check download digest of rhel oval files (anchore#462)

Signed-off-by: Alex Goodman <[email protected]>

.github/actions/bootstrap/action.yaml

@@ -30,7 +30,7 @@ inputs:
   cache-key-prefix:
     description: "Prefix all cache keys with this value"
     required: true
-    default: "8381c12a05"
+    default: "9c833ef7"
   bootstrap-apt-packages:
     description: "Space delimited list of tools to install via apt"
     default: ""

.gitmodules

@@ -1,4 +1,4 @@
 [submodule "tests/quality/vulnerability-match-labels"]
 	path = tests/quality/vulnerability-match-labels
 	url = [email protected]:anchore/vulnerability-match-labels.git
-	branch = main
+	branch = adjust-centos-ruby-labels

src/vunnel/providers/rhel/oval_parser.py

@@ -107,7 +107,7 @@ def _download_oval_file(self, base_url: str, oval_url_path: str, path_to_sha: di
 
         if previous_sha256 and latest_sha256:
             self.logger.debug(f"{oval_url_path}: previous sha256: {previous_sha256}, latest sha256: {latest_sha256}")
-            download = latest_sha256.lower() != latest_sha256.lower()
+            download = previous_sha256.lower() != latest_sha256.lower()
 
         if download:
             try: