang/github.com/buildkite/interpolate@v0.1.5", + "pkg:golang/github.com/buildkite/roko@v1.4.0", + "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.7", + "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "pkg:golang/github.com/dustin/go-humanize@v1.0.1", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-chi/chi/v5@v5.3.0", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/go-querystring@v1.2.0", + "pkg:golang/github.com/google/s2a-go@v0.1.9", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.16", + "pkg:golang/github.com/googleapis/gax-go/v2@v2.22.0", + "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.29.0", + "pkg:golang/github.com/json-iterator/go@v1.1.12", + "pkg:golang/github.com/klauspost/compress@v1.18.6", + "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "pkg:golang/github.com/lestrrat-go/blackmagic@v1.0.4", + "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1", + "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", + "pkg:golang/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", + "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", + "pkg:golang/github.com/oleiade/reflections@v1.1.0", + "pkg:golang/github.com/pborman/uuid@v1.2.1", + "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", + "pkg:golang/github.com/pkg/errors@v0.9.1", + "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.68.0", + "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.68.0", + "pkg:golang/go.opentelemetry.io/otel/metric@v1.44.0", + "pkg:golang/go.opentelemetry.io/otel/trace@v1.44.0", + "pkg:golang/go.opentelemetry.io/otel@v1.44.0", + "pkg:golang/go.uber.org/multierr@v1.11.0", + "pkg:golang/go.yaml.in/yaml/v2@v2.4.4", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/golang.org/x/crypto@v0.53.0", + "pkg:golang/golang.org/x/net@v0.56.0", + "pkg:golang/golang.org/x/oauth2@v0.36.0", + "pkg:golang/golang.org/x/sync@v0.21.0", + "pkg:golang/golang.org/x/sys@v0.46.0", + "pkg:golang/golang.org/x/term@v0.44.0", + "pkg:golang/golang.org/x/text@v0.38.0", + "pkg:golang/golang.org/x/time@v0.15.0", + "pkg:golang/google.golang.org/api@v0.284.0", + "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260526163538-3dc84a4a5aaa", + "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260526163538-3dc84a4a5aaa", + "pkg:golang/google.golang.org/genproto@v0.0.0-20260406210006-6f92a3bedf2d", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/buildkite/go-pipeline@v0.17.1", + "dependsOn": [ + "pkg:golang/github.com/buildkite/interpolate@v0.1.5", + "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1", + "pkg:golang/github.com/oleiade/reflections@v1.1.0", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/buildkite/interpolate@v0.1.5", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/buildkite/roko@v1.4.0", + "dependsOn": [ + "pkg:golang/github.com/google/go-cmp@v0.7.0" + ] + }, + { + "ref": "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/chrismellard/docker-credential-acr-env@v0.0.0-20230304212654-82a0ddb27589", + "dependsOn": [ + "pkg:golang/github.com/Azure/go-autorest/autorest/date@v0.3.0", + "pkg:golang/github.com/Azure/go-autorest/logger@v0.2.1", + "pkg:golang/github.com/Azure/go-autorest/tracing@v0.6.0", + "pkg:golang/github.com/dimchansky/utfbom@v1.1.1", + "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0" + ] + }, + { + "ref": "pkg:golang/github.com/clbanning/mxj/v2@v2.7.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/cockroachdb/apd/v3@v3.2.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/common-nighthawk/go-figure@v0.0.0-20210622060536-734e95fb86be", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/coreos/go-oidc/v3@v3.18.0", + "dependsOn": [ + "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "pkg:golang/golang.org/x/oauth2@v0.36.0" + ] + }, + { + "ref": "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.7", + "dependsOn": [ + "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0" + ] + }, + { + "ref": "pkg:golang/github.com/cyberphone/json-canonicalization@v0.0.0-20241213102144-19d51d7fe467", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/dimchansky/utfbom@v1.1.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/docker/cli@v29.5.3+incompatible", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/docker/docker-credential-helpers@v0.9.5", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/dustin/go-humanize@v1.0.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/emicklei/go-restful/v3@v3.13.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/emicklei/proto@v1.14.3", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/fsnotify/fsnotify@v1.10.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.0", + "dependsOn": [ + "pkg:golang/github.com/x448/float16@v0.8.4" + ] + }, + { + "ref": "pkg:golang/github.com/go-chi/chi/v5@v5.3.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-logr/logr@v1.4.3", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-openapi/analysis@v0.25.2", + "dependsOn": [ + "pkg:golang/github.com/go-openapi/jsonpointer@v0.23.1", + "pkg:golang/github.com/go-openapi/jsonreference@v0.21.6", + "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4" + ] + }, + { + "ref": "pkg:golang/github.com/go-openapi/errors@v0.22.8", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-openapi/jsonpointer@v0.23.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-openapi/jsonreference@v0.21.6", + "dependsOn": [ + "pkg:golang/github.com/go-openapi/jsonpointer@v0.23.1" + ] + }, + { + "ref": "pkg:golang/github.com/go-openapi/loads@v0.24.0", + "dependsOn": [ + "pkg:golang/github.com/go-openapi/analysis@v0.25.2", + "pkg:golang/github.com/go-openapi/errors@v0.22.8", + "pkg:golang/github.com/go-openapi/jsonpointer@v0.23.1", + "pkg:golang/github.com/go-openapi/jsonreference@v0.21.6", + "pkg:golang/github.com/go-openapi/swag/jsonname@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/loading@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/mangling@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/stringutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.26.1", + "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4" + ] + }, + { + "ref": "pkg:golang/github.com/go-openapi/runtime/server-middleware@v0.30.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-openapi/runtime@v0.32.4", + "dependsOn": [ + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/go-openapi/analysis@v0.25.2", + "pkg:golang/github.com/go-openapi/errors@v0.22.8", + "pkg:golang/github.com/go-openapi/jsonpointer@v0.23.1", + "pkg:golang/github.com/go-openapi/jsonreference@v0.21.6", + "pkg:golang/github.com/go-openapi/loads@v0.24.0", + "pkg:golang/github.com/go-openapi/runtime/server-middleware@v0.30.0", + "pkg:golang/github.com/go-openapi/spec@v0.22.6", + "pkg:golang/github.com/go-openapi/swag/fileutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/jsonname@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/loading@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/mangling@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/stringutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.26.1", + "pkg:golang/github.com/go-openapi/validate@v0.26.0", + "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/go.opentelemetry.io/otel/metric@v1.44.0", + "pkg:golang/go.opentelemetry.io/otel/trace@v1.44.0", + "pkg:golang/go.opentelemetry.io/otel@v1.44.0", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/golang.org/x/sync@v0.21.0" + ] + }, + { + "ref": "pkg:golang/github.com/go-openapi/spec@v0.22.6", + "dependsOn": [ + "pkg:golang/github.com/go-openapi/jsonpointer@v0.23.1", + "pkg:golang/github.com/go-openapi/jsonreference@v0.21.6", + "pkg:golang/github.com/go-openapi/swag/jsonname@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/loading@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/stringutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.26.1", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4" + ] + }, + { + "ref": "pkg:golang/github.com/go-openapi/strfmt@v0.26.4", + "dependsOn": [ + "pkg:golang/github.com/go-openapi/errors@v0.22.8", + "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", + "pkg:golang/golang.org/x/net@v0.56.0", + "pkg:golang/golang.org/x/text@v0.38.0" + ] + }, + { + "ref": "pkg:golang/github.com/go-openapi/swag/cmdutils@v0.26.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-openapi/swag/conv@v0.27.0", + "dependsOn": [ + "pkg:golang/github.com/go-openapi/swag/typeutils@v0.27.0" + ] + }, + { + "ref": "pkg:golang/github.com/go-openapi/swag/fileutils@v0.26.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-openapi/swag/jsonname@v0.26.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.26.1", + "dependsOn": [ + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4" + ] + }, + { + "ref": "pkg:golang/github.com/go-openapi/swag/loading@v0.26.1", + "dependsOn": [ + "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.26.1", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4" + ] + }, + { + "ref": "pkg:golang/github.com/go-openapi/swag/mangling@v0.26.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-openapi/swag/netutils@v0.26.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-openapi/swag/stringutils@v0.26.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-openapi/swag/typeutils@v0.27.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.26.1", + "dependsOn": [ + "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.26.1", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4" + ] + }, + { + "ref": "pkg:golang/github.com/go-openapi/swag@v0.26.1", + "dependsOn": [ + "pkg:golang/github.com/go-openapi/swag/cmdutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/fileutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/jsonname@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/loading@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/mangling@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/netutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/stringutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.26.1", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4" + ] + }, + { + "ref": "pkg:golang/github.com/go-openapi/validate@v0.26.0", + "dependsOn": [ + "pkg:golang/github.com/go-openapi/analysis@v0.25.2", + "pkg:golang/github.com/go-openapi/errors@v0.22.8", + "pkg:golang/github.com/go-openapi/jsonpointer@v0.23.1", + "pkg:golang/github.com/go-openapi/jsonreference@v0.21.6", + "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4" + ] + }, + { + "ref": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/gobwas/glob@v0.2.3", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/golang-jwt/jwt/v4@v4.5.2", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/golang/snappy@v0.0.4", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/google/certificate-transparency-go@v1.3.3", + "dependsOn": [ + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "pkg:golang/github.com/dustin/go-humanize@v1.0.1", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/s2a-go@v0.1.9", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", + "pkg:golang/github.com/spf13/cobra@v1.10.2", + "pkg:golang/github.com/spf13/pflag@v1.0.10", + "pkg:golang/github.com/transparency-dev/merkle@v0.0.2", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/go.uber.org/multierr@v1.11.0", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/google/gnostic-models@v0.7.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/google/go-cmp@v0.7.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/google/go-containerregistry@v0.21.7", + "dependsOn": [ + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.7", + "pkg:golang/github.com/docker/cli@v29.5.3+incompatible", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/klauspost/compress@v1.18.6", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", + "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", + "pkg:golang/github.com/sirupsen/logrus@v1.9.4", + "pkg:golang/github.com/spf13/cobra@v1.10.2", + "pkg:golang/github.com/spf13/pflag@v1.0.10", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/golang.org/x/mod@v0.37.0", + "pkg:golang/golang.org/x/oauth2@v0.36.0", + "pkg:golang/golang.org/x/sync@v0.21.0", + "pkg:golang/golang.org/x/sys@v0.46.0" + ] + }, + { + "ref": "pkg:golang/github.com/google/go-github/v88@v88.0.0", + "dependsOn": [ + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/go-querystring@v1.2.0" + ] + }, + { + "ref": "pkg:golang/github.com/google/go-querystring@v1.2.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/google/s2a-go@v0.1.9", + "dependsOn": [ + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-logr/stdr@v1.2.2" + ] + }, + { + "ref": "pkg:golang/github.com/google/uuid@v1.6.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.16", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/googleapis/gax-go/v2@v2.22.0", + "dependsOn": [ + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1" + ] + }, + { + "ref": "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.29.0", + "dependsOn": [ + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/golang.org/x/oauth2@v0.36.0" + ] + }, + { + "ref": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", + "dependsOn": [ + "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2" + ] + }, + { + "ref": "pkg:golang/github.com/hashicorp/go-rootcerts@v1.0.2", + "dependsOn": [ + "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0" + ] + }, + { + "ref": "pkg:golang/github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0", + "dependsOn": [ + "pkg:golang/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2", + "pkg:golang/github.com/ryanuber/go-glob@v1.0.0", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2", + "dependsOn": [ + "pkg:golang/github.com/ryanuber/go-glob@v1.0.0" + ] + }, + { + "ref": "pkg:golang/github.com/hashicorp/go-sockaddr@v1.0.7", + "dependsOn": [ + "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", + "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/hashicorp/hcl@v1.0.1-vault-7", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/hashicorp/vault/api@v1.22.0", + "dependsOn": [ + "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", + "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", + "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", + "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", + "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", + "pkg:golang/github.com/hashicorp/go-rootcerts@v1.0.2", + "pkg:golang/github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0", + "pkg:golang/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2", + "pkg:golang/github.com/hashicorp/go-sockaddr@v1.0.7", + "pkg:golang/github.com/hashicorp/hcl@v1.0.1-vault-7", + "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", + "pkg:golang/github.com/natefinch/atomic@v1.0.1", + "pkg:golang/github.com/ryanuber/go-glob@v1.0.0", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/in-toto/attestation@v1.2.0", + "dependsOn": [ + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/in-toto/in-toto-golang@v0.11.0", + "dependsOn": [ + "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.7", + "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", + "pkg:golang/github.com/shibumi/go-pathspec@v1.3.0", + "pkg:golang/github.com/spf13/cobra@v1.10.2", + "pkg:golang/github.com/spf13/pflag@v1.0.10", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/jedisct1/go-minisign@v0.0.0-20230811132847-661be99b8267", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/jellydator/ttlcache/v3@v3.4.0", + "dependsOn": [ + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/json-iterator/go@v1.1.12", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/kelseyhightower/envconfig@v1.4.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/klauspost/compress@v1.18.6", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/lestrrat-go/blackmagic@v1.0.4", + "dependsOn": [ + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/lestrrat-go/dsig@v1.2.1", + "dependsOn": [ + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/lestrrat-go/httprc/v3@v3.0.5", + "dependsOn": [ + "pkg:golang/github.com/lestrrat-go/blackmagic@v1.0.4", + "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1", + "pkg:golang/github.com/lestrrat-go/option/v2@v2.0.0", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/lestrrat-go/jwx/v3@v3.1.1", + "dependsOn": [ + "pkg:golang/github.com/lestrrat-go/blackmagic@v1.0.4", + "pkg:golang/github.com/lestrrat-go/dsig@v1.2.1", + "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1", + "pkg:golang/github.com/lestrrat-go/httprc/v3@v3.0.5", + "pkg:golang/github.com/lestrrat-go/option/v2@v2.0.0", + "pkg:golang/github.com/valyala/fastjson@v1.6.10", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/lestrrat-go/option/v2@v2.0.0", + "dependsOn": [ + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/letsencrypt/boulder@v0.20260309.0", + "dependsOn": [ + "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", + "pkg:golang/github.com/titanous/rocacheck@v0.0.0-20171023193734-afe73141d399", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4" + ] + }, + { + "ref": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.1-0.20231216201459-8508981c8b6c", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/moby/term@v0.5.2", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/mozillazg/docker-credential-acr-helper@v0.4.0", + "dependsOn": [ + "pkg:golang/github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider@v0.14.0", + "pkg:golang/github.com/alibabacloud-go/alibabacloud-gateway-spi@v0.0.4", + "pkg:golang/github.com/alibabacloud-go/cr-20160607@v1.0.1", + "pkg:golang/github.com/alibabacloud-go/cr-20181201@v1.0.10", + "pkg:golang/github.com/alibabacloud-go/endpoint-util@v1.1.1", + "pkg:golang/github.com/aliyun/credentials-go@v1.3.2" + ] + }, + { + "ref": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/natefinch/atomic@v1.0.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/nozzle/throttler@v0.0.0-20180817012639-2ea982251481", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/oleiade/reflections@v1.1.0", + "dependsOn": [ + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/open-policy-agent/opa@v1.17.1", + "dependsOn": [ + "pkg:golang/github.com/agnivade/levenshtein@v1.2.1", + "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.7", + "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "pkg:golang/github.com/dustin/go-humanize@v1.0.1", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/fsnotify/fsnotify@v1.10.1", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/gobwas/glob@v0.2.3", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "pkg:golang/github.com/lestrrat-go/blackmagic@v1.0.4", + "pkg:golang/github.com/lestrrat-go/dsig@v1.2.1", + "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1", + "pkg:golang/github.com/lestrrat-go/httprc/v3@v3.0.5", + "pkg:golang/github.com/lestrrat-go/jwx/v3@v3.1.1", + "pkg:golang/github.com/lestrrat-go/option/v2@v2.0.0", + "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", + "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4", + "pkg:golang/github.com/rcrowley/go-metrics@v0.0.0-20250401214520-65e299d6c5c9", + "pkg:golang/github.com/rogpeppe/go-internal@v1.14.1", + "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", + "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", + "pkg:golang/github.com/sirupsen/logrus@v1.9.4", + "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", + "pkg:golang/github.com/spf13/afero@v1.15.0", + "pkg:golang/github.com/spf13/cast@v1.10.0", + "pkg:golang/github.com/spf13/cobra@v1.10.2", + "pkg:golang/github.com/spf13/pflag@v1.0.10", + "pkg:golang/github.com/spf13/viper@v1.21.0", + "pkg:golang/github.com/subosito/gotenv@v1.6.0", + "pkg:golang/github.com/tchap/go-patricia/v2@v2.3.3", + "pkg:golang/github.com/valyala/fastjson@v1.6.10", + "pkg:golang/github.com/vektah/gqlparser/v2@v2.5.33", + "pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20190905194746-02993c407bfb", + "pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", + "pkg:golang/github.com/yashtewari/glob-intersection@v0.2.0", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.68.0", + "pkg:golang/go.yaml.in/yaml/v2@v2.4.4", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/golang.org/x/time@v0.15.0", + "pkg:golang/sigs.k8s.io/yaml@v1.6.0" + ] + }, + { + "ref": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", + "dependsOn": [ + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0" + ] + }, + { + "ref": "pkg:golang/github.com/pborman/uuid@v1.2.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/pkg/errors@v0.9.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/protocolbuffers/txtpbfmt@v0.0.0-20260217160748-a481f6a22f94", + "dependsOn": [ + "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/rcrowley/go-metrics@v0.0.0-20250401214520-65e299d6c5c9", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/rogpeppe/go-internal@v1.14.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/ryanuber/go-glob@v1.0.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", + "dependsOn": [ + "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", + "pkg:golang/github.com/spf13/afero@v1.15.0" + ] + }, + { + "ref": "pkg:golang/github.com/sassoftware/relic@v7.2.1+incompatible", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "dependsOn": [ + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/shibumi/go-pathspec@v1.3.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/sigstore/cosign/v3", + "dependsOn": [ + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/cuelang.org/go@v0.16.1", + "pkg:golang/github.com/awslabs/amazon-ecr-credential-helper/ecr-login@v0.12.0", + "pkg:golang/github.com/buildkite/agent/v3@v3.130.0", + "pkg:golang/github.com/chrismellard/docker-credential-acr-env@v0.0.0-20230304212654-82a0ddb27589", + "pkg:golang/github.com/cyberphone/json-canonicalization@v0.0.0-20241213102144-19d51d7fe467", + "pkg:golang/github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7", + "pkg:golang/github.com/dustin/go-humanize@v1.0.1", + "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "pkg:golang/github.com/go-openapi/runtime@v0.32.4", + "pkg:golang/github.com/go-openapi/strfmt@v0.26.4", + "pkg:golang/github.com/go-openapi/swag/conv@v0.27.0", + "pkg:golang/github.com/google/certificate-transparency-go@v1.3.3", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/go-containerregistry@v0.21.7", + "pkg:golang/github.com/google/go-github/v88@v88.0.0", + "pkg:golang/github.com/in-toto/attestation@v1.2.0", + "pkg:golang/github.com/in-toto/in-toto-golang@v0.11.0", + "pkg:golang/github.com/kelseyhightower/envconfig@v1.4.0", + "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1", + "pkg:golang/github.com/moby/term@v0.5.2", + "pkg:golang/github.com/mozillazg/docker-credential-acr-helper@v0.4.0", + "pkg:golang/github.com/nozzle/throttler@v0.0.0-20180817012639-2ea982251481", + "pkg:golang/github.com/open-policy-agent/opa@v1.17.1", + "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "pkg:golang/github.com/sigstore/protobuf-specs@v0.5.1", + "pkg:golang/github.com/sigstore/rekor-tiles/v2@v2.3.0", + "pkg:golang/github.com/sigstore/rekor@v1.5.3", + "pkg:golang/github.com/sigstore/sigstore-go@v1.2.2", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/aws@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/azure@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/gcp@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/hashivault@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore@v1.10.8", + "pkg:golang/github.com/sigstore/timestamp-authority/v2@v2.1.2", + "pkg:golang/github.com/spf13/cobra@v1.10.2", + "pkg:golang/github.com/spf13/pflag@v1.0.10", + "pkg:golang/github.com/spf13/viper@v1.21.0", + "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.7.0", + "pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.4.2", + "pkg:golang/github.com/transparency-dev/merkle@v0.0.2", + "pkg:golang/github.com/withfig/autocomplete-tools/integrations/cobra@v1.2.1", + "pkg:golang/gitlab.com/gitlab-org/api/client-go@v1.46.0", + "pkg:golang/golang.org/x/crypto@v0.53.0", + "pkg:golang/golang.org/x/oauth2@v0.36.0", + "pkg:golang/golang.org/x/sync@v0.21.0", + "pkg:golang/golang.org/x/term@v0.44.0", + "pkg:golang/google.golang.org/api@v0.284.0", + "pkg:golang/google.golang.org/protobuf@v1.36.12-0.20260120151049-f2248ac996af", + "pkg:golang/k8s.io/api@v0.36.2", + "pkg:golang/k8s.io/apimachinery@v0.36.2", + "pkg:golang/k8s.io/client-go@v0.36.2", + "pkg:golang/k8s.io/utils@v0.0.0-20260210185600-b8788abfbbc2", + "pkg:golang/sigs.k8s.io/release-utils@v0.12.4" + ] + }, + { + "ref": "pkg:golang/github.com/sigstore/protobuf-specs@v0.5.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/sigstore/rekor-tiles/v2@v2.3.0", + "dependsOn": [ + "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", + "pkg:golang/cloud.google.com/go/auth@v0.20.0", + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/cloud.google.com/go/kms@v1.31.0", + "pkg:golang/github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2", + "pkg:golang/github.com/blang/semver@v3.5.1+incompatible", + "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/common-nighthawk/go-figure@v0.0.0-20210622060536-734e95fb86be", + "pkg:golang/github.com/cyberphone/json-canonicalization@v0.0.0-20241213102144-19d51d7fe467", + "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "pkg:golang/github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352", + "pkg:golang/github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7", + "pkg:golang/github.com/dustin/go-humanize@v1.0.1", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/s2a-go@v0.1.9", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.16", + "pkg:golang/github.com/googleapis/gax-go/v2@v2.22.0", + "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.29.0", + "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", + "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", + "pkg:golang/github.com/jellydator/ttlcache/v3@v3.4.0", + "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", + "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4", + "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", + "pkg:golang/github.com/pkg/errors@v0.9.1", + "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", + "pkg:golang/github.com/sassoftware/relic@v7.2.1+incompatible", + "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "pkg:golang/github.com/shibumi/go-pathspec@v1.3.0", + "pkg:golang/github.com/sigstore/protobuf-specs@v0.5.1", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/aws@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/gcp@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore@v1.10.8", + "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", + "pkg:golang/github.com/spf13/afero@v1.15.0", + "pkg:golang/github.com/spf13/cast@v1.10.0", + "pkg:golang/github.com/spf13/cobra@v1.10.2", + "pkg:golang/github.com/spf13/pflag@v1.0.10", + "pkg:golang/github.com/spf13/viper@v1.21.0", + "pkg:golang/github.com/subosito/gotenv@v1.6.0", + "pkg:golang/github.com/theupdateframework/go-tuf@v0.7.0", + "pkg:golang/github.com/tink-crypto/tink-go-awskms/v3@v3.0.0", + "pkg:golang/github.com/tink-crypto/tink-go-gcpkms/v2@v2.2.0", + "pkg:golang/github.com/tink-crypto/tink-go/v2@v2.6.0", + "pkg:golang/github.com/transparency-dev/merkle@v0.0.2", + "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/go.opentelemetry.io/otel/metric@v1.44.0", + "pkg:golang/go.opentelemetry.io/otel/trace@v1.44.0", + "pkg:golang/go.opentelemetry.io/otel@v1.44.0", + "pkg:golang/go.yaml.in/yaml/v2@v2.4.4", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/golang.org/x/oauth2@v0.36.0", + "pkg:golang/golang.org/x/time@v0.15.0", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1", + "pkg:golang/k8s.io/klog/v2@v2.140.0", + "pkg:golang/sigs.k8s.io/release-utils@v0.12.4" + ] + }, + { + "ref": "pkg:golang/github.com/sigstore/rekor@v1.5.3", + "dependsOn": [ + "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.2.0", + "pkg:golang/github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2", + "pkg:golang/github.com/blang/semver@v3.5.1+incompatible", + "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/common-nighthawk/go-figure@v0.0.0-20210622060536-734e95fb86be", + "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.0", + "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/go-openapi/analysis@v0.25.2", + "pkg:golang/github.com/go-openapi/errors@v0.22.8", + "pkg:golang/github.com/go-openapi/jsonpointer@v0.23.1", + "pkg:golang/github.com/go-openapi/jsonreference@v0.21.6", + "pkg:golang/github.com/go-openapi/loads@v0.24.0", + "pkg:golang/github.com/go-openapi/runtime/server-middleware@v0.30.0", + "pkg:golang/github.com/go-openapi/runtime@v0.32.4", + "pkg:golang/github.com/go-openapi/spec@v0.22.6", + "pkg:golang/github.com/go-openapi/strfmt@v0.26.4", + "pkg:golang/github.com/go-openapi/swag/cmdutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/fileutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/jsonname@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/loading@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/mangling@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/netutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/stringutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag@v0.26.1", + "pkg:golang/github.com/go-openapi/validate@v0.26.0", + "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/s2a-go@v0.1.9", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/googleapis/gax-go/v2@v2.22.0", + "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", + "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", + "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", + "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", + "pkg:golang/github.com/hashicorp/go-rootcerts@v1.0.2", + "pkg:golang/github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0", + "pkg:golang/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2", + "pkg:golang/github.com/hashicorp/go-sockaddr@v1.0.7", + "pkg:golang/github.com/hashicorp/hcl@v1.0.1-vault-7", + "pkg:golang/github.com/hashicorp/vault/api@v1.22.0", + "pkg:golang/github.com/jellydator/ttlcache/v3@v3.4.0", + "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", + "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", + "pkg:golang/github.com/natefinch/atomic@v1.0.1", + "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4", + "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", + "pkg:golang/github.com/pkg/errors@v0.9.1", + "pkg:golang/github.com/ryanuber/go-glob@v1.0.0", + "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", + "pkg:golang/github.com/sassoftware/relic@v7.2.1+incompatible", + "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "pkg:golang/github.com/shibumi/go-pathspec@v1.3.0", + "pkg:golang/github.com/sigstore/protobuf-specs@v0.5.1", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/aws@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/azure@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/gcp@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/hashivault@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore@v1.10.8", + "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", + "pkg:golang/github.com/spf13/afero@v1.15.0", + "pkg:golang/github.com/spf13/cast@v1.10.0", + "pkg:golang/github.com/spf13/cobra@v1.10.2", + "pkg:golang/github.com/spf13/pflag@v1.0.10", + "pkg:golang/github.com/spf13/viper@v1.21.0", + "pkg:golang/github.com/subosito/gotenv@v1.6.0", + "pkg:golang/github.com/theupdateframework/go-tuf@v0.7.0", + "pkg:golang/github.com/tink-crypto/tink-go-awskms/v3@v3.0.0", + "pkg:golang/github.com/tink-crypto/tink-go-gcpkms/v2@v2.2.0", + "pkg:golang/github.com/tink-crypto/tink-go/v2@v2.6.0", + "pkg:golang/github.com/transparency-dev/merkle@v0.0.2", + "pkg:golang/github.com/x448/float16@v0.8.4", + "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/go.opentelemetry.io/otel/metric@v1.44.0", + "pkg:golang/go.opentelemetry.io/otel/trace@v1.44.0", + "pkg:golang/go.opentelemetry.io/otel@v1.44.0", + "pkg:golang/go.uber.org/multierr@v1.11.0", + "pkg:golang/go.uber.org/zap@v1.28.0", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/golang.org/x/crypto@v0.53.0", + "pkg:golang/golang.org/x/net@v0.56.0", + "pkg:golang/golang.org/x/oauth2@v0.36.0", + "pkg:golang/golang.org/x/sync@v0.21.0", + "pkg:golang/golang.org/x/sys@v0.46.0", + "pkg:golang/golang.org/x/term@v0.44.0", + "pkg:golang/golang.org/x/text@v0.38.0", + "pkg:golang/golang.org/x/time@v0.15.0", + "pkg:golang/google.golang.org/grpc@v1.82.0", + "pkg:golang/gopkg.in/ini.v1@v1.67.3", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1", + "pkg:golang/k8s.io/klog/v2@v2.140.0", + "pkg:golang/sigs.k8s.io/release-utils@v0.12.4", + "pkg:golang/sigs.k8s.io/yaml@v1.6.0" + ] + }, + { + "ref": "pkg:golang/github.com/sigstore/sigstore-go@v1.2.2", + "dependsOn": [ + "pkg:golang/github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2", + "pkg:golang/github.com/blang/semver@v3.5.1+incompatible", + "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/cyberphone/json-canonicalization@v0.0.0-20241213102144-19d51d7fe467", + "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "pkg:golang/github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352", + "pkg:golang/github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7", + "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/go-openapi/analysis@v0.25.2", + "pkg:golang/github.com/go-openapi/errors@v0.22.8", + "pkg:golang/github.com/go-openapi/jsonpointer@v0.23.1", + "pkg:golang/github.com/go-openapi/jsonreference@v0.21.6", + "pkg:golang/github.com/go-openapi/loads@v0.24.0", + "pkg:golang/github.com/go-openapi/runtime/server-middleware@v0.30.0", + "pkg:golang/github.com/go-openapi/runtime@v0.32.4", + "pkg:golang/github.com/go-openapi/spec@v0.22.6", + "pkg:golang/github.com/go-openapi/strfmt@v0.26.4", + "pkg:golang/github.com/go-openapi/swag/cmdutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/conv@v0.27.0", + "pkg:golang/github.com/go-openapi/swag/fileutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/jsonname@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/loading@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/mangling@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/netutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/stringutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag/typeutils@v0.27.0", + "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.26.1", + "pkg:golang/github.com/go-openapi/swag@v0.26.1", + "pkg:golang/github.com/go-openapi/validate@v0.26.0", + "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", + "pkg:golang/github.com/google/certificate-transparency-go@v1.3.3", + "pkg:golang/github.com/google/go-containerregistry@v0.21.7", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.29.0", + "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", + "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", + "pkg:golang/github.com/in-toto/attestation@v1.2.0", + "pkg:golang/github.com/in-toto/in-toto-golang@v0.11.0", + "pkg:golang/github.com/letsencrypt/boulder@v0.20260309.0", + "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", + "pkg:golang/github.com/pkg/errors@v0.9.1", + "pkg:golang/github.com/sassoftware/relic@v7.2.1+incompatible", + "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "pkg:golang/github.com/shibumi/go-pathspec@v1.3.0", + "pkg:golang/github.com/sigstore/protobuf-specs@v0.5.1", + "pkg:golang/github.com/sigstore/rekor-tiles/v2@v2.3.0", + "pkg:golang/github.com/sigstore/rekor@v1.5.3", + "pkg:golang/github.com/sigstore/sigstore@v1.10.8", + "pkg:golang/github.com/sigstore/timestamp-authority/v2@v2.1.2", + "pkg:golang/github.com/spf13/cobra@v1.10.2", + "pkg:golang/github.com/spf13/pflag@v1.0.10", + "pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.4.2", + "pkg:golang/github.com/theupdateframework/go-tuf@v0.7.0", + "pkg:golang/github.com/titanous/rocacheck@v0.0.0-20171023193734-afe73141d399", + "pkg:golang/github.com/transparency-dev/formats@v0.1.1", + "pkg:golang/github.com/transparency-dev/merkle@v0.0.2", + "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/go.opentelemetry.io/otel/metric@v1.44.0", + "pkg:golang/go.opentelemetry.io/otel/trace@v1.44.0", + "pkg:golang/go.opentelemetry.io/otel@v1.44.0", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/golang.org/x/crypto@v0.53.0", + "pkg:golang/golang.org/x/mod@v0.37.0", + "pkg:golang/golang.org/x/net@v0.56.0", + "pkg:golang/golang.org/x/oauth2@v0.36.0", + "pkg:golang/golang.org/x/sync@v0.21.0", + "pkg:golang/golang.org/x/sys@v0.46.0", + "pkg:golang/golang.org/x/term@v0.44.0", + "pkg:golang/golang.org/x/text@v0.38.0", + "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260526163538-3dc84a4a5aaa", + "pkg:golang/google.golang.org/grpc@v1.82.0", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1", + "pkg:golang/k8s.io/klog/v2@v2.140.0" + ] + }, + { + "ref": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/aws@v1.10.8", + "dependsOn": [ + "pkg:golang/github.com/jellydator/ttlcache/v3@v3.4.0", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/azure@v1.10.8", + "dependsOn": [ + "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.2.0", + "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/jellydator/ttlcache/v3@v3.4.0", + "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", + "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78" + ] + }, + { + "ref": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/gcp@v1.10.8", + "dependsOn": [ + "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/s2a-go@v0.1.9", + "pkg:golang/github.com/jellydator/ttlcache/v3@v3.4.0", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1" + ] + }, + { + "ref": "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/hashivault@v1.10.8", + "dependsOn": [ + "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", + "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", + "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", + "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", + "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", + "pkg:golang/github.com/hashicorp/go-rootcerts@v1.0.2", + "pkg:golang/github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0", + "pkg:golang/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2", + "pkg:golang/github.com/hashicorp/go-sockaddr@v1.0.7", + "pkg:golang/github.com/hashicorp/hcl@v1.0.1-vault-7", + "pkg:golang/github.com/hashicorp/vault/api@v1.22.0", + "pkg:golang/github.com/jellydator/ttlcache/v3@v3.4.0", + "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", + "pkg:golang/github.com/natefinch/atomic@v1.0.1", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/ryanuber/go-glob@v1.0.0", + "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/sigstore/sigstore@v1.10.8", + "dependsOn": [ + "pkg:golang/github.com/golang/snappy@v0.0.4", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/letsencrypt/boulder@v0.20260309.0", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "pkg:golang/github.com/syndtr/goleveldb@v1.0.1-0.20220721030215-126854af5e6d", + "pkg:golang/github.com/theupdateframework/go-tuf@v0.7.0", + "pkg:golang/github.com/tink-crypto/tink-go/v2@v2.6.0", + "pkg:golang/github.com/titanous/rocacheck@v0.0.0-20171023193734-afe73141d399", + "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/sigstore/timestamp-authority/v2@v2.1.2", + "dependsOn": [ + "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", + "pkg:golang/cloud.google.com/go/auth@v0.20.0", + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/cloud.google.com/go/iam@v1.11.0", + "pkg:golang/cloud.google.com/go/kms@v1.31.0", + "pkg:golang/cloud.google.com/go/longrunning@v1.0.0", + "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/internal@v1.12.0", + "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys@v1.5.0", + "pkg:golang/github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal@v1.2.0", + "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/common-nighthawk/go-figure@v0.0.0-20210622060536-734e95fb86be", + "pkg:golang/github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352", + "pkg:golang/github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-chi/chi/v5@v5.3.0", + "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/go-openapi/jsonpointer@v0.23.1", + "pkg:golang/github.com/go-openapi/runtime/server-middleware@v0.30.0", + "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", + "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/s2a-go@v0.1.9", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/googleapis/gax-go/v2@v2.22.0", + "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", + "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", + "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", + "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", + "pkg:golang/github.com/hashicorp/go-rootcerts@v1.0.2", + "pkg:golang/github.com/hashicorp/go-secure-stdlib/parseutil@v0.2.0", + "pkg:golang/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2", + "pkg:golang/github.com/hashicorp/go-sockaddr@v1.0.7", + "pkg:golang/github.com/hashicorp/hcl@v1.0.1-vault-7", + "pkg:golang/github.com/hashicorp/vault/api@v1.22.0", + "pkg:golang/github.com/jellydator/ttlcache/v3@v3.4.0", + "pkg:golang/github.com/kylelemons/godebug@v1.1.0", + "pkg:golang/github.com/letsencrypt/boulder@v0.20260309.0", + "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", + "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", + "pkg:golang/github.com/natefinch/atomic@v1.0.1", + "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4", + "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", + "pkg:golang/github.com/pkg/errors@v0.9.1", + "pkg:golang/github.com/ryanuber/go-glob@v1.0.0", + "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", + "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/aws@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/azure@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/gcp@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore/pkg/signature/kms/hashivault@v1.10.8", + "pkg:golang/github.com/sigstore/sigstore@v1.10.8", + "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", + "pkg:golang/github.com/spf13/afero@v1.15.0", + "pkg:golang/github.com/spf13/cast@v1.10.0", + "pkg:golang/github.com/spf13/cobra@v1.10.2", + "pkg:golang/github.com/spf13/pflag@v1.0.10", + "pkg:golang/github.com/spf13/viper@v1.21.0", + "pkg:golang/github.com/subosito/gotenv@v1.6.0", + "pkg:golang/github.com/tink-crypto/tink-go-awskms/v3@v3.0.0", + "pkg:golang/github.com/tink-crypto/tink-go-gcpkms/v2@v2.2.0", + "pkg:golang/github.com/tink-crypto/tink-go-hcvault/v2@v2.5.0", + "pkg:golang/github.com/tink-crypto/tink-go/v2@v2.6.0", + "pkg:golang/github.com/titanous/rocacheck@v0.0.0-20171023193734-afe73141d399", + "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/go.uber.org/multierr@v1.11.0", + "pkg:golang/go.uber.org/zap@v1.28.0", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/golang.org/x/oauth2@v0.36.0", + "pkg:golang/golang.org/x/time@v0.15.0", + "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260526163538-3dc84a4a5aaa", + "pkg:golang/sigs.k8s.io/release-utils@v0.12.4", + "pkg:golang/sigs.k8s.io/yaml@v1.6.0" + ] + }, + { + "ref": "pkg:golang/github.com/sirupsen/logrus@v1.9.4", + "dependsOn": [ + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", + "dependsOn": [ + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/spf13/afero@v1.15.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/spf13/cast@v1.10.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/spf13/cobra@v1.10.2", + "dependsOn": [ + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4" + ] + }, + { + "ref": "pkg:golang/github.com/spf13/pflag@v1.0.10", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/spf13/viper@v1.21.0", + "dependsOn": [ + "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4", + "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", + "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", + "pkg:golang/github.com/spf13/afero@v1.15.0", + "pkg:golang/github.com/spf13/cast@v1.10.0", + "pkg:golang/github.com/spf13/pflag@v1.0.10", + "pkg:golang/github.com/subosito/gotenv@v1.6.0", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.7.0", + "dependsOn": [ + "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/subosito/gotenv@v1.6.0", + "dependsOn": [ + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/syndtr/goleveldb@v1.0.1-0.20220721030215-126854af5e6d", + "dependsOn": [ + "pkg:golang/github.com/golang/snappy@v0.0.4" + ] + }, + { + "ref": "pkg:golang/github.com/tchap/go-patricia/v2@v2.3.3", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.4.2", + "dependsOn": [ + "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", + "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.11.0", + "pkg:golang/github.com/spf13/cobra@v1.10.2", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/theupdateframework/go-tuf@v0.7.0", + "dependsOn": [ + "pkg:golang/github.com/dustin/go-humanize@v1.0.1", + "pkg:golang/github.com/golang/snappy@v0.0.4", + "pkg:golang/github.com/syndtr/goleveldb@v1.0.1-0.20220721030215-126854af5e6d", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/tink-crypto/tink-go-awskms/v3@v3.0.0", + "dependsOn": [ + "pkg:golang/github.com/tink-crypto/tink-go/v2@v2.6.0" + ] + }, + { + "ref": "pkg:golang/github.com/tink-crypto/tink-go-gcpkms/v2@v2.2.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/tink-crypto/tink-go-hcvault/v2@v2.5.0", + "dependsOn": [ + "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", + "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", + "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", + "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", + "pkg:golang/github.com/hashicorp/go-rootcerts@v1.0.2", + "pkg:golang/github.com/hashicorp/go-secure-stdlib/strutil@v0.1.2", + "pkg:golang/github.com/hashicorp/hcl@v1.0.1-vault-7", + "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", + "pkg:golang/github.com/ryanuber/go-glob@v1.0.0", + "pkg:golang/github.com/tink-crypto/tink-go/v2@v2.6.0" + ] + }, + { + "ref": "pkg:golang/github.com/tink-crypto/tink-go/v2@v2.6.0", + "dependsOn": [ + "pkg:golang/github.com/google/go-cmp@v0.7.0" + ] + }, + { + "ref": "pkg:golang/github.com/titanous/rocacheck@v0.0.0-20171023193734-afe73141d399", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/tjfoc/gmsm@v1.4.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/transparency-dev/formats@v0.1.1", + "dependsOn": [ + "pkg:golang/github.com/google/go-cmp@v0.7.0" + ] + }, + { + "ref": "pkg:golang/github.com/transparency-dev/merkle@v0.0.2", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/valyala/fastjson@v1.6.10", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/vektah/gqlparser/v2@v2.5.33", + "dependsOn": [ + "pkg:golang/github.com/agnivade/levenshtein@v1.2.1", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/github.com/withfig/autocomplete-tools/integrations/cobra@v1.2.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/x448/float16@v0.8.4", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20190905194746-02993c407bfb", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/yashtewari/glob-intersection@v0.2.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", + "dependsOn": [] + }, + { + "ref": "pkg:golang/gitlab.com/gitlab-org/api/client-go@v1.46.0", + "dependsOn": [ + "pkg:golang/github.com/google/go-querystring@v1.2.0", + "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", + "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "dependsOn": [ + "pkg:golang/github.com/rogpeppe/go-internal@v1.14.1", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.68.0", + "dependsOn": [ + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.68.0", + "dependsOn": [ + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/go.opentelemetry.io/otel/metric@v1.44.0", + "dependsOn": [ + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/go.opentelemetry.io/otel/trace@v1.44.0", + "pkg:golang/go.opentelemetry.io/otel@v1.44.0", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/go.opentelemetry.io/otel/trace@v1.44.0", + "dependsOn": [ + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/go.opentelemetry.io/otel@v1.44.0", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/go.opentelemetry.io/otel@v1.44.0", + "dependsOn": [ + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/go.opentelemetry.io/otel/metric@v1.44.0", + "pkg:golang/go.opentelemetry.io/otel/trace@v1.44.0", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/go.uber.org/multierr@v1.11.0", + "dependsOn": [ + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/go.uber.org/zap@v1.28.0", + "dependsOn": [ + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/go.yaml.in/yaml/v2@v2.4.4", + "dependsOn": [] + }, + { + "ref": "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "dependsOn": [] + }, + { + "ref": "pkg:golang/golang.org/x/crypto@v0.53.0", + "dependsOn": [ + "pkg:golang/golang.org/x/sys@v0.46.0", + "pkg:golang/golang.org/x/term@v0.44.0", + "pkg:golang/golang.org/x/text@v0.38.0" + ] + }, + { + "ref": "pkg:golang/golang.org/x/mod@v0.37.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/golang.org/x/net@v0.56.0", + "dependsOn": [ + "pkg:golang/golang.org/x/crypto@v0.53.0", + "pkg:golang/golang.org/x/sys@v0.46.0", + "pkg:golang/golang.org/x/term@v0.44.0", + "pkg:golang/golang.org/x/text@v0.38.0" + ] + }, + { + "ref": "pkg:golang/golang.org/x/oauth2@v0.36.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/golang.org/x/sync@v0.21.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/golang.org/x/sys@v0.46.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/golang.org/x/term@v0.44.0", + "dependsOn": [ + "pkg:golang/golang.org/x/sys@v0.46.0" + ] + }, + { + "ref": "pkg:golang/golang.org/x/text@v0.38.0", + "dependsOn": [ + "pkg:golang/golang.org/x/sync@v0.21.0" + ] + }, + { + "ref": "pkg:golang/golang.org/x/time@v0.15.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/google.golang.org/api@v0.284.0", + "dependsOn": [ + "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", + "pkg:golang/cloud.google.com/go/auth@v0.20.0", + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/s2a-go@v0.1.9", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.16", + "pkg:golang/github.com/googleapis/gax-go/v2@v2.22.0", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/golang.org/x/oauth2@v0.36.0", + "pkg:golang/golang.org/x/sync@v0.21.0", + "pkg:golang/golang.org/x/time@v0.15.0", + "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260526163538-3dc84a4a5aaa" + ] + }, + { + "ref": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260526163538-3dc84a4a5aaa", + "dependsOn": [] + }, + { + "ref": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260526163538-3dc84a4a5aaa", + "dependsOn": [] + }, + { + "ref": "pkg:golang/google.golang.org/genproto@v0.0.0-20260406210006-6f92a3bedf2d", + "dependsOn": [] + }, + { + "ref": "pkg:golang/google.golang.org/grpc@v1.82.0", + "dependsOn": [ + "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/go-logr/stdr@v1.2.2", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", + "pkg:golang/golang.org/x/oauth2@v0.36.0" + ] + }, + { + "ref": "pkg:golang/google.golang.org/protobuf@v1.36.12-0.20260120151049-f2248ac996af", + "dependsOn": [ + "pkg:golang/github.com/google/go-cmp@v0.7.0" + ] + }, + { + "ref": "pkg:golang/gopkg.in/evanphx/json-patch.v4@v4.13.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/gopkg.in/inf.v0@v0.9.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/gopkg.in/ini.v1@v1.67.3", + "dependsOn": [] + }, + { + "ref": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", + "dependsOn": [] + }, + { + "ref": "pkg:golang/k8s.io/api@v0.36.2", + "dependsOn": [ + "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.0", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/json-iterator/go@v1.1.12", + "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", + "pkg:golang/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", + "pkg:golang/github.com/x448/float16@v0.8.4", + "pkg:golang/gopkg.in/inf.v0@v0.9.1", + "pkg:golang/k8s.io/apimachinery@v0.36.2", + "pkg:golang/k8s.io/klog/v2@v2.140.0", + "pkg:golang/k8s.io/kube-openapi@v0.0.0-20260317180543-43fb72c5454a", + "pkg:golang/k8s.io/utils@v0.0.0-20260210185600-b8788abfbbc2", + "pkg:golang/sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", + "pkg:golang/sigs.k8s.io/randfill@v1.0.0", + "pkg:golang/sigs.k8s.io/structured-merge-diff/v6@v6.3.2", + "pkg:golang/sigs.k8s.io/yaml@v1.6.0" + ] + }, + { + "ref": "pkg:golang/k8s.io/apimachinery@v0.36.2", + "dependsOn": [ + "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.0", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/google/gnostic-models@v0.7.0", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/json-iterator/go@v1.1.12", + "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", + "pkg:golang/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", + "pkg:golang/github.com/rogpeppe/go-internal@v1.14.1", + "pkg:golang/github.com/x448/float16@v0.8.4", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/google.golang.org/protobuf@v1.36.12-0.20260120151049-f2248ac996af", + "pkg:golang/gopkg.in/evanphx/json-patch.v4@v4.13.0", + "pkg:golang/gopkg.in/inf.v0@v0.9.1", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1", + "pkg:golang/k8s.io/klog/v2@v2.140.0", + "pkg:golang/k8s.io/kube-openapi@v0.0.0-20260317180543-43fb72c5454a", + "pkg:golang/k8s.io/utils@v0.0.0-20260210185600-b8788abfbbc2", + "pkg:golang/sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", + "pkg:golang/sigs.k8s.io/randfill@v1.0.0", + "pkg:golang/sigs.k8s.io/structured-merge-diff/v6@v6.3.2", + "pkg:golang/sigs.k8s.io/yaml@v1.6.0" + ] + }, + { + "ref": "pkg:golang/k8s.io/client-go@v0.36.2", + "dependsOn": [ + "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", + "pkg:golang/github.com/emicklei/go-restful/v3@v3.13.0", + "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.0", + "pkg:golang/github.com/go-logr/logr@v1.4.3", + "pkg:golang/github.com/google/gnostic-models@v0.7.0", + "pkg:golang/github.com/google/go-cmp@v0.7.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/json-iterator/go@v1.1.12", + "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", + "pkg:golang/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", + "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", + "pkg:golang/github.com/x448/float16@v0.8.4", + "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", + "pkg:golang/google.golang.org/protobuf@v1.36.12-0.20260120151049-f2248ac996af", + "pkg:golang/gopkg.in/evanphx/json-patch.v4@v4.13.0", + "pkg:golang/gopkg.in/inf.v0@v0.9.1", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1", + "pkg:golang/k8s.io/api@v0.36.2", + "pkg:golang/k8s.io/apimachinery@v0.36.2", + "pkg:golang/k8s.io/klog/v2@v2.140.0", + "pkg:golang/k8s.io/kube-openapi@v0.0.0-20260317180543-43fb72c5454a", + "pkg:golang/k8s.io/utils@v0.0.0-20260210185600-b8788abfbbc2", + "pkg:golang/sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", + "pkg:golang/sigs.k8s.io/randfill@v1.0.0", + "pkg:golang/sigs.k8s.io/structured-merge-diff/v6@v6.3.2", + "pkg:golang/sigs.k8s.io/yaml@v1.6.0" + ] + }, + { + "ref": "pkg:golang/k8s.io/klog/v2@v2.140.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/k8s.io/kube-openapi@v0.0.0-20260317180543-43fb72c5454a", + "dependsOn": [ + "pkg:golang/github.com/google/gnostic-models@v0.7.0", + "pkg:golang/github.com/google/uuid@v1.6.0", + "pkg:golang/github.com/json-iterator/go@v1.1.12", + "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", + "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1", + "pkg:golang/sigs.k8s.io/randfill@v1.0.0" + ] + }, + { + "ref": "pkg:golang/k8s.io/utils@v0.0.0-20260210185600-b8788abfbbc2", + "dependsOn": [] + }, + { + "ref": "pkg:golang/sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", + "dependsOn": [] + }, + { + "ref": "pkg:golang/sigs.k8s.io/randfill@v1.0.0", + "dependsOn": [] + }, + { + "ref": "pkg:golang/sigs.k8s.io/release-utils@v0.12.4", + "dependsOn": [ + "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", + "pkg:golang/github.com/common-nighthawk/go-figure@v0.0.0-20210622060536-734e95fb86be", + "pkg:golang/github.com/moby/term@v0.5.2", + "pkg:golang/github.com/nozzle/throttler@v0.0.0-20180817012639-2ea982251481", + "pkg:golang/github.com/sirupsen/logrus@v1.9.4", + "pkg:golang/github.com/spf13/cobra@v1.10.2", + "pkg:golang/gopkg.in/yaml.v3@v3.0.1" + ] + }, + { + "ref": "pkg:golang/sigs.k8s.io/structured-merge-diff/v6@v6.3.2", + "dependsOn": [ + "pkg:golang/github.com/json-iterator/go@v1.1.12", + "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd" + ] + }, + { + "ref": "pkg:golang/sigs.k8s.io/yaml@v1.6.0", + "dependsOn": [ + "pkg:golang/sigs.k8s.io/randfill@v1.0.0" + ] + } + ], + "annotations": [ + { + "bom-ref": "metadata-annotations", + "subjects": [ + "pkg:golang/github.com/sigstore/cosign/v3" + ], + "annotator": { + "component": { + "group": "@cyclonedx", + "name": "cdxgen", + "version": "12.8.2", + "purl": "pkg:npm/%40cyclonedx/cdxgen@12.8.2", + "type": "application", + "bom-ref": "pkg:npm/@cyclonedx/cdxgen@12.8.2", + "publisher": "OWASP Foundation", + "authors": [ + { + "name": "OWASP Foundation" + } + ] + } + }, + "timestamp": "2026-08-06T16:57:51Z", + "text": "This Cryptography Bill-of-Materials (CBOM) document was created on Thursday, August 6, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'github.com/sigstore/cosign/v3'. There are 56 cryptographic assets listed under components in this CBOM. There are 314 components. The package type in this CBOM is golang with 146 purl namespaces described under components. The components were identified from the source files: go.mod." + } + ] +} diff --git a/migration/src/lib.rs b/migration/src/lib.rs index bdea5fa220..cce5347536 100644 --- a/migration/src/lib.rs +++ b/migration/src/lib.rs @@ -82,6 +82,7 @@ mod m0002350_drop_purl_status_gist_index; mod m0002360_pythonver_cmp_parallel_restricted; mod m0002370_importer_quay_auth; mod m0002380_version_function_parallelism; +mod m0002390_add_crypto_policy_verdict; pub trait MigratorExt: Send { fn build_migrations() -> Migrations; @@ -177,6 +178,7 @@ impl MigratorExt for Migrator { .normal(m0002360_pythonver_cmp_parallel_restricted::Migration) .normal(m0002370_importer_quay_auth::Migration) .normal(m0002380_version_function_parallelism::Migration) + .normal(m0002390_add_crypto_policy_verdict::Migration) } } diff --git a/migration/src/m0002390_add_crypto_policy_verdict.rs b/migration/src/m0002390_add_crypto_policy_verdict.rs new file mode 100644 index 0000000000..761169eec2 --- /dev/null +++ b/migration/src/m0002390_add_crypto_policy_verdict.rs @@ -0,0 +1,35 @@ +use sea_orm_migration::prelude::*; + +#[derive(DeriveMigrationName)] +pub struct Migration; + +#[async_trait::async_trait] +impl MigrationTrait for Migration { + async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> { + manager + .alter_table( + Table::alter() + .table(SbomCrypto::Table) + .add_column(ColumnDef::new(SbomCrypto::PolicyVerdict).string().null()) + .to_owned(), + ) + .await + } + + async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> { + manager + .alter_table( + Table::alter() + .table(SbomCrypto::Table) + .drop_column(SbomCrypto::PolicyVerdict) + .to_owned(), + ) + .await + } +} + +#[derive(Iden)] +enum SbomCrypto { + Table, + PolicyVerdict, +} diff --git a/modules/fundamental/Cargo.toml b/modules/fundamental/Cargo.toml index 5eafe1553a..44ce1c3ce5 100644 --- a/modules/fundamental/Cargo.toml +++ b/modules/fundamental/Cargo.toml @@ -51,6 +51,8 @@ uuid = { workspace = true } semver = { workspace = true } regex = { workspace = true } lenient_semver = { workspace = true } +async-trait = { workspace = true } +reqwest = { workspace = true, features = ["json"] } [dev-dependencies] actix-http = { workspace = true } diff --git a/modules/fundamental/src/crypto/endpoints/mod.rs b/modules/fundamental/src/crypto/endpoints/mod.rs index 8ec69a9a2c..4022d8a71f 100644 --- a/modules/fundamental/src/crypto/endpoints/mod.rs +++ b/modules/fundamental/src/crypto/endpoints/mod.rs @@ -1,10 +1,15 @@ -use crate::crypto::{ - model::{ - CryptoAlgorithmSummary, CryptoSummary, PolicyEvaluationRequest, PolicyEvaluationResponse, +use crate::{ + Error, + crypto::{ + model::{ + CryptoAlgorithmSummary, CryptoSummary, PolicyEvaluationRequest, + PolicyEvaluationResponse, PolicySummaryResult, + }, + service::CryptoService, }, - service::CryptoService, }; use actix_web::{HttpResponse, Responder, get, post, web}; +use sea_orm::TransactionTrait; use trustify_auth::{ReadSbom, authorizer::Require}; use trustify_common::{ db::{self, pagination_cache::PaginationCache, query::Query}, @@ -15,15 +20,19 @@ use uuid::Uuid; pub fn configure( config: &mut utoipa_actix_web::service_config::ServiceConfig, - db: db::ReadOnly, + db_rw: db::ReadWrite, + db_ro: db::ReadOnly, cache: PaginationCache, + conforma_url: Option, ) { - let service = CryptoService::new(cache); + let service = CryptoService::new(cache, conforma_url); config - .app_data(web::Data::new(db)) + .app_data(web::Data::new(db_rw)) + .app_data(web::Data::new(db_ro)) .app_data(web::Data::new(service)) .service(list_algorithms) .service(get_summary) + .service(get_policy_summary) .service(list_sbom_crypto) .service(evaluate_policy); } @@ -118,6 +127,23 @@ pub async fn list_sbom_crypto( )) } +#[utoipa::path( + tag = "crypto", + operation_id = "getCryptoPolicySummary", + responses( + (status = 200, description = "Stored policy verdict summary (reads DB, does not call Conforma)", body = PolicySummaryResult), + ), +)] +#[get("/v3/crypto/policy/summary")] +pub async fn get_policy_summary( + state: web::Data, + db: web::Data, + _: Require, +) -> actix_web::Result { + let tx = db.begin().await?; + Ok(HttpResponse::Ok().json(state.fetch_policy_summary(&tx).await?)) +} + #[utoipa::path( tag = "crypto", operation_id = "evaluateCryptoPolicy", @@ -129,12 +155,14 @@ pub async fn list_sbom_crypto( #[post("/v3/crypto/policy/evaluate")] pub async fn evaluate_policy( state: web::Data, - db: web::Data, + db: web::Data, body: web::Json, _: Require, -) -> actix_web::Result { +) -> Result { let tx = db.begin().await?; - Ok(HttpResponse::Ok().json(state.evaluate_policy(body.sbom_id, &tx).await?)) + let result = state.evaluate_policy(body.sbom_id, &tx).await?; + tx.commit().await?; + Ok(HttpResponse::Ok().json(result)) } #[cfg(test)] diff --git a/modules/fundamental/src/crypto/endpoints/test.rs b/modules/fundamental/src/crypto/endpoints/test.rs index 776b8b1d8e..ded8cca4c2 100644 --- a/modules/fundamental/src/crypto/endpoints/test.rs +++ b/modules/fundamental/src/crypto/endpoints/test.rs @@ -1,17 +1,70 @@ use crate::{ - crypto::model::{ - CryptoAlgorithmSummary, CryptoSummary, PolicyEvaluationRequest, PolicyEvaluationResponse, + crypto::{ + model::{CryptoAlgorithmSummary, CryptoSummary, PolicyEvaluationRequest}, + service::{ + CryptoService, + evaluator::{AlgorithmInput, EvaluatorFinding, EvaluatorReport, PolicyEvaluator}, + policy::PolicyVerdict, + }, }, - crypto::service::policy::PolicyVerdict, test::caller, }; use actix_http::StatusCode; use actix_web::test::TestRequest; +use async_trait::async_trait; +use sea_orm::TransactionTrait; use test_context::test_context; use test_log::test; -use trustify_common::model::PaginatedResults; +use trustify_common::{db, db::pagination_cache::PaginationCache, model::PaginatedResults}; use trustify_module_ingestor::model::IngestResult; use trustify_test_context::{TrustifyContext, call::CallService, document_bytes}; +use uuid::Uuid; + +/// Mock evaluator: SHA-1/MD5 → NonCompliant, PQC-safe → Compliant, everything else → Warning. +struct MockPolicyEvaluator; + +#[async_trait] +impl PolicyEvaluator for MockPolicyEvaluator { + async fn evaluate( + &self, + algorithms: &[AlgorithmInput], + ) -> Result { + let mut violations = vec![]; + let mut warnings = vec![]; + for algo in algorithms { + let upper = algo.name.to_uppercase(); + if upper.contains("SHA1") || upper.contains("SHA-1") || upper.contains("MD5") { + violations.push(EvaluatorFinding { + node_id: Some(algo.node_id.clone()), + }); + } else if !is_pqc_safe(&upper) { + warnings.push(EvaluatorFinding { + node_id: Some(algo.node_id.clone()), + }); + } + } + Ok(EvaluatorReport { + violations, + warnings, + }) + } +} + +fn is_pqc_safe(upper: &str) -> bool { + [ + "MLKEM", + "ML-KEM", + "KYBER", + "MLDSA", + "ML-DSA", + "DILITHIUM", + "SLHDSA", + "SLH-DSA", + "SPHINCS", + ] + .iter() + .any(|kw| upper.contains(kw)) +} async fn ingest_cbom(app: &impl CallService) -> IngestResult { let request = TestRequest::post() @@ -46,14 +99,6 @@ async fn list_algorithms(ctx: &TrustifyContext) -> Result<(), anyhow::Error> { ); for algo in &response.items { - assert!( - matches!( - algo.policy_status, - PolicyVerdict::Compliant | PolicyVerdict::Warning | PolicyVerdict::NonCompliant - ), - "algorithm {} should have a valid policy_status", - algo.name - ); assert!( algo.sboms_count >= 1, "algorithm {} should appear in at least 1 SBOM", @@ -142,28 +187,6 @@ async fn get_summary(ctx: &TrustifyContext) -> Result<(), anyhow::Error> { // Then: keycloak-cbom has 22 algorithm-type components assert_eq!(summary.total_algorithms, 22, "expected 22 algorithms"); - assert!( - summary.pqc_compliant >= 0, - "pqc_compliant should be non-negative" - ); - assert!( - summary.classical_share_pct >= 0.0 && summary.classical_share_pct <= 100.0, - "classical_share_pct should be a valid percentage" - ); - - // keycloak-cbom has no PQC algorithms, so all are classical - assert_eq!( - summary.pqc_compliant, 0, - "keycloak-cbom has no PQC-safe algorithms" - ); - assert!( - (summary.classical_share_pct - 100.0).abs() < f64::EPSILON, - "all algorithms should be classical" - ); - assert_eq!( - summary.sboms_meeting_pqc, 0, - "no SBOMs should meet PQC since all algorithms are classical" - ); Ok(()) } @@ -180,9 +203,6 @@ async fn get_summary_empty_db(ctx: &TrustifyContext) -> Result<(), anyhow::Error let summary: CryptoSummary = app.call_and_read_body_json(request).await; assert_eq!(summary.total_algorithms, 0); - assert_eq!(summary.pqc_compliant, 0); - assert!((summary.classical_share_pct - 0.0).abs() < f64::EPSILON); - assert_eq!(summary.sboms_meeting_pqc, 0); Ok(()) } @@ -252,7 +272,9 @@ async fn list_sbom_crypto_filtered(ctx: &TrustifyContext) -> Result<(), anyhow:: /// Verifies policy evaluation across all SBOMs. #[test_context(TrustifyContext)] #[test(actix_web::test)] -async fn evaluate_policy(ctx: &TrustifyContext) -> Result<(), anyhow::Error> { +async fn evaluate_policy_requires_conforma(ctx: &TrustifyContext) -> Result<(), anyhow::Error> { + // When CONFORMA_URL is not configured (test default), the endpoint must + // return 500 rather than silently falling back to a hardcoded policy. let app = caller(ctx).await?; ingest_cbom(&app).await; @@ -260,25 +282,14 @@ async fn evaluate_policy(ctx: &TrustifyContext) -> Result<(), anyhow::Error> { .uri("/api/v3/crypto/policy/evaluate") .set_json(PolicyEvaluationRequest { sbom_id: None }) .to_request(); - let response: PolicyEvaluationResponse = app.call_and_read_body_json(request).await; + let response = app.call_service(request).await; - assert!(response.summary.total > 0, "expected algorithms from CBOM"); assert_eq!( - response.summary.total, - response.summary.compliant + response.summary.warning + response.summary.non_compliant, - "summary counts should add up to total" + response.status(), + StatusCode::INTERNAL_SERVER_ERROR, + "evaluate_policy must fail with 500 when CONFORMA_URL is not set" ); - // SHA1 in keycloak-cbom should be NonCompliant - let sha1 = response.results.iter().find(|r| r.name == "SHA1"); - assert!(sha1.is_some(), "SHA1 should be present in results"); - assert_eq!(sha1.unwrap().verdict, PolicyVerdict::NonCompliant); - - // ECDH should be Warning (classical in transition) - let ecdh = response.results.iter().find(|r| r.name == "ECDH"); - assert!(ecdh.is_some(), "ECDH should be present in results"); - assert_eq!(ecdh.unwrap().verdict, PolicyVerdict::Warning); - Ok(()) } @@ -296,20 +307,14 @@ async fn evaluate_policy_with_sbom_filter(ctx: &TrustifyContext) -> Result<(), a sbom_id: Some(sbom_id), }) .to_request(); - let response: PolicyEvaluationResponse = app.call_and_read_body_json(request).await; + let response = app.call_service(request).await; - assert!( - response.summary.total > 0, - "expected algorithms for the specific SBOM" + assert_eq!( + response.status(), + StatusCode::INTERNAL_SERVER_ERROR, + "evaluate_policy must fail with 500 when CONFORMA_URL is not set" ); - for result in &response.results { - assert_eq!( - result.sbom_id, sbom_id, - "all results should match the filtered SBOM ID" - ); - } - Ok(()) } @@ -323,10 +328,214 @@ async fn evaluate_policy_empty_db(ctx: &TrustifyContext) -> Result<(), anyhow::E .uri("/api/v3/crypto/policy/evaluate") .set_json(PolicyEvaluationRequest { sbom_id: None }) .to_request(); - let response: PolicyEvaluationResponse = app.call_and_read_body_json(request).await; + let response = app.call_service(request).await; + + assert_eq!( + response.status(), + StatusCode::INTERNAL_SERVER_ERROR, + "evaluate_policy must fail with 500 when CONFORMA_URL is not set" + ); + + Ok(()) +} + +/// Verifies that evaluate_policy persists verdicts to the DB and returns correct classifications. +/// SHA-1 must be NonCompliant; classical algorithms must be Warning. +#[test_context(TrustifyContext)] +#[test(actix_web::test)] +async fn evaluate_policy_stores_verdicts(ctx: &TrustifyContext) -> Result<(), anyhow::Error> { + let app = caller(ctx).await?; + let ingest = ingest_cbom(&app).await; + let sbom_id: Uuid = ingest.id.parse()?; + + let service = + CryptoService::with_evaluator(PaginationCache::for_test(), Box::new(MockPolicyEvaluator)); + let db_rw = db::ReadWrite::new(ctx.db.clone()); + let tx = db_rw.begin().await?; + let result = service.evaluate_policy(Some(sbom_id), &tx).await?; + tx.commit().await?; + + // keycloak-cbom contains SHA1 — must be non_compliant + assert!( + result + .results + .iter() + .any(|r| r.name.to_uppercase().contains("SHA1") + && r.verdict == PolicyVerdict::NonCompliant), + "SHA1 must be classified as NonCompliant" + ); + + // Classical algorithms (e.g. AES, EC) must be warning + assert!( + result + .results + .iter() + .any(|r| r.verdict == PolicyVerdict::Warning), + "classical algorithms must be classified as Warning" + ); + + Ok(()) +} + +/// Verifies that list_algorithms returns policy_status from stored verdicts after evaluation. +#[test_context(TrustifyContext)] +#[test(actix_web::test)] +async fn list_algorithms_returns_policy_status_after_evaluation( + ctx: &TrustifyContext, +) -> Result<(), anyhow::Error> { + let app = caller(ctx).await?; + let ingest = ingest_cbom(&app).await; + let sbom_id: Uuid = ingest.id.parse()?; + + let service = + CryptoService::with_evaluator(PaginationCache::for_test(), Box::new(MockPolicyEvaluator)); + let db_rw = db::ReadWrite::new(ctx.db.clone()); + let tx = db_rw.begin().await?; + service.evaluate_policy(Some(sbom_id), &tx).await?; + tx.commit().await?; + + let request = TestRequest::get() + .uri(&format!( + "/api/v3/sbom/{sbom_id}/crypto?total=true&asset_type=algorithm" + )) + .to_request(); + let response: PaginatedResults = + app.call_and_read_body_json(request).await; + + assert!( + response.items.iter().any(|a| a.policy_status.is_some()), + "policy_status must be populated after evaluation" + ); + assert!( + response + .items + .iter() + .any(|a| a.policy_status == Some(PolicyVerdict::NonCompliant)), + "at least one algorithm must be NonCompliant (SHA1)" + ); + assert!( + response + .items + .iter() + .any(|a| a.policy_status == Some(PolicyVerdict::Warning)), + "at least one algorithm must be Warning" + ); + + Ok(()) +} + +/// Verifies that algorithms not on the deny list default to Warning (not Compliant). +#[test_context(TrustifyContext)] +#[test(actix_web::test)] +async fn unknown_algorithms_default_to_warning(ctx: &TrustifyContext) -> Result<(), anyhow::Error> { + let app = caller(ctx).await?; + ingest_cbom(&app).await; + + let service = + CryptoService::with_evaluator(PaginationCache::for_test(), Box::new(MockPolicyEvaluator)); + let db_rw = db::ReadWrite::new(ctx.db.clone()); + let tx = db_rw.begin().await?; + let result = service.evaluate_policy(None, &tx).await?; + tx.commit().await?; + + // AES is not PQC-safe and not on the deny list — must be Warning, not NonCompliant + let aes: Vec<_> = result + .results + .iter() + .filter(|r| r.name.to_uppercase().starts_with("AES")) + .collect(); + assert!(!aes.is_empty(), "keycloak-cbom must contain AES algorithms"); + assert!( + aes.iter().all(|r| r.verdict == PolicyVerdict::Warning), + "AES (unknown/classical) must default to Warning" + ); + + Ok(()) +} + +/// Verifies that fetch_policy_summary returns all zeros on an empty database. +#[test_context(TrustifyContext)] +#[test(actix_web::test)] +async fn policy_summary_empty_db(ctx: &TrustifyContext) -> Result<(), anyhow::Error> { + let app = caller(ctx).await?; + + let request = TestRequest::get() + .uri("/api/v3/crypto/policy/summary") + .to_request(); + let summary: crate::crypto::model::PolicySummaryResult = + app.call_and_read_body_json(request).await; + + assert_eq!(summary.total, 0); + assert_eq!(summary.compliant, 0); + assert_eq!(summary.warning, 0); + assert_eq!(summary.non_compliant, 0); - assert_eq!(response.summary.total, 0); - assert!(response.results.is_empty()); + Ok(()) +} + +/// Verifies that fetch_policy_summary returns total > 0 but zero verdict counts +/// when algorithms exist but none have been evaluated yet (NULL policy_verdict). +#[test_context(TrustifyContext)] +#[test(actix_web::test)] +async fn policy_summary_no_verdicts(ctx: &TrustifyContext) -> Result<(), anyhow::Error> { + let app = caller(ctx).await?; + ingest_cbom(&app).await; + + let request = TestRequest::get() + .uri("/api/v3/crypto/policy/summary") + .to_request(); + let summary: crate::crypto::model::PolicySummaryResult = + app.call_and_read_body_json(request).await; + + // keycloak-cbom has 22 algorithm-type assets; none evaluated yet + assert_eq!(summary.total, 22, "total must count unevaluated algorithms"); + assert_eq!(summary.compliant, 0); + assert_eq!(summary.warning, 0); + assert_eq!(summary.non_compliant, 0); + + Ok(()) +} + +/// Verifies that fetch_policy_summary reflects stored verdicts after evaluation +/// and that counts are consistent with the evaluate_policy response. +#[test_context(TrustifyContext)] +#[test(actix_web::test)] +async fn policy_summary_after_evaluation(ctx: &TrustifyContext) -> Result<(), anyhow::Error> { + let app = caller(ctx).await?; + let ingest = ingest_cbom(&app).await; + let sbom_id: Uuid = ingest.id.parse()?; + + let service = + CryptoService::with_evaluator(PaginationCache::for_test(), Box::new(MockPolicyEvaluator)); + let db_rw = db::ReadWrite::new(ctx.db.clone()); + let tx = db_rw.begin().await?; + let eval = service.evaluate_policy(Some(sbom_id), &tx).await?; + tx.commit().await?; + + let request = TestRequest::get() + .uri("/api/v3/crypto/policy/summary") + .to_request(); + let summary: crate::crypto::model::PolicySummaryResult = + app.call_and_read_body_json(request).await; + + // total counts all algorithms (evaluated + any unevaluated in other SBOMs) + assert!( + summary.total >= eval.summary.total, + "total must include all algorithms" + ); + // verdict sub-counts must match the evaluation response exactly (single SBOM) + assert_eq!(summary.compliant, eval.summary.compliant); + assert_eq!(summary.warning, eval.summary.warning); + assert_eq!(summary.non_compliant, eval.summary.non_compliant); + // sanity: at least one non-compliant (SHA1) and one warning + assert!( + summary.non_compliant > 0, + "SHA1 must produce at least one non_compliant" + ); + assert!( + summary.warning > 0, + "classical algorithms must produce at least one warning" + ); Ok(()) } diff --git a/modules/fundamental/src/crypto/model.rs b/modules/fundamental/src/crypto/model.rs index 807b6f5e69..ab5bf9aed0 100644 --- a/modules/fundamental/src/crypto/model.rs +++ b/modules/fundamental/src/crypto/model.rs @@ -18,18 +18,17 @@ pub struct CryptoAlgorithmSummary { pub primitive: Option, #[schema(value_type = Object)] pub properties: serde_json::Value, - pub policy_status: PolicyVerdict, pub packages_count: i64, pub sboms_count: i64, + /// Policy verdict stored after Conforma evaluation; None means not yet evaluated. + #[schema(required)] + pub policy_status: Option, } /// Aggregate KPI metrics for cryptographic assets across all SBOMs. #[derive(Serialize, Deserialize, Debug, Clone, ToSchema)] pub struct CryptoSummary { pub total_algorithms: i64, - pub pqc_compliant: i64, - pub classical_share_pct: f64, - pub sboms_meeting_pqc: i64, } #[derive(Serialize, Deserialize, Debug, Clone, ToSchema)] diff --git a/modules/fundamental/src/crypto/service/conforma.rs b/modules/fundamental/src/crypto/service/conforma.rs new file mode 100644 index 0000000000..77e6635978 --- /dev/null +++ b/modules/fundamental/src/crypto/service/conforma.rs @@ -0,0 +1,113 @@ +use std::time::Duration; + +use anyhow::Context; +use async_trait::async_trait; +use serde::Deserialize; + +use super::evaluator::{AlgorithmInput, EvaluatorFinding, EvaluatorReport, PolicyEvaluator}; + +pub struct ConformaClient { + /// Base URL of the running Conforma server (e.g. `http://localhost:8085`). + /// Start the service with the compose-conforma.yaml overlay before running trustify. + base_url: String, +} + +impl ConformaClient { + pub fn new(base_url: String) -> Self { + Self { base_url } + } + + async fn run(&self, input: serde_json::Value) -> Result { + self.wait_ready().await?; + + let client = reqwest::Client::new(); + let response = client + .post(format!("{}/v1/validate/input", self.base_url)) + .json(&input) + .send() + .await + .context("failed to reach Conforma evaluation endpoint")?; + + response + .json() + .await + .context("failed to parse Conforma response") + .map_err(|e| crate::Error::Internal(e.to_string())) + } + + async fn wait_ready(&self) -> Result<(), crate::Error> { + let client = reqwest::Client::builder() + .timeout(Duration::from_secs(5)) + .build() + .context("failed to build HTTP client")?; + let deadline = tokio::time::Instant::now() + Duration::from_secs(30); + + loop { + if tokio::time::Instant::now() > deadline { + return Err(crate::Error::Internal( + "Conforma server did not become ready within 30s".into(), + )); + } + match client.get(format!("{}/ready", self.base_url)).send().await { + Ok(r) if r.status().is_success() => return Ok(()), + _ => tokio::time::sleep(Duration::from_millis(200)).await, + } + } + } +} + +#[async_trait] +impl PolicyEvaluator for ConformaClient { + async fn evaluate( + &self, + algorithms: &[AlgorithmInput], + ) -> Result { + let input = serde_json::json!({ + "algorithms": algorithms.iter().map(|a| serde_json::json!({ + "node_id": a.node_id, + "sbom_id": a.sbom_id, + "name": a.name, + "oid": a.oid, + "properties": a.properties, + })).collect::>() + }); + + let raw = self.run(input).await?; + let file = raw.filepaths.into_iter().next().unwrap_or_default(); + + Ok(EvaluatorReport { + violations: file.violations.into_iter().map(parse_finding).collect(), + warnings: file.warnings.into_iter().map(parse_finding).collect(), + }) + } +} + +// Conforma strips extra fields from deny/warn results and only preserves "msg". +// We embed the node_id as a "[node_id:]" prefix so trustify can parse it +// back out and match violations to individual AlgorithmPolicyResult rows. +fn parse_finding(r: RawResult) -> EvaluatorFinding { + let node_id = r + .msg + .strip_prefix("[node_id:") + .and_then(|s| s.find(']').map(|i| s[..i].to_string())); + EvaluatorFinding { node_id } +} + +#[derive(Deserialize, Default)] +struct RawConformaReport { + #[serde(default)] + filepaths: Vec, +} + +#[derive(Deserialize, Default)] +struct RawFilePath { + #[serde(default)] + violations: Vec, + #[serde(default)] + warnings: Vec, +} + +#[derive(Deserialize)] +struct RawResult { + msg: String, +} diff --git a/modules/fundamental/src/crypto/service/evaluator.rs b/modules/fundamental/src/crypto/service/evaluator.rs new file mode 100644 index 0000000000..a1af950ced --- /dev/null +++ b/modules/fundamental/src/crypto/service/evaluator.rs @@ -0,0 +1,27 @@ +use async_trait::async_trait; +use uuid::Uuid; + +pub struct AlgorithmInput { + pub node_id: String, + pub sbom_id: Uuid, + pub name: String, + pub oid: Option, + pub properties: serde_json::Value, +} + +pub struct EvaluatorReport { + pub violations: Vec, + pub warnings: Vec, +} + +pub struct EvaluatorFinding { + pub node_id: Option, +} + +#[async_trait] +pub trait PolicyEvaluator: Send + Sync { + async fn evaluate( + &self, + algorithms: &[AlgorithmInput], + ) -> Result; +} diff --git a/modules/fundamental/src/crypto/service/mod.rs b/modules/fundamental/src/crypto/service/mod.rs index 0fcffb0c6d..04468e3bd3 100644 --- a/modules/fundamental/src/crypto/service/mod.rs +++ b/modules/fundamental/src/crypto/service/mod.rs @@ -1,3 +1,5 @@ +pub mod conforma; +pub mod evaluator; pub mod policy; use crate::{ @@ -7,12 +9,12 @@ use crate::{ AlgorithmPolicyResult, CryptoAlgorithmSummary, CryptoSummary, PolicyEvaluationResponse, PolicySummaryResult, }, - service::policy::{PolicyVerdict, evaluate_algorithm}, + service::policy::PolicyVerdict, }, }; use sea_orm::{ - ColumnTrait, Condition, ConnectionTrait, EntityTrait, JoinType, LoaderTrait, QueryFilter, - QueryOrder, QuerySelect, RelationTrait, + ActiveModelTrait, ActiveValue, ColumnTrait, Condition, ConnectionTrait, EntityTrait, JoinType, + LoaderTrait, PaginatorTrait, QueryFilter, QueryOrder, QuerySelect, RelationTrait, }; use std::collections::{HashMap, HashSet}; use tracing::instrument; @@ -32,11 +34,32 @@ use uuid::Uuid; pub struct CryptoService { cache: PaginationCache, + evaluator: Option>, } impl CryptoService { - pub fn new(cache: PaginationCache) -> Self { - Self { cache } + pub fn new(cache: PaginationCache, conforma_url: Option) -> Self { + Self { + cache, + evaluator: conforma_url + .map(conforma::ConformaClient::new) + .map(|c| Box::new(c) as Box), + } + } + + pub fn has_evaluator(&self) -> bool { + self.evaluator.is_some() + } + + #[cfg(test)] + pub fn with_evaluator( + cache: PaginationCache, + evaluator: Box, + ) -> Self { + Self { + cache, + evaluator: Some(evaluator), + } } /// List crypto assets with optional filtering by asset type and SBOM. @@ -89,7 +112,6 @@ impl CryptoService { .zip(nodes) .filter_map(|(crypto, node)| { let node = node?; - let verdict = evaluate_algorithm(&node.name, &crypto.properties); let primitive = crypto .properties .get("algorithmProperties") @@ -101,6 +123,12 @@ impl CryptoService { .copied() .unwrap_or(0); let sc = sbom_counts.get(&node.name).copied().unwrap_or(0); + let policy_status = crypto.policy_verdict.as_deref().and_then(|v| match v { + "compliant" => Some(PolicyVerdict::Compliant), + "warning" => Some(PolicyVerdict::Warning), + "non_compliant" => Some(PolicyVerdict::NonCompliant), + _ => None, + }); Some(CryptoAlgorithmSummary { sbom_id: crypto.sbom_id, node_id: crypto.node_id, @@ -108,10 +136,10 @@ impl CryptoService { asset_type: crypto.asset_type, oid: crypto.oid, primitive, - policy_status: verdict, properties: crypto.properties, packages_count: pc, sboms_count: sc, + policy_status, }) }) .collect(); @@ -122,50 +150,50 @@ impl CryptoService { }) } - /// Compute aggregate KPI metrics across all SBOMs. + /// Aggregate stored policy verdicts from the DB without calling Validator. #[instrument(skip_all, err(level = tracing::Level::INFO))] - pub async fn fetch_summary( + pub async fn fetch_policy_summary( &self, connection: &C, - ) -> Result { - let all_algos = sbom_crypto::Entity::find() + ) -> Result { + let rows: Vec> = sbom_crypto::Entity::find() .filter(sbom_crypto::Column::AssetType.eq(CryptoAssetType::Algorithm)) + .select_only() + .column(sbom_crypto::Column::PolicyVerdict) + .into_tuple() .all(connection) .await?; - let nodes = all_algos.load_one(sbom_node::Entity, connection).await?; - let total_algorithms = all_algos.len() as i64; - let mut pqc_compliant: i64 = 0; - let mut sbom_all_compliant: HashMap = HashMap::new(); - - for (crypto, node) in all_algos.iter().zip(&nodes) { - if let Some(node) = node { - let verdict = evaluate_algorithm(&node.name, &crypto.properties); - if verdict == PolicyVerdict::Compliant { - pqc_compliant += 1; - } - let entry = sbom_all_compliant.entry(crypto.sbom_id).or_insert(true); - if verdict != PolicyVerdict::Compliant { - *entry = false; + let (total, compliant, warning, non_compliant) = + rows.iter().fold((0, 0, 0, 0), |(t, c, w, n), verdict| { + match verdict.as_deref() { + Some("compliant") => (t + 1, c + 1, w, n), + Some("warning") => (t + 1, c, w + 1, n), + Some("non_compliant") => (t + 1, c, w, n + 1), + _ => (t + 1, c, w, n), } - } - } + }); - let classical = total_algorithms - pqc_compliant; - let classical_share_pct = if total_algorithms > 0 { - (classical as f64 / total_algorithms as f64) * 100.0 - } else { - 0.0 - }; + Ok(PolicySummaryResult { + total, + compliant, + warning, + non_compliant, + }) + } - let sboms_meeting_pqc = sbom_all_compliant.values().filter(|&&v| v).count() as i64; + /// Compute aggregate KPI metrics across all SBOMs. + #[instrument(skip_all, err(level = tracing::Level::INFO))] + pub async fn fetch_summary( + &self, + connection: &C, + ) -> Result { + let total_algorithms = sbom_crypto::Entity::find() + .filter(sbom_crypto::Column::AssetType.eq(CryptoAssetType::Algorithm)) + .count(connection) + .await? as i64; - Ok(CryptoSummary { - total_algorithms, - pqc_compliant, - classical_share_pct, - sboms_meeting_pqc, - }) + Ok(CryptoSummary { total_algorithms }) } /// Count packages related to each crypto asset via Generates relationship. @@ -253,6 +281,11 @@ impl CryptoService { sbom_id: Option, connection: &C, ) -> Result { + let policy_evaluator = self + .evaluator + .as_ref() + .ok_or_else(|| Error::Internal("CONFORMA_URL is not configured".into()))?; + let mut query = sbom_crypto::Entity::find() .filter(sbom_crypto::Column::AssetType.eq(CryptoAssetType::Algorithm)); @@ -263,12 +296,47 @@ impl CryptoService { let items = query.all(connection).await?; let nodes = items.load_one(sbom_node::Entity, connection).await?; + let algo_input: Vec = items + .iter() + .zip(nodes.iter()) + .filter_map(|(crypto, node)| { + let node = node.as_ref()?; + Some(evaluator::AlgorithmInput { + node_id: crypto.node_id.clone(), + sbom_id: crypto.sbom_id, + name: node.name.clone(), + oid: crypto.oid.clone(), + properties: crypto.properties.clone(), + }) + }) + .collect(); + + let report = policy_evaluator.evaluate(&algo_input).await?; + + let violation_ids: HashSet<&str> = report + .violations + .iter() + .filter_map(|v| v.node_id.as_deref()) + .collect(); + + let warning_ids: HashSet<&str> = report + .warnings + .iter() + .filter_map(|w| w.node_id.as_deref()) + .collect(); + let results: Vec = items .into_iter() .zip(nodes) .filter_map(|(crypto, node)| { let node = node?; - let verdict = evaluate_algorithm(&node.name, &crypto.properties); + let verdict = if violation_ids.contains(crypto.node_id.as_str()) { + PolicyVerdict::NonCompliant + } else if warning_ids.contains(crypto.node_id.as_str()) { + PolicyVerdict::Warning + } else { + PolicyVerdict::Compliant + }; Some(AlgorithmPolicyResult { sbom_id: crypto.sbom_id, node_id: crypto.node_id, @@ -280,6 +348,26 @@ impl CryptoService { }) .collect(); + // Persist verdicts so list_algorithms can return policy_status without + // calling Conforma on every read request. + for result in &results { + let verdict_str = match result.verdict { + PolicyVerdict::Compliant => "compliant", + PolicyVerdict::Warning => "warning", + PolicyVerdict::NonCompliant => "non_compliant", + }; + let active: sbom_crypto::ActiveModel = sbom_crypto::ActiveModel { + sbom_id: ActiveValue::Unchanged(result.sbom_id), + node_id: ActiveValue::Unchanged(result.node_id.clone()), + policy_verdict: ActiveValue::Set(Some(verdict_str.to_string())), + ..Default::default() + }; + active + .update(connection) + .await + .map_err(|e| Error::Internal(format!("failed to persist policy verdict: {e}")))?; + } + let summary = PolicySummaryResult { total: results.len(), compliant: results diff --git a/modules/fundamental/src/crypto/service/policy.rs b/modules/fundamental/src/crypto/service/policy.rs index 0ddca540e9..fb53798268 100644 --- a/modules/fundamental/src/crypto/service/policy.rs +++ b/modules/fundamental/src/crypto/service/policy.rs @@ -8,346 +8,3 @@ pub enum PolicyVerdict { Warning, NonCompliant, } - -struct AlgorithmProps<'a> { - parameter_set_identifier: Option<&'a str>, -} - -impl<'a> AlgorithmProps<'a> { - fn from_value(v: &'a serde_json::Value) -> Self { - let ap = &v["algorithmProperties"]; - Self { - parameter_set_identifier: ap["parameterSetIdentifier"].as_str(), - } - } - - fn key_size(&self) -> Option { - self.parameter_set_identifier - .and_then(|s| s.parse::().ok()) - } -} - -pub fn evaluate_algorithm(name: &str, properties: &serde_json::Value) -> PolicyVerdict { - let upper = name.to_uppercase(); - let props = AlgorithmProps::from_value(properties); - - // PQC-safe algorithms → Compliant - if is_pqc_safe(&upper) { - return PolicyVerdict::Compliant; - } - - // Weak/broken algorithms → NonCompliant - if is_weak(&upper, &props) { - return PolicyVerdict::NonCompliant; - } - - // Everything else (classical in transition + unknown) → Warning - PolicyVerdict::Warning -} - -fn is_pqc_safe(upper_name: &str) -> bool { - let normalized = upper_name.replace('-', ""); - let pqc_patterns = ["MLKEM", "KYBER", "MLDSA", "DILITHIUM", "SLHDSA", "SPHINCS"]; - pqc_patterns - .iter() - .any(|pattern| normalized.contains(pattern)) -} - -fn is_weak(upper_name: &str, props: &AlgorithmProps<'_>) -> bool { - let normalized = upper_name.replace('-', ""); - - if normalized.contains("MD5") || normalized.contains("RC4") || normalized.contains("RC2") { - return true; - } - - // SHA-1 / SHA1 but not SHA-128, SHA-256, etc. - if is_sha1(&normalized) { - return true; - } - - // DES but not 3DES / Triple-DES / DESede - if normalized.contains("DES") - && !normalized.contains("3DES") - && !normalized.contains("TDES") - && !normalized.contains("TRIPLE") - && !normalized.contains("DESEDE") - { - return true; - } - - // RSA / DSA with small key size - if (normalized.contains("RSA") || normalized == "DSA") - && matches!(props.key_size(), Some(size) if size <= 1024) - { - return true; - } - - false -} - -fn is_sha1(normalized: &str) -> bool { - // Match SHA1 but not SHA128, SHA256, SHA384, SHA512, etc. - if let Some(pos) = normalized.find("SHA1") { - let after = &normalized[pos + 4..]; - return after.is_empty() || !after.starts_with(|c: char| c.is_ascii_digit()); - } - false -} - -#[cfg(test)] -mod test { - use super::*; - use serde_json::json; - use test_log::test; - - fn props_with_param(param: &str) -> serde_json::Value { - json!({ - "algorithmProperties": { - "parameterSetIdentifier": param - } - }) - } - - fn props_with_primitive(primitive: &str) -> serde_json::Value { - json!({ - "algorithmProperties": { - "primitive": primitive - } - }) - } - - fn empty_props() -> serde_json::Value { - json!({}) - } - - #[test] - fn pqc_algorithms_are_compliant() { - let props = empty_props(); - assert_eq!( - evaluate_algorithm("ML-KEM", &props), - PolicyVerdict::Compliant - ); - assert_eq!( - evaluate_algorithm("ML-KEM-768", &props), - PolicyVerdict::Compliant - ); - assert_eq!( - evaluate_algorithm("MLKEM", &props), - PolicyVerdict::Compliant - ); - assert_eq!( - evaluate_algorithm("Kyber", &props), - PolicyVerdict::Compliant - ); - assert_eq!( - evaluate_algorithm("ML-DSA", &props), - PolicyVerdict::Compliant - ); - assert_eq!( - evaluate_algorithm("MLDSA-65", &props), - PolicyVerdict::Compliant - ); - assert_eq!( - evaluate_algorithm("Dilithium", &props), - PolicyVerdict::Compliant - ); - assert_eq!( - evaluate_algorithm("SLH-DSA", &props), - PolicyVerdict::Compliant - ); - assert_eq!( - evaluate_algorithm("SLHDSA", &props), - PolicyVerdict::Compliant - ); - assert_eq!( - evaluate_algorithm("SPHINCS+", &props), - PolicyVerdict::Compliant - ); - } - - #[test] - fn pqc_case_insensitive() { - let props = empty_props(); - assert_eq!( - evaluate_algorithm("ml-kem", &props), - PolicyVerdict::Compliant - ); - assert_eq!( - evaluate_algorithm("kyber", &props), - PolicyVerdict::Compliant - ); - assert_eq!( - evaluate_algorithm("ml-dsa", &props), - PolicyVerdict::Compliant - ); - assert_eq!( - evaluate_algorithm("slh-dsa", &props), - PolicyVerdict::Compliant - ); - } - - #[test] - fn weak_algorithms_are_noncompliant() { - let props = empty_props(); - assert_eq!( - evaluate_algorithm("MD5", &props), - PolicyVerdict::NonCompliant - ); - assert_eq!( - evaluate_algorithm("RC4", &props), - PolicyVerdict::NonCompliant - ); - assert_eq!( - evaluate_algorithm("RC2", &props), - PolicyVerdict::NonCompliant - ); - assert_eq!( - evaluate_algorithm("DES", &props), - PolicyVerdict::NonCompliant - ); - } - - #[test] - fn sha1_is_noncompliant() { - let props = props_with_primitive("hash"); - assert_eq!( - evaluate_algorithm("SHA1", &props), - PolicyVerdict::NonCompliant - ); - assert_eq!( - evaluate_algorithm("SHA-1", &props), - PolicyVerdict::NonCompliant - ); - // SHA-256 and SHA-512 should NOT be non-compliant - assert_eq!(evaluate_algorithm("SHA256", &props), PolicyVerdict::Warning); - assert_eq!(evaluate_algorithm("SHA512", &props), PolicyVerdict::Warning); - assert_eq!( - evaluate_algorithm("SHA-384", &props), - PolicyVerdict::Warning - ); - } - - #[test] - fn des_but_not_3des() { - let props = empty_props(); - assert_eq!( - evaluate_algorithm("DES", &props), - PolicyVerdict::NonCompliant - ); - assert_eq!(evaluate_algorithm("3DES", &props), PolicyVerdict::Warning); - assert_eq!( - evaluate_algorithm("Triple-DES", &props), - PolicyVerdict::Warning - ); - } - - #[test] - fn rsa_key_size_discrimination() { - assert_eq!( - evaluate_algorithm("RSA", &props_with_param("1024")), - PolicyVerdict::NonCompliant - ); - assert_eq!( - evaluate_algorithm("RSA", &props_with_param("512")), - PolicyVerdict::NonCompliant - ); - assert_eq!( - evaluate_algorithm("RSA", &props_with_param("2048")), - PolicyVerdict::Warning - ); - assert_eq!( - evaluate_algorithm("RSA", &props_with_param("4096")), - PolicyVerdict::Warning - ); - // RSA without key size info defaults to Warning - assert_eq!( - evaluate_algorithm("RSA", &empty_props()), - PolicyVerdict::Warning - ); - } - - #[test] - fn classical_algorithms_are_warning() { - let props = empty_props(); - assert_eq!(evaluate_algorithm("ECDSA", &props), PolicyVerdict::Warning); - assert_eq!(evaluate_algorithm("ECDH", &props), PolicyVerdict::Warning); - assert_eq!( - evaluate_algorithm("Ed25519", &props), - PolicyVerdict::Warning - ); - assert_eq!(evaluate_algorithm("AES", &props), PolicyVerdict::Warning); - assert_eq!( - evaluate_algorithm("AES-128-GCM", &props), - PolicyVerdict::Warning - ); - } - - #[test] - fn unknown_algorithms_default_to_warning() { - let props = empty_props(); - assert_eq!( - evaluate_algorithm("SomeUnknownAlgo", &props), - PolicyVerdict::Warning - ); - assert_eq!( - evaluate_algorithm("CHACHA20", &props), - PolicyVerdict::Warning - ); - } - - #[test] - fn keycloak_cbom_algorithms() { - // Real algorithms from keycloak-cbom.json fixture - assert_eq!( - evaluate_algorithm( - "SHA1", - &json!({ - "algorithmProperties": { - "primitive": "hash", - "parameterSetIdentifier": "160" - } - }) - ), - PolicyVerdict::NonCompliant - ); - assert_eq!( - evaluate_algorithm( - "ECDH", - &json!({ - "algorithmProperties": { - "primitive": "key-agree" - } - }) - ), - PolicyVerdict::Warning - ); - assert_eq!( - evaluate_algorithm( - "EC-secp521r1", - &json!({ - "algorithmProperties": { - "primitive": "pke", - "curve": "secp521r1" - } - }) - ), - PolicyVerdict::Warning - ); - } - - #[test] - fn missing_properties_handled() { - assert_eq!( - evaluate_algorithm("AES", &json!(null)), - PolicyVerdict::Warning - ); - assert_eq!( - evaluate_algorithm("AES", &json!({})), - PolicyVerdict::Warning - ); - assert_eq!( - evaluate_algorithm("RSA", &json!(null)), - PolicyVerdict::Warning - ); - } -} diff --git a/modules/fundamental/src/endpoints.rs b/modules/fundamental/src/endpoints.rs index cadd25fb54..232c3d3d9c 100644 --- a/modules/fundamental/src/endpoints.rs +++ b/modules/fundamental/src/endpoints.rs @@ -26,6 +26,10 @@ pub struct Config { /// `POST /api/v3/purl/recommend/report` request. Overrides `TRUSTD_RECOMMEND_REPORT_PACKAGE_LIMIT` /// when set explicitly. Default: 10 000. pub recommend_report_package_limit: u64, + /// Base URL of the running Conforma server (e.g. `http://localhost:8085`). + /// Required for `POST /v3/crypto/policy/evaluate`. Start the service with + /// the compose-conforma.yaml overlay before running trustify. + pub conforma_url: Option, } impl Default for Config { @@ -40,6 +44,7 @@ impl Default for Config { max_group_name_length: 0, recommend_patterns: vec![], recommend_report_package_limit: env_limit, + conforma_url: None, } } } @@ -67,7 +72,13 @@ pub fn configure( config.advisory_upload_limit, cache.clone(), ); - crypto::endpoints::configure(svc, db_ro.clone(), cache.clone()); + crypto::endpoints::configure( + svc, + db_rw.clone(), + db_ro.clone(), + cache.clone(), + config.conforma_url, + ); exploit::endpoints::configure(svc, db_ro.clone(), cache.clone()); license::endpoints::configure(svc, db_ro.clone()); organization::endpoints::configure(svc, db_ro.clone(), cache.clone()); diff --git a/modules/fundamental/src/sbom/endpoints/mod.rs b/modules/fundamental/src/sbom/endpoints/mod.rs index 82883d6096..11369480ae 100644 --- a/modules/fundamental/src/sbom/endpoints/mod.rs +++ b/modules/fundamental/src/sbom/endpoints/mod.rs @@ -11,6 +11,7 @@ use uuid::Uuid; use crate::{ Error, common::LicenseRefMapping, + crypto::service::CryptoService, license::{ get_sanitize_filename, service::{LicenseService, license_export::LicenseExporter}, @@ -735,6 +736,7 @@ pub async fn upload( sbom_group: web::Data, config: web::Data, db: web::Data, + crypto_service: Option>, QsQuery(UploadQuery { labels, format, @@ -763,6 +765,9 @@ pub async fn upload( .await?; } + // Capture the raw UUID before the urn:uuid: prefix is added. + let sbom_uuid = Uuid::parse_str(&result.id).ok(); + // Rewrite ID to have the prefix: Although the field is "id" it always carried the ID, // but with the `urn:uuid:` prefix. Which was used for "key" fields. Which accepted // for than the actual ID. The whole naming is flawed and confusing. But in order to @@ -771,6 +776,28 @@ pub async fn upload( tx.commit().await?; + // Fire-and-forget policy evaluation so verdicts are available immediately after ingest. + // Only runs when CONFORMA_URL is configured; failures are logged but do not affect + // the ingest response. + if let (Some(svc), Some(uuid)) = (crypto_service, sbom_uuid) + && svc.has_evaluator() + { + let db_bg = db.clone(); + tokio::spawn(async move { + match db_bg.begin().await { + Ok(tx) => match svc.evaluate_policy(Some(uuid), &tx).await { + Ok(_) => { + if let Err(e) = tx.commit().await { + tracing::warn!("Post-ingest policy eval: commit failed: {e}"); + } + } + Err(e) => tracing::warn!("Post-ingest policy evaluation failed: {e}"), + }, + Err(e) => tracing::warn!("Post-ingest policy eval: failed to begin tx: {e}"), + } + }); + } + log::info!("Uploaded SBOM: {}", result.id); Ok(HttpResponse::Created().json(result)) } diff --git a/modules/ingestor/src/graph/sbom/common/cryptographic_asset.rs b/modules/ingestor/src/graph/sbom/common/cryptographic_asset.rs index 74cf316b0f..6d018ec4f1 100644 --- a/modules/ingestor/src/graph/sbom/common/cryptographic_asset.rs +++ b/modules/ingestor/src/graph/sbom/common/cryptographic_asset.rs @@ -87,6 +87,7 @@ impl CryptographicAssetCreator { asset_type: Set(asset.asset_type), oid: Set(asset.oid), properties: Set(asset.properties), + policy_verdict: Set(None), }); } diff --git a/openapi.yaml b/openapi.yaml index 423e76feb7..1fb85b72c3 100644 --- a/openapi.yaml +++ b/openapi.yaml @@ -1161,6 +1161,18 @@ paths: application/json: schema: $ref: '#/components/schemas/PolicyEvaluationResponse' + /api/v3/crypto/policy/summary: + get: + tags: + - crypto + operationId: getCryptoPolicySummary + responses: + '200': + description: Stored policy verdict summary (reads DB, does not call Conforma) + content: + application/json: + schema: + $ref: '#/components/schemas/PolicySummaryResult' /api/v3/crypto/summary: get: tags: @@ -5431,9 +5443,9 @@ components: - oid - primitive - properties - - policy_status - packages_count - sboms_count + - policy_status properties: asset_type: $ref: '#/components/schemas/CryptoAssetType' @@ -5449,7 +5461,10 @@ components: type: integer format: int64 policy_status: - $ref: '#/components/schemas/PolicyVerdict' + oneOf: + - type: 'null' + - $ref: '#/components/schemas/PolicyVerdict' + description: Policy verdict stored after Conforma evaluation; None means not yet evaluated. primitive: type: - string @@ -5477,19 +5492,7 @@ components: description: Aggregate KPI metrics for cryptographic assets across all SBOMs. required: - total_algorithms - - pqc_compliant - - classical_share_pct - - sboms_meeting_pqc properties: - classical_share_pct: - type: number - format: double - pqc_compliant: - type: integer - format: int64 - sboms_meeting_pqc: - type: integer - format: int64 total_algorithms: type: integer format: int64 @@ -6470,9 +6473,9 @@ components: - oid - primitive - properties - - policy_status - packages_count - sboms_count + - policy_status properties: asset_type: $ref: '#/components/schemas/CryptoAssetType' @@ -6488,7 +6491,10 @@ components: type: integer format: int64 policy_status: - $ref: '#/components/schemas/PolicyVerdict' + oneOf: + - type: 'null' + - $ref: '#/components/schemas/PolicyVerdict' + description: Policy verdict stored after Conforma evaluation; None means not yet evaluated. primitive: type: - string diff --git a/server/src/profile/api.rs b/server/src/profile/api.rs index 4b28ba5841..3282e7855f 100644 --- a/server/src/profile/api.rs +++ b/server/src/profile/api.rs @@ -136,6 +136,12 @@ pub struct Run { #[arg(long, env = "TRUSTD_VALIDATORS_CONFIG")] pub validators_config: Option, + /// Base URL of the running Conforma server (e.g. `http://localhost:8085`). + /// Required for `POST /api/v3/crypto/policy/evaluate`. Start the service with + /// the compose-conforma.yaml overlay (`podman compose -f etc/deploy/compose/compose-conforma.yaml up`). + #[arg(long, env = "CONFORMA_URL")] + pub conforma_url: Option, + // flattened commands must go last // /// Analysis configuration @@ -496,6 +502,7 @@ impl InitData { advisory_upload_limit: run.advisory_upload_limit.into(), max_group_name_length: run.max_group_name_length, recommend_patterns: run.recommend_patterns, + conforma_url: run.conforma_url, ..Default::default() }, ingestor: trustify_module_ingestor::endpoints::Config {