Component Hashes in SBOMs

CISA 2026 SBOM Minimum Elements mandates per-component digests or hashes as a minimum element. I believe this is the most controversial and problematic change in the requirements. That is if we want those hashes to have some meaning. Apparently, there are 2 intended meanings: Verification of component’s validity and integrity via hash (this is where the problem lies) Signal that manufacturer had access to the component at some point Here is why verification is an issue. My favourite example is container images. They used to have repository names embedded into manifests, and the hash would come from manifest. Transfer that same image (byte-to-byte equal) to a different registry and the hash would change. This was later fixed, but the problem remains that they are still serialization-dependent, and the tooling that moves artifacts re-serializes constantly. docker pull followed by docker push collapses a multi-arch index to one platform and can recompress layers, and there are other…