A vendor-published sha256, with or without a sha256: prefix, as lowercase hex; anything else is null.
sha256:
A vendor-published sha256, with or without a
sha256:prefix, as lowercase hex; anything else is null.