Batuhan Apaydın

I can take care of this one ☝️🫡

Last but not least, we need to push this file to the OCI registry along with the image itself :point_down: https://artifacthub.io/docs/topics/repositories/#repository-metadata ```shell $ printf "{}" > config.json $ oras push...

We should enhance this kind of provider thing by using Syft also. How? Syft can generate an SBOM for the container images that we want to validate. Then we can...

I saw it from the documentation: https://goreleaser.com/customization/build/

> I see the reason for `trimpath`, but what I'm referring to is: > > * [#642 (files)](https://github.com/anchore/grype/pull/642/files#diff-e426ed45842837026e10e66af23d9c7077e89eacbe6958ce7cb991130ad05adaR143) > * [#642 (files)](https://github.com/anchore/grype/pull/642/files#diff-f3c08cd4e56926b1732a8183a4eb36057b86d9503161db0021350279b18144a7R184) > > Where there was a change to...

> I see the reason for `trimpath`, but what I'm referring to is: > > * [#642 (files)](https://github.com/anchore/grype/pull/642/files#diff-e426ed45842837026e10e66af23d9c7077e89eacbe6958ce7cb991130ad05adaR143) > * [#642 (files)](https://github.com/anchore/grype/pull/642/files#diff-f3c08cd4e56926b1732a8183a4eb36057b86d9503161db0021350279b18144a7R184) > > Where there was a change to...

https://github.com/hashicorp/vault-csi-provider/pull/143

I reverted GOPATH changes, let's what will happen 😮

``` ⨯ release failed after 96.69s error=failed to build for linux_amd64: exit status 2: # github.com/anchore/grype open main: no such file or directory ``` @wagoodman :(

I think we should get build date via https://reproducible-builds.org/docs/source-date-epoch/