mirror of
https://github.com/anchore/syft.git
synced 2026-10-11 21:57:22 +02:00
An extra-dep can be pinned as "@sha256:<hash>,<size>" or as "@rev:<n>". The hash slice assumed the first form, so a rev pin left the end index at -1 and the parser panicked with slice bounds out of range. A rev pin carries no package hash, so only the sha256 form now yields one. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>