1metadata:
 2  id: audit-log-bad-digest
 3  type: AuditLog
 4  gemara-version: "1.1.0"
 5  version: "1.0.0"
 6  description: "Invalid audit log: evidence source digest uses uppercase algorithm"
 7  author:
 8    id: lead-auditor
 9    name: "Auditor"
10    type: Human
11  mapping-references:
12    - id: github-api
13      title: "GitHub Dependency Graph API"
14      version: "2026"
15      url: "https://docs.github.com/en/rest/dependency-graph"
16
17target:
18  id: gemara-repo
19  name: "gemaraproj/gemara"
20  type: Software
21  uri: "https://github.com/gemaraproj/gemara"
22  environment: production
23
24owner:
25  responsible:
26    - name: "Auditor"
27      affiliation: "External Audit Firm"
28  accountable:
29    - name: "Project Lead"
30      affiliation: "OpenSSF"
31
32summary: "Digest format validation test."
33
34criteria:
35  - reference-id: github-api
36
37results:
38  - id: AR-QA-01
39    title: "Dependency manifests present"
40    type: Observation
41    description: "Repository includes dependency manifests."
42    criteria-reference:
43      reference-id: github-api
44      entries:
45        - reference-id: OSPS-QA-02
46    evidence:
47      - id: EV-QA-01
48        type: api-response
49        description: "Dependency manifests from the GitHub dependency graph SBOM endpoint"
50        collected-at: "2026-02-10T15:05:00Z"
51        source:
52          reference-id: github-api
53          coordinate: "/repos/gemaraproj/gemara/dependency-graph/sbom"
54          digest: "SHA256:invalidbecauseuppercasealgorithm"