Invalid SPDX generated for flagger

[surendrapathak]

Flagger uses sbom-action to produce spdx with release artifacts. However, the file is an invalid SPDX.

SPDX2.3 requires at least one SHA to be SHA1 for File.

However, the SBOM is missing SHA1 checksums for all files starting line 1835 -

"checksums": [
    {
     "algorithm": "SHA256",
     "checksumValue": "21fd7be6572c8892b02ff91926cf72f456e150c50b58e5f2bb534077bf455551"
    }

Steps to reproduce the issue:

Anything else we need to know?:

Environment:

• Output of syft version:
  From SBOM: "Tool: syft-0.68.1"

• OS (e.g: cat /etc/os-release or similar):

[tgerla]

Hi @surendrapathak, the solution here should be the same as the previous ticket: #1568 (comment) -- if you set the environment variables @kzantow listed, you should see the checksums in the result.