From 1e0df2f4a39b623a756171afce4fda5e929432da Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 11 Oct 2026 02:22:07 +0200 Subject: [PATCH] Reject advisory policy envelopes before lifecycle effects Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade --- ...026-10-10-lifecycle-consumer-pin-repair.md | 122 + ...lifecycle-consumer-pin-repair.sources.json | 32 + .../Containerfile | 5 + .../2026-10-11-purpose-hardening/README.md | 62 + .../2026-10-11-purpose-hardening/checks.json | 27 + .../container.json | 32 + .../installed-purpose.py | 21 + .../provenance.json | 9 + .../2026-10-11-purpose-hardening/scan.json | 2354 +++++++++++++++++ informed_decision/policy.py | 6 + tests/test_lifecycle_policy_component.py | 63 + tests/test_policy_client.py | 14 + ...D-WP-0009-lifecycle-consumer-pin-repair.md | 107 + 13 files changed, 2854 insertions(+) create mode 100644 docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.md create mode 100644 docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.sources.json create mode 100644 docs/evidence/2026-10-11-purpose-hardening/Containerfile create mode 100644 docs/evidence/2026-10-11-purpose-hardening/README.md create mode 100644 docs/evidence/2026-10-11-purpose-hardening/checks.json create mode 100644 docs/evidence/2026-10-11-purpose-hardening/container.json create mode 100644 docs/evidence/2026-10-11-purpose-hardening/installed-purpose.py create mode 100644 docs/evidence/2026-10-11-purpose-hardening/provenance.json create mode 100644 docs/evidence/2026-10-11-purpose-hardening/scan.json create mode 100644 workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md diff --git a/docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.md b/docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.md new file mode 100644 index 0000000..c09d129 --- /dev/null +++ b/docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.md @@ -0,0 +1,122 @@ +# Lifecycle consumer pin repair — 2026-10-10 + +Initial preparation is retained below. The config-only repair was approved and +verified live on 2026-10-11; the dated execution appendix distinguishes it from +the separate, unpublished purpose-hardening image. No human disposition is claimed. +Root agent observed native State Hub `POST /v1/decisions` returning HTTP 503 +`invalid_decision`, and read only fixed runtime policy fields: lifecycle package +`informed-decision.lifecycle`, version `v1`, digest +`sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827`. +The provider owner pin is now version `v2`, digest +`sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c`. + +Access Engine `pkg/api/canonical.go` defines and emits only envelope contract +`flex-auth.decision-record.v1`. FLEX-WP-0035 adds advisory binding purpose +`readback`; enforcement binding purpose stays absent. Lifecycle policy version +v2 must not be mistaken for envelope contract version v2. Informed Decision's +existing exact package/version/digest check correctly refuses a stale pin. +Readiness does not prove that a consumer pin matches a provider release. + +Root's sanitized native provider probe returned HTTP 200, envelope contract +`flex-auth.decision-record.v1`, binding purpose absent, matched policy version +v2, provenance lifecycle package v2/da01e045, and submitted digest match true. +Consumer runtime remained v1/cee6a79. Native pod Ready=1 and image 7f5c6cb. +Reported CPU requested headroom: 3460m/4000m (86% allocated); this repair retains +5m request and Recreate, and does not add a concurrent pod. + +## Exact proposed action + +Stable proposal: `INFD-WP-0009-T02/config-repin-v1`. +Update the lifecycle pin in `deploy/lifecycle/admission.candidate.json` and +`deploy/lifecycle/service.candidate.json`. Replace immutable runtime ConfigMap +`informed-decision-runtime-c81577741a09` with +`informed-decision-runtime-6c221878d051`, and update the Deployment's +`configuration` volume reference to the new name. Same namespace and service. +The runtime JSON differs only in lifecycle version/digest. + +Service image remains +`forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173`. +The existing image needs no source parser patch to consume this owner policy. +Local inspected service source HEAD is `bee5ad9af60ab21bcc88423307ce02cc2ab5631b`; +local provider source HEAD is `f5fad7c2851708be41c82891430deffe5f4af0ac`. +No schema migration, credentials, review-policy pin, audience or network +change. Initial lifecycle repair does not implement expansion INFD-WP-0008. + +## Verification + +Real Access Engine HTTP component with synthetic caller custody, current owner +lifecycle fixture and existing PolicyClient: three tests passed (one collaboration +flow, two stale-pin regressions). Each stale version or digest produces exact +503 `invalid_decision`, writes no memo/lifecycle event, then succeeds with the +exact current owner pin. This proves restoring compatible policy pins suffices; +no parser relaxation is needed. Staged ConfigMap exactly matches the established +renderer output for the repinned admission input; retained customizations in +the existing Deployment are preserved. + +Before execution: retain exact live Deployment, old runtime ConfigMap, current +image digest and database evidence counts; verify live runtime JSON differs from +candidate only as reviewed. Run server-side dry-run and diff through the current +owner GitOps release path and retain their results. Check railiance01 headroom: +existing request is 5m CPU, unchanged; Recreate stops the single writer first. +Expect a brief interruption. No concurrent writer is admitted. + +After execution: verify exact same image and new ConfigMap reference, rollout +completion and readyz; prove native State Hub registration/publication with +stable write keys and retained provider observations/receipts. Ready alone is +insufficient. Human acceptance remains a separate human act. + +## Rollback and risk + +Rollback: restore the old Deployment configuration volume reference and its +retained immutable ConfigMap through the same GitOps path. Preserve the existing +schema-5 database and any new evidence; do not restore an old database merely +to revert policy pins. The old pin intentionally returns to fail-closed 503 +against the v2 provider; coordinate owner rollback only if the provider itself +must be reverted. No provider rollback belongs to this proposal. + +No cloud/resource expansion or paid inference; expected incremental cost EUR 0. +Risk: brief service interruption and continued refusal if the runtime provider +pin differs; verification stops closure until native receipts exist. + +## Source hashes + +See `2026-10-10-lifecycle-consumer-pin-repair.sources.json` for exact original and +proposed release artifact SHA-256 values. Supervisor approval, approved digest, +executed digest and verified outcome must be recorded by the root executor; +this packet supplies preparation only. + + +## Separate source hardening (not in config-only live proposal) + +PolicyClient now explicitly refuses advisory or malformed binding purpose; only +absence or the exact empty string is the canonical enforcement form. Current +service image 7f5c6cb does not contain this patch. Unit coverage includes nine +purpose variants; a real provider allow envelope with unchanged binding digest, +package pins and TTL is injected with `purpose=readback` and must refuse the +write, then the original enforcement response succeeds. These tests cover the +missing consumer guard without accepting an unpublished envelope v2 contract. +INFD-WP-0009-T04 retains separate image preparation/native release work. T02's +same-image config repair remains unchanged. + +Validation after source hardening: 73 policy/purpose, real-provider component +and deployment-render tests passed; 21 lifecycle-service checks passed. Review +controller component checks (53) require its other owner binary and were skipped; +they are not counted as verified. No live hardening rollout is claimed. + +## Config-only execution appendix — 2026-10-11 + +Founder approved exact revision `7db8485ffecdebfabd77a9daec085553c74bf0bf`. +The existing manual Argo Application synced only the new runtime ConfigMap and +Deployment, with prune disabled. Application Succeeded/Healthy; generation24 +observed24 Ready1 and `/readyz`200 were verified. Lifecycle consumer version +v2/da01e045 and unchanged service image7f5c6cb were observed. Native State Hub +registration/publication succeeded with stable write keys; review delivery later +completed after correcting a separate caller packet-validation error. +Custodian retains exact approval, rendered digest, executed JSON patch, outcomes +and rollback in `docs/evidence/2026-10-10-security-consolidation/`. Original +preparation hashes above remain historical evidence, not rewritten approval. + +Purpose-hardening T04 preparation now has a built, scanned local image and +synthetic installed/backup checks in `2026-10-11-purpose-hardening/README.md`. +That image is neither published nor deployed; config-only approval does not +cover it. diff --git a/docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.sources.json b/docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.sources.json new file mode 100644 index 0000000..1720338 --- /dev/null +++ b/docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.sources.json @@ -0,0 +1,32 @@ +[ + { + "repo": "informed-decision", + "path": "deploy/lifecycle/admission.candidate.json", + "original_sha256": "fc5d6fb8ab833f268427d05f01c9c40db4b7fdd30840a5bdd6660dc6277e3cba", + "staged_sha256": "22f830736ee56f6ed9b62f47d243e4e24a1b68263b261e78e2f1cfcb85adbd50" + }, + { + "repo": "informed-decision", + "path": "deploy/lifecycle/service.candidate.json", + "original_sha256": "fcfd29e0ed438b8fc3dd2e719db5a914ec3d947775bf38cae8deeb5d2269e954", + "staged_sha256": "7a676532836affd6d75c7f1c41a5f937d8c8c809f63e3264ccce612730d5ba7b" + }, + { + "repo": "informed-decision", + "path": "tests/test_lifecycle_policy_component.py", + "original_sha256": "5fc8e57f499ca0c2882d4fcbfc5a5f6af46315d34b3d03d9a3a6dd95e225487b", + "staged_sha256": "7a08fece31ddb5fd80ccdb67c5fc2821e328d8751e33c55714fd398982f71039" + }, + { + "repo": "informed-decision", + "path": "informed_decision/policy.py", + "original_sha256": "a00b93b34caee5f190dea750c53b7bca819b993b8ef2f499ef9525d7b8c11842", + "staged_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + { + "repo": "informed-decision", + "path": "tests/test_policy_client.py", + "original_sha256": "7e3285e7b0381612f40c13a2f2b8f92d6520a4415b44437bc7538cf87f5adbf7", + "staged_sha256": "2d743fa7f624f667b714be488197cda0cc82056dee44b5457e28786f09447622" + } +] diff --git a/docs/evidence/2026-10-11-purpose-hardening/Containerfile b/docs/evidence/2026-10-11-purpose-hardening/Containerfile new file mode 100644 index 0000000..2208be3 --- /dev/null +++ b/docs/evidence/2026-10-11-purpose-hardening/Containerfile @@ -0,0 +1,5 @@ +FROM forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173 +LABEL org.opencontainers.image.base.digest="sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173" +LABEL social.coulomb.source.policy.sha256="9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" +LABEL social.coulomb.source.base.revision="7db8485ffecdebfabd77a9daec085553c74bf0bf" +COPY policy.py /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py diff --git a/docs/evidence/2026-10-11-purpose-hardening/README.md b/docs/evidence/2026-10-11-purpose-hardening/README.md new file mode 100644 index 0000000..dc3ab06 --- /dev/null +++ b/docs/evidence/2026-10-11-purpose-hardening/README.md @@ -0,0 +1,62 @@ +# Advisory-purpose hardening image preparation — 2026-10-11 + +INFD-WP-0009-T04 remains in progress. This candidate is locally built and tested; +it has no registry publication or deployment receipt. Proposal ID: +`INFD-WP-0009-T04/purpose-overlay-v1`. No live action is authorized by this packet. + +Base: `forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173`. +Base installed policy.py equals HEAD7db8485 policy SHA-256a00b93b34caee5f190dea750c53b7bca819b993b8ef2f499ef9525d7b8c11842. +Overlay source SHA-2569d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62. +Only policy.py is added as one layer. Dependency, schema/store, runtime user, +entrypoint, env and ports remain exact. `provenance.json` binds source and build +recipe; source patch remains uncommitted during preparation and no whole-tree +commit provenance is claimed. + +Local candidate `informed-decision:purpose-hardening-20261011` has index digest +`sha256:b8b58944786015a5375304241c149d1dab885eb539d6d8945f56b01a3c2bc821`, +platform manifest918bbdce7337b716edfeb99b9343037dd141bb870aa3f32d7e4394c410c65b7d, +configf187897d7322f10e06d53c153a6fa7e6f7403b47a9b59cf6edd12285ec479310. +These local digests are not registry receipts. Verify eventual published digest +and installed source before authoring a final admitted Deployment pin. + +Evidence: `checks.json` proves base layer/config equality and fresh scan DB +(2026-10-10 updated18:59Z, downloaded23:32Z), zero HIGH/CRITICAL findings. +`scan.json` retains package findings; scanner warns Alpine3.24 is not on its +EOL list. Vulnerability scan is bounded and not a universal security claim. +`container.json` retains 13 checks, including private single writer, uncertain +submission preservation, restart, consistent backup and separate synthetic +restore. All temporary containers/volumes were removed. `installed-purpose.py` +passes 10 installed-client forms: absent and empty allow, eight other/advisory +forms refuse. Native identity/PDP/approval/audit proof is not claimed. + +Rebuild: make a fresh private temporary context, copy exact policy.py from owner +source and this Containerfile to it, check both hashes against provenance.json, +then `docker build --network none --pull=false -f /Containerfile -t +informed-decision:purpose-hardening-20261011 `. Use only the immutable +base and these files; normal repo .dockerignore excludes a direct module copy. +No package download or broader dirty-source wheel enters this overlay. + +## Concrete proposed release + +After registry publication/verification, update only admission.candidate.json +image and rendered service.candidate.json Deployment image, preserving current +ConfigMap6c221878d051, schema5, review/lifecycle policy pins, requester custody, +audience, network, PVC, 5m request, replicas1 and Recreate. Retain exact source +revision/digest and server dry-run/diff through manual Argo before approval. +Obtain separate supervisor approval of that concrete immutable image revision; +the config-only7db8485 approval cannot be reused. + +Before cutover retain metadata-only counts and unique consistent native snapshot +in protected custody; verify restore with the candidate on a separate protected +volume without printing record content or credentials. Synthetic restore here +proves mechanism only. Same-schema rollback retains current DB/evidence and +restores image7f5c6cb through owner Argo; no data downgrade or replay is intended. +Risk: brief Recreate interruption, no concurrent writer; incremental EUR0 for +existing infrastructure, no paid inference. This source correction refuses an +advisory envelope before effects while preserving exact current enforcement. + +After approved release verify exact image/config, health, current pins and native +register/publication with stable keys; inject a native-provider-derived advisory +response in an isolated installed-client probe and prove refusal before writes. +Do not contaminate production PDP config or create human approvals to test this +guard. Reconcile lifecycle/audit receipts and retain failed/uncertain outcomes. diff --git a/docs/evidence/2026-10-11-purpose-hardening/checks.json b/docs/evidence/2026-10-11-purpose-hardening/checks.json new file mode 100644 index 0000000..9d0635b --- /dev/null +++ b/docs/evidence/2026-10-11-purpose-hardening/checks.json @@ -0,0 +1,27 @@ +{ + "candidate_image_id": "sha256:b8b58944786015a5375304241c149d1dab885eb539d6d8945f56b01a3c2bc821", + "repo_digests": [ + "informed-decision@sha256:b8b58944786015a5375304241c149d1dab885eb539d6d8945f56b01a3c2bc821" + ], + "base_layers_preserved": true, + "additional_layers": 1, + "runtime_config_preserved": { + "User": true, + "Entrypoint": true, + "Cmd": true, + "Env": true, + "ExposedPorts": true, + "WorkingDir": true + }, + "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969", + "db": { + "Version": 2, + "NextUpdate": "2026-10-11T18:59:50.889010572Z", + "UpdatedAt": "2026-10-10T18:59:50.889010923Z", + "DownloadedAt": "2026-10-10T23:32:32.380033131Z" + }, + "high_critical": [], + "scan_scope": "candidate OS/package vulnerabilities; not security attestation; scan warning Alpine3.24 not on EOL list", + "published": false, + "deployed": false +} diff --git a/docs/evidence/2026-10-11-purpose-hardening/container.json b/docs/evidence/2026-10-11-purpose-hardening/container.json new file mode 100644 index 0000000..5add763 --- /dev/null +++ b/docs/evidence/2026-10-11-purpose-hardening/container.json @@ -0,0 +1,32 @@ +{ + "status": "passed", + "image_id": "sha256:b8b58944786015a5375304241c149d1dab885eb539d6d8945f56b01a3c2bc821", + "repo_digests": [ + "informed-decision@sha256:b8b58944786015a5375304241c149d1dab885eb539d6d8945f56b01a3c2bc821" + ], + "checks_passed": 13, + "checks": [ + "installed container entrypoint serves with projected configuration", + "non-root read-only runtime has no external network or published port", + "private config/database modes enforced; package installer absent", + "configured review refuses anonymous access and reports audit-unready status", + "private listener refuses anonymous lifecycle access and exposes no browser routes", + "public listener exposes no private workload route", + "a second writer cannot acquire the active evidence volume", + "synthetic uncertain intent and undelivered evidence remain explicit", + "consistent backup created while serving; overwrite refused", + "SIGTERM closes the serving writer without forced kill", + "restart preserves immutable content and unresolved submission without retry", + "separate restored volume preserves exact content and unresolved state", + "incomplete owner configuration exits before serving" + ], + "fixture_only": true, + "external_network": "none", + "content_snapshot_sha256": "6ff72dc6578d8a4c0803ec4330e6144ae18c3182e29ab5506b039cedefb468ea", + "native_identity_policy_audit_proven": false, + "published": false, + "deployed": false, + "factory_attempts": 0, + "paid_model_calls": 0, + "cleanup_complete": true +} diff --git a/docs/evidence/2026-10-11-purpose-hardening/installed-purpose.py b/docs/evidence/2026-10-11-purpose-hardening/installed-purpose.py new file mode 100644 index 0000000..0736145 --- /dev/null +++ b/docs/evidence/2026-10-11-purpose-hardening/installed-purpose.py @@ -0,0 +1,21 @@ +import copy,json,time +from datetime import datetime,timezone +from informed_decision.policy import PolicyClient,CONTRACT,submitted_digest +pin='sha256:'+'b'*64 +req={'id':'image-purpose-fixture','tenant':'tenant:platform','subject':{'id':'synthetic','type':'service','tenant':'tenant:platform'},'resource':{'id':'memo:fixture','type':'memo','system':'informed-decision','tenant':'tenant:platform'},'action':'register','context':{}} +class Transport: + def request(self,*args,**kwargs): + now=time.time(); stamp=lambda t:datetime.fromtimestamp(t,timezone.utc).isoformat() + b={**copy.deepcopy({k:req[k] for k in ('tenant','subject','action','resource','context')}),'request_digest':'sha256:'+'e'*64,'submitted_request_digest':submitted_digest(req)} + if self.purpose!='ABSENT':b['purpose']=self.purpose + d={'id':'synthetic-decision','contract_version':CONTRACT,'request_id':req['id'],'effect':'allow','matched_policy_version':'v1','subject':req['subject'],'resource':req['resource'],'binding':b,'lifetime':{'kind':'ttl','not_before':stamp(now-1),'expires_at':stamp(now+60)},'provenance':{'policy_package':'fixture','policy_version':'v1','policy_package_digest':pin,'registry_snapshot_digest':'sha256:'+'c'*64,'evaluator':'flex-auth/fixture','decision_time':stamp(now)}} + return 200,d +checks=[] +for purpose in ('ABSENT','','readback','enforcement','unknown',None,False,0,[],{}): + t=Transport();t.purpose=purpose + c=PolicyClient('https://fixture.invalid',lambda:'synthetic-only',package='fixture',version='v1',package_digest=pin,transport=t) + o=c.check(req) + if purpose in ('ABSENT',''):assert o.outcome=='allow';o.require_current(time.time()) + else:assert o.outcome=='invalid_decision' and o.decision_json is None + checks.append(str(purpose)) +print(json.dumps({'installed_image_purpose_variants':len(checks),'binding_forms_allowed':2,'advisory_or_malformed_refused':8,'synthetic_only':True,'native_provider':False})) diff --git a/docs/evidence/2026-10-11-purpose-hardening/provenance.json b/docs/evidence/2026-10-11-purpose-hardening/provenance.json new file mode 100644 index 0000000..afdeb6a --- /dev/null +++ b/docs/evidence/2026-10-11-purpose-hardening/provenance.json @@ -0,0 +1,9 @@ +{ + "source_base_revision": "7db8485ffecdebfabd77a9daec085553c74bf0bf", + "base_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "base_policy_sha256": "a00b93b34caee5f190dea750c53b7bca819b993b8ef2f499ef9525d7b8c11842", + "policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", + "containerfile_sha256": "42277e419014a56c0d24399a3aa45b2b0b27a7c22e0d225110007fa71460d345", + "scope": "single policy.py overlay; source correction uncommitted; not a claim whole worktree committed", + "tag": "informed-decision:purpose-hardening-20261011" +} diff --git a/docs/evidence/2026-10-11-purpose-hardening/scan.json b/docs/evidence/2026-10-11-purpose-hardening/scan.json new file mode 100644 index 0000000..0a33539 --- /dev/null +++ b/docs/evidence/2026-10-11-purpose-hardening/scan.json @@ -0,0 +1,2354 @@ +{ + "SchemaVersion": 2, + "Trivy": { + "Version": "0.74.0" + }, + "ReportID": "01a12829-4648-7753-afcb-5d2adbad0dad", + "CreatedAt": "2026-10-10T23:32:36.040482769Z", + "ArtifactID": "sha256:1bad13e980cfc8180d0a62925280f3b1fe7fcc1eaf75de2db788955bf1b74641", + "ArtifactName": "/proof/image.tar", + "ArtifactType": "container_image", + "Metadata": { + "Size": 88258048, + "OS": { + "Family": "alpine", + "Name": "3.24.1" + }, + "ImageID": "sha256:f187897d7322f10e06d53c153a6fa7e6f7403b47a9b59cf6edd12285ec479310", + "DiffIDs": [ + "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c", + "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd", + "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366", + "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe", + "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1", + "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c", + "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59", + "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02", + "sha256:cfe264ae4f375233f7120985f4ec67f07a192f53197dcab8bd839322e215697b" + ], + "RepoTags": [ + "informed-decision:purpose-hardening-20261011" + ], + "Reference": "informed-decision:purpose-hardening-20261011", + "ImageConfig": { + "architecture": "amd64", + "created": "2026-10-11T01:26:13.880821866+02:00", + "history": [ + { + "created": "2026-06-16T00:01:29.967161902Z", + "created_by": "ADD alpine-minirootfs-3.24.1-x86_64.tar.gz / # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-06-16T00:01:29.967161902Z", + "created_by": "CMD [\"/bin/sh\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV LANG=C.UTF-8", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "RUN /bin/sh -c set -eux; \tapk add --no-cache \t\tca-certificates \t\ttzdata \t; # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PYTHON_VERSION=3.12.14", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:10:30.672225972Z", + "created_by": "RUN /bin/sh -c set -eux; \t\tapk add --no-cache --virtual .build-deps \t\tbluez-dev \t\tbzip2-dev \t\tdpkg-dev dpkg \t\tfindutils \t\tg++ \t\tgcc \t\tgdbm-dev \t\tgnupg \t\tlibc-dev \t\tlibffi-dev \t\tlibnsl-dev \t\tlibtirpc-dev \t\tlinux-headers \t\tmake \t\tncurses-dev \t\topenssl-dev \t\tpax-utils \t\treadline-dev \t\tsqlite-dev \t\ttar \t\ttcl-dev \t\ttk \t\ttk-dev \t\tutil-linux-dev \t\txz \t\txz-dev \t\tzlib-dev \t; \t\twget -O python.tar.xz \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz\"; \techo \"$PYTHON_SHA256 *python.tar.xz\" | sha256sum -c -; \twget -O python.tar.xz.asc \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc\"; \tGNUPGHOME=\"$(mktemp -d)\"; export GNUPGHOME; \tgpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$GPG_KEY\"; \tgpg --batch --verify python.tar.xz.asc python.tar.xz; \tgpgconf --kill all; \trm -rf \"$GNUPGHOME\" python.tar.xz.asc; \tmkdir -p /usr/src/python; \ttar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; \trm python.tar.xz; \t\tcd /usr/src/python; \tgnuArch=\"$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)\"; \t./configure \t\t--build=\"$gnuArch\" \t\t--enable-loadable-sqlite-extensions \t\t--enable-option-checking=fatal \t\t--enable-shared \t\t$(test \"${gnuArch%%-*}\" != 'riscv64' \u0026\u0026 echo '--with-lto') \t\t--with-ensurepip \t; \tnproc=\"$(nproc)\"; \tEXTRA_CFLAGS=\"-DTHREAD_STACK_SIZE=0x100000\"; \tLDFLAGS=\"${LDFLAGS:-} -Wl,--strip-all\"; \tarch=\"$(apk --print-arch)\"; \tcase \"$arch\" in \t\tx86_64|aarch64) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer\"; \t\t\t;; \t\tx86) \t\t\t;; \t\t*) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer\"; \t\t\t;; \tesac; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-}\" \t; \trm python; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\\$\\$ORIGIN/../lib'\" \t\tpython \t; \tmake install; \t\tcd /; \trm -rf /usr/src/python; \t\tfind /usr/local -depth \t\t\\( \t\t\t\\( -type d -a \\( -name test -o -name tests -o -name idle_test \\) \\) \t\t\t-o \\( -type f -a \\( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \\) \\) \t\t\\) -exec rm -rf '{}' + \t; \t\tfind /usr/local -type f -executable -not \\( -name '*tkinter*' \\) -exec scanelf --needed --nobanner --format '%n#p' '{}' ';' \t\t| tr ',' '\\n' \t\t| sort -u \t\t| awk 'system(\"[ -e /usr/local/lib/\" $1 \" ]\") == 0 { next } { print \"so:\" $1 }' \t\t| xargs -rt apk add --no-network --virtual .python-rundeps \t; \tapk del --no-network .build-deps; \t\texport PYTHONDONTWRITEBYTECODE=1; \tpython3 --version; \tpip3 --version # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:10:30.782726003Z", + "created_by": "RUN /bin/sh -c set -eux; \tfor src in idle3 pip3 pydoc3 python3 python3-config; do \t\tdst=\"$(echo \"$src\" | tr -d 3)\"; \t\t[ -s \"/usr/local/bin/$src\" ]; \t\t[ ! -e \"/usr/local/bin/$dst\" ]; \t\tln -svT \"$src\" \"/usr/local/bin/$dst\"; \tdone # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:10:30.782726003Z", + "created_by": "CMD [\"python3\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-11T00:49:47.962156876+02:00", + "created_by": "ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-11T00:49:47.962156876+02:00", + "created_by": "RUN /bin/sh -c apk add --no-cache 'libuuid\u003e=2.42.3-r1' \u0026\u0026 addgroup -S -g 10001 informed \u0026\u0026 adduser -S -u 10001 -G informed -H informed # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:55.351944978+02:00", + "created_by": "COPY /opt/venv /opt/venv # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.462092072+02:00", + "created_by": "RUN /bin/sh -c rm -rf /usr/local/bin/pip* /usr/local/lib/python3.12/site-packages/pip* /usr/local/lib/python3.12/site-packages/setuptools* /usr/local/lib/python3.12/site-packages/pkg_resources /opt/venv/bin/pip* /opt/venv/lib/python3.12/site-packages/pip* /opt/venv/lib/python3.12/site-packages/setuptools* /opt/venv/lib/python3.12/site-packages/pkg_resources # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "WORKDIR /app", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "USER 10001:10001", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "EXPOSE [8080/tcp 8081/tcp]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "ENTRYPOINT [\"informed-decision-container\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-11T01:26:13.880821866+02:00", + "created_by": "LABEL org.opencontainers.image.base.digest=sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-11T01:26:13.880821866+02:00", + "created_by": "LABEL social.coulomb.source.policy.sha256=9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-11T01:26:13.880821866+02:00", + "created_by": "LABEL social.coulomb.source.base.revision=7db8485ffecdebfabd77a9daec085553c74bf0bf", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-11T01:26:13.880821866+02:00", + "created_by": "COPY policy.py /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py # buildkit", + "comment": "buildkit.dockerfile.v0" + } + ], + "os": "linux", + "rootfs": { + "type": "layers", + "diff_ids": [ + "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c", + "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd", + "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366", + "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe", + "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1", + "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c", + "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59", + "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02", + "sha256:cfe264ae4f375233f7120985f4ec67f07a192f53197dcab8bd839322e215697b" + ] + }, + "config": { + "Entrypoint": [ + "informed-decision-container" + ], + "Env": [ + "PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "LANG=C.UTF-8", + "GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", + "PYTHON_VERSION=3.12.14", + "PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a", + "PYTHONDONTWRITEBYTECODE=1", + "PYTHONUNBUFFERED=1" + ], + "Labels": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "social.coulomb.source.base.revision": "7db8485ffecdebfabd77a9daec085553c74bf0bf", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "User": "10001:10001", + "WorkingDir": "/app", + "ExposedPorts": { + "8080/tcp": {}, + "8081/tcp": {} + } + } + }, + "Layers": [ + { + "Size": 8697856, + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "Size": 1538048, + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "Size": 47150592, + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "Size": 5120, + "Digest": "sha256:ed62c91ccd94e36a928e96d704cfcf20861302590245cc12aa89a15a5d6be29b", + "DiffID": "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe" + }, + { + "Size": 131584, + "Digest": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86", + "DiffID": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "Size": 30705664, + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "Size": 12288, + "Digest": "sha256:16a3dba6b720d3059eab918cd3596f94145ac9cf4d456f925a21f0f72522863f", + "DiffID": "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59" + }, + { + "Size": 1536, + "Digest": "sha256:e73dd464fbff5607cc62a1b2b66b0eefe737dfad4db8e7b58a48cda7c12d94d3", + "DiffID": "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02" + }, + { + "Size": 15360, + "Digest": "sha256:16240cb52c7e7b3c8c9d8c5ef77790b1ddb527cb13001191d7e153b2f965b1ed", + "DiffID": "sha256:cfe264ae4f375233f7120985f4ec67f07a192f53197dcab8bd839322e215697b" + } + ] + }, + "Results": [ + { + "Target": "/proof/image.tar (alpine 3.24.1)", + "Class": "os-pkgs", + "Type": "alpine", + "Packages": [ + { + "ID": ".python-rundeps@20260901.001029", + "Name": ".python-rundeps", + "Identifier": { + "PURL": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch\u0026distro=3.24.1", + "UID": "4e26c99fecac1e97" + }, + "Version": "20260901.001029", + "Arch": "noarch", + "DependsOn": [ + "gdbm@1.26-r0", + "libbz2@1.0.8-r6", + "libcrypto3@3.5.8-r0", + "libffi@3.5.2-r1", + "libncursesw@6.6_p20260516-r0", + "libnsl@2.0.1-r2", + "libpanelw@6.6_p20260516-r0", + "libssl3@3.5.8-r0", + "libtirpc@1.3.5-r1", + "libuuid@2.42.3-r1", + "musl@1.2.6-r2", + "readline@8.3.3-r1", + "sqlite-libs@3.53.4-r0", + "xz-libs@5.8.3-r0", + "zlib@1.3.2-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:51d0c1e7d88a414345799f0309185c625013ef32", + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-baselayout@3.7.2-r1", + "Name": "alpine-baselayout", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "1b9c543300f8073e" + }, + "Version": "3.7.2-r1", + "Arch": "x86_64", + "SrcName": "alpine-baselayout", + "SrcVersion": "3.7.2-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "alpine-baselayout-data@3.7.2-r1", + "busybox-binsh@1.37.0-r31" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:f0fcfdc2f4da058af6473bc45c4eab62916225b2", + "InstalledFiles": [ + "etc/motd", + "etc/crontabs/root", + "etc/modprobe.d/aliases.conf", + "etc/modprobe.d/blacklist.conf", + "etc/modprobe.d/i386.conf", + "etc/profile.d/20locale.sh", + "etc/profile.d/README", + "etc/profile.d/color_prompt.sh.disabled", + "usr/lib/sysctl.d/00-alpine.conf", + "var/lock", + "var/run", + "var/spool/mail", + "var/spool/cron/crontabs" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-baselayout-data@3.7.2-r1", + "Name": "alpine-baselayout-data", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "fcc3cd90122d8aa7" + }, + "Version": "3.7.2-r1", + "Arch": "x86_64", + "SrcName": "alpine-baselayout", + "SrcVersion": "3.7.2-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c6f9bded17d844b6f1b0bb5766d2c35c0d5c8508", + "InstalledFiles": [ + "etc/fstab", + "etc/group", + "etc/hostname", + "etc/hosts", + "etc/inittab", + "etc/modules", + "etc/mtab", + "etc/nsswitch.conf", + "etc/passwd", + "etc/profile", + "etc/protocols", + "etc/services", + "etc/shadow", + "etc/shells", + "etc/sysctl.conf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-keys@2.6-r0", + "Name": "alpine-keys", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "cb1f6c8fa74713e0" + }, + "Version": "2.6-r0", + "Arch": "x86_64", + "SrcName": "alpine-keys", + "SrcVersion": "2.6-r0", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:d8d6b80e53c059a77e4915da78ba964f3ffea240", + "InstalledFiles": [ + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", + "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", + "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", + "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", + "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", + "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", + "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", + "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", + "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", + "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", + "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", + "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", + "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-release@3.24.1-r0", + "Name": "alpine-release", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "6cfad6f36e1f31aa" + }, + "Version": "3.24.1-r0", + "Arch": "x86_64", + "SrcName": "alpine-base", + "SrcVersion": "3.24.1-r0", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "alpine-keys@2.6-r0" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:bc6912a25cdc7733e0035ed509eceaa4026946e3", + "InstalledFiles": [ + "etc/alpine-release", + "etc/issue", + "etc/os-release", + "etc/secfixes.d/alpine", + "usr/lib/os-release" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "apk-tools@3.0.6-r0", + "Name": "apk-tools", + "Identifier": { + "PURL": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "cb2633c883b17a04" + }, + "Version": "3.0.6-r0", + "Arch": "x86_64", + "SrcName": "apk-tools", + "SrcVersion": "3.0.6-r0", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "ca-certificates-bundle@20260611-r0", + "libapk@3.0.6-r0", + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2", + "zlib@1.3.2-r0" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:043333589798a1f52e09ae63f026c6c8fa676d34", + "InstalledFiles": [ + "sbin/apk" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "busybox@1.37.0-r31", + "Name": "busybox", + "Identifier": { + "PURL": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "771020c43c8440bf" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:b5405ebc02f7dd8be95b6265c54b243d5456ab8f", + "InstalledFiles": [ + "bin/busybox", + "etc/securetty", + "etc/busybox-paths.d/busybox", + "etc/logrotate.d/acpid", + "etc/network/if-up.d/dad", + "etc/udhcpc/udhcpc.conf", + "usr/share/udhcpc/default.script" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "busybox-binsh@1.37.0-r31", + "Name": "busybox-binsh", + "Identifier": { + "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "1ec8a3d5d2b63297" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "busybox@1.37.0-r31" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:5cbd14acc6f1804c5bac6c77dc2c492f010b0fc7", + "InstalledFiles": [ + "bin/sh" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ca-certificates@20260611-r0", + "Name": "ca-certificates", + "Identifier": { + "PURL": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "2a3c316ee83c6198" + }, + "Version": "20260611-r0", + "Arch": "x86_64", + "SrcName": "ca-certificates", + "SrcVersion": "20260611-r0", + "Licenses": [ + "MPL-2.0", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "busybox-binsh@1.37.0-r31", + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + "Digest": "sha1:8f2a04abeb54b331e2970a0a0dffb7bd6bdde567", + "InstalledFiles": [ + "etc/ca-certificates.conf", + "etc/apk/protected_paths.d/ca-certificates.list", + "etc/ca-certificates/update.d/certhash", + "usr/bin/c_rehash", + "usr/sbin/update-ca-certificates", + "usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", + "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", + "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", + "usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", + "usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", + "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", + "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", + "usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", + "usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", + "usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", + "usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", + "usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", + "usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", + "usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", + "usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", + "usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", + "usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", + "usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", + "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", + "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", + "usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", + "usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", + "usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", + "usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", + "usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/Izenpe.com.crt", + "usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", + "usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", + "usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", + "usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", + "usr/share/ca-certificates/mozilla/OISTE_Server_Root_ECC_G1.crt", + "usr/share/ca-certificates/mozilla/OISTE_Server_Root_RSA_G1.crt", + "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", + "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", + "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", + "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", + "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", + "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", + "usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", + "usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", + "usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", + "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", + "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", + "usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", + "usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", + "usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", + "usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", + "usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt", + "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", + "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", + "usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", + "usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", + "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", + "usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", + "usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", + "usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", + "usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", + "usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", + "usr/share/ca-certificates/mozilla/e-Szigno_TLS_Root_CA_2023.crt", + "usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", + "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", + "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", + "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", + "usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", + "usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ca-certificates-bundle@20260611-r0", + "Name": "ca-certificates-bundle", + "Identifier": { + "PURL": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "20337c2ea28bef28" + }, + "Version": "20260611-r0", + "Arch": "x86_64", + "SrcName": "ca-certificates", + "SrcVersion": "20260611-r0", + "Licenses": [ + "MPL-2.0", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c9534a03750bdfae341f10969016090fc11febbd", + "InstalledFiles": [ + "etc/ssl/cert.pem", + "etc/ssl/certs/ca-certificates.crt", + "etc/ssl1.1/cert.pem", + "etc/ssl1.1/certs" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "gdbm@1.26-r0", + "Name": "gdbm", + "Identifier": { + "PURL": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "5eb1a3f86262ca77" + }, + "Version": "1.26-r0", + "Arch": "x86_64", + "SrcName": "gdbm", + "SrcVersion": "1.26-r0", + "Licenses": [ + "GPL-3.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:619493d8124fe49a8ee1d8f7a1372cf7e3977337", + "InstalledFiles": [ + "usr/lib/libgdbm.so.6", + "usr/lib/libgdbm.so.6.0.0", + "usr/lib/libgdbm_compat.so.4", + "usr/lib/libgdbm_compat.so.4.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "keyutils-libs@1.6.3-r4", + "Name": "keyutils-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64\u0026distro=3.24.1", + "UID": "a1a29120eb342032" + }, + "Version": "1.6.3-r4", + "Arch": "x86_64", + "SrcName": "keyutils", + "SrcVersion": "1.6.3-r4", + "Licenses": [ + "GPL-2.0-or-later", + "LGPL-2.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:b7331c96f077fc3522ee4361a441d1097204cd90", + "InstalledFiles": [ + "usr/lib/libkeyutils.so.1", + "usr/lib/libkeyutils.so.1.10" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "krb5-conf@1.0-r2", + "Name": "krb5-conf", + "Identifier": { + "PURL": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "e7cf94ba8b6dbc33" + }, + "Version": "1.0-r2", + "Arch": "x86_64", + "SrcName": "krb5-conf", + "SrcVersion": "1.0-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:40a11e0690a59e110367b62a80661024e9942a2d", + "InstalledFiles": [ + "etc/krb5.conf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "krb5-libs@1.22.2-r1", + "Name": "krb5-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "958f8b4a4f087dac" + }, + "Version": "1.22.2-r1", + "Arch": "x86_64", + "SrcName": "krb5", + "SrcVersion": "1.22.2-r1", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "keyutils-libs@1.6.3-r4", + "krb5-conf@1.0-r2", + "libcom_err@1.47.4-r0", + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "libverto@0.3.2-r2", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:ef02346e21b817ff379e4601e5b1fc9760e5e31a", + "InstalledFiles": [ + "usr/lib/libgssapi_krb5.so.2", + "usr/lib/libgssapi_krb5.so.2.2", + "usr/lib/libgssrpc.so.4", + "usr/lib/libgssrpc.so.4.2", + "usr/lib/libk5crypto.so.3", + "usr/lib/libk5crypto.so.3.1", + "usr/lib/libkadm5clnt_mit.so.12", + "usr/lib/libkadm5clnt_mit.so.12.0", + "usr/lib/libkadm5srv_mit.so.12", + "usr/lib/libkadm5srv_mit.so.12.0", + "usr/lib/libkdb5.so.10", + "usr/lib/libkdb5.so.10.0", + "usr/lib/libkrad.so.0", + "usr/lib/libkrad.so.0.0", + "usr/lib/libkrb5.so.3", + "usr/lib/libkrb5.so.3.3", + "usr/lib/libkrb5support.so.0", + "usr/lib/libkrb5support.so.0.1", + "usr/lib/krb5/plugins/kdb/db2.so", + "usr/lib/krb5/plugins/preauth/otp.so", + "usr/lib/krb5/plugins/preauth/spake.so", + "usr/lib/krb5/plugins/preauth/test.so", + "usr/lib/krb5/plugins/tls/k5tls.so" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libapk@3.0.6-r0", + "Name": "libapk", + "Identifier": { + "PURL": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "a35b8b9b3219513a" + }, + "Version": "3.0.6-r0", + "Arch": "x86_64", + "SrcName": "apk-tools", + "SrcVersion": "3.0.6-r0", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "musl@1.2.6-r2", + "zlib@1.3.2-r0" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:523a8f58104589f74f743d501c81bf6517155378", + "InstalledFiles": [ + "usr/lib/libapk.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libbz2@1.0.8-r6", + "Name": "libbz2", + "Identifier": { + "PURL": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64\u0026distro=3.24.1", + "UID": "48e17539404e2d56" + }, + "Version": "1.0.8-r6", + "Arch": "x86_64", + "SrcName": "bzip2", + "SrcVersion": "1.0.8-r6", + "Licenses": [ + "bzip-2-1.0.6" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:08566ba5c7af97c25474be8b24e8b48f0116b67d", + "InstalledFiles": [ + "usr/lib/libbz2.so.1", + "usr/lib/libbz2.so.1.0.8" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libcom_err@1.47.4-r0", + "Name": "libcom_err", + "Identifier": { + "PURL": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "3fc35a3f66d192af" + }, + "Version": "1.47.4-r0", + "Arch": "x86_64", + "SrcName": "e2fsprogs", + "SrcVersion": "1.47.4-r0", + "Licenses": [ + "GPL-2.0-or-later", + "LGPL-2.0-or-later", + "BSD-3-Clause", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:4b9fb5899ea0b1c0cfbb2a2c5952704437d4ecef", + "InstalledFiles": [ + "usr/lib/libcom_err.so.2", + "usr/lib/libcom_err.so.2.1" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libcrypto3@3.5.8-r0", + "Name": "libcrypto3", + "Identifier": { + "PURL": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "4299bba2ba9c96aa" + }, + "Version": "3.5.8-r0", + "Arch": "x86_64", + "SrcName": "openssl", + "SrcVersion": "3.5.8-r0", + "Licenses": [ + "Apache-2.0" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:1b3b9fc0c136f4936932bcb2ec21499f0ae5dfd3", + "InstalledFiles": [ + "etc/ssl/ct_log_list.cnf", + "etc/ssl/ct_log_list.cnf.dist", + "etc/ssl/openssl.cnf", + "etc/ssl/openssl.cnf.dist", + "usr/lib/libcrypto.so.3", + "usr/lib/engines-3/afalg.so", + "usr/lib/engines-3/capi.so", + "usr/lib/engines-3/loader_attic.so", + "usr/lib/engines-3/padlock.so", + "usr/lib/ossl-modules/legacy.so" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libffi@3.5.2-r1", + "Name": "libffi", + "Identifier": { + "PURL": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "d3eaa921287b1ccd" + }, + "Version": "3.5.2-r1", + "Arch": "x86_64", + "SrcName": "libffi", + "SrcVersion": "3.5.2-r1", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:2f7b261f7fcecc4eebd8b330e7f6fb80713bfe3a", + "InstalledFiles": [ + "usr/lib/libffi.so.8", + "usr/lib/libffi.so.8.2.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libintl@1.0-r0", + "Name": "libintl", + "Identifier": { + "PURL": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "25c18808d8fc87e0" + }, + "Version": "1.0-r0", + "Arch": "x86_64", + "SrcName": "gettext", + "SrcVersion": "1.0-r0", + "Licenses": [ + "LGPL-2.1-or-later" + ], + "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:282d6642ccac87237e43a864159d73cf5abe7550", + "InstalledFiles": [ + "usr/lib/libintl.so.8", + "usr/lib/libintl.so.8.4.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libncursesw@6.6_p20260516-r0", + "Name": "libncursesw", + "Identifier": { + "PURL": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e8939f45e2191bcc" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "DependsOn": [ + "musl@1.2.6-r2", + "ncurses-terminfo-base@6.6_p20260516-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:9f318e6e324d6827274829194cf6ac6afbaded12", + "InstalledFiles": [ + "usr/lib/libncursesw.so.6", + "usr/lib/libncursesw.so.6.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libnsl@2.0.1-r2", + "Name": "libnsl", + "Identifier": { + "PURL": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "3d893c60d41da67b" + }, + "Version": "2.0.1-r2", + "Arch": "x86_64", + "SrcName": "libnsl", + "SrcVersion": "2.0.1-r2", + "Licenses": [ + "LGPL-2.0-or-later" + ], + "DependsOn": [ + "libintl@1.0-r0", + "libtirpc@1.3.5-r1", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:5194adbf26560b52be318481a7af294ab05fd795", + "InstalledFiles": [ + "usr/lib/libnsl.so.3", + "usr/lib/libnsl.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libpanelw@6.6_p20260516-r0", + "Name": "libpanelw", + "Identifier": { + "PURL": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "ef1ad9bb256b373" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "DependsOn": [ + "libncursesw@6.6_p20260516-r0", + "musl@1.2.6-r2", + "ncurses-terminfo-base@6.6_p20260516-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:149bdc434232ed11fc5bb975ba519a07154a6f56", + "InstalledFiles": [ + "usr/lib/libpanelw.so.6", + "usr/lib/libpanelw.so.6.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libssl3@3.5.8-r0", + "Name": "libssl3", + "Identifier": { + "PURL": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "f290ab59b88b1c4a" + }, + "Version": "3.5.8-r0", + "Arch": "x86_64", + "SrcName": "openssl", + "SrcVersion": "3.5.8-r0", + "Licenses": [ + "Apache-2.0" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:5f9b1e55d821953d2e2b1db322dad70a3b5041ea", + "InstalledFiles": [ + "usr/lib/libssl.so.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libtirpc@1.3.5-r1", + "Name": "libtirpc", + "Identifier": { + "PURL": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "471c8d955ca03be5" + }, + "Version": "1.3.5-r1", + "Arch": "x86_64", + "SrcName": "libtirpc", + "SrcVersion": "1.3.5-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "krb5-libs@1.22.2-r1", + "libtirpc-conf@1.3.5-r1", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:c32865bd86a8b8829d152279cabbc5ac6d430eb2", + "InstalledFiles": [ + "usr/lib/libtirpc.so.3", + "usr/lib/libtirpc.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libtirpc-conf@1.3.5-r1", + "Name": "libtirpc-conf", + "Identifier": { + "PURL": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "3437392c14aad33f" + }, + "Version": "1.3.5-r1", + "Arch": "x86_64", + "SrcName": "libtirpc", + "SrcVersion": "1.3.5-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:0c17d9988dc986c90e22f79778df047eca9973ff", + "InstalledFiles": [ + "etc/bindresvport.blacklist", + "etc/netconfig" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libuuid@2.42.3-r1", + "Name": "libuuid", + "Identifier": { + "PURL": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "c444e9cdd1bdda40" + }, + "Version": "2.42.3-r1", + "Arch": "x86_64", + "SrcName": "util-linux", + "SrcVersion": "2.42.3-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86", + "DiffID": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + "Digest": "sha1:8f041ef637ad75f381cc0c034f2afbbb0303264e", + "InstalledFiles": [ + "usr/lib/libuuid.so.1", + "usr/lib/libuuid.so.1.3.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libverto@0.3.2-r2", + "Name": "libverto", + "Identifier": { + "PURL": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "9df4321a283a6cf6" + }, + "Version": "0.3.2-r2", + "Arch": "x86_64", + "SrcName": "libverto", + "SrcVersion": "0.3.2-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:73233059338142e4ac6d8fb8bb0074e93da75dc1", + "InstalledFiles": [ + "usr/lib/libverto.so.1", + "usr/lib/libverto.so.1.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "musl@1.2.6-r2", + "Name": "musl", + "Identifier": { + "PURL": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "1f8cb44befe503d4" + }, + "Version": "1.2.6-r2", + "Arch": "x86_64", + "SrcName": "musl", + "SrcVersion": "1.2.6-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:0f7e5827e4e1a73631beda27b78431a8ba240e05", + "InstalledFiles": [ + "lib/ld-musl-x86_64.so.1", + "lib/libc.musl-x86_64.so.1" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "musl-utils@1.2.6-r2", + "Name": "musl-utils", + "Identifier": { + "PURL": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "4497482ec1d943e1" + }, + "Version": "1.2.6-r2", + "Arch": "x86_64", + "SrcName": "musl", + "SrcVersion": "1.2.6-r2", + "Licenses": [ + "MIT", + "BSD-2-Clause", + "GPL-2.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2", + "scanelf@1.3.9-r1" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:75ada3c48d63ec5d87c42fdf934a3fdd11298dc5", + "InstalledFiles": [ + "sbin/ldconfig", + "usr/bin/getconf", + "usr/bin/getent", + "usr/bin/iconv", + "usr/bin/ldd" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ncurses-terminfo-base@6.6_p20260516-r0", + "Name": "ncurses-terminfo-base", + "Identifier": { + "PURL": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e7fac5c6a6e9ae8" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:9d551d828e9c8ee52c5801c1d6046828ebf15752", + "InstalledFiles": [ + "etc/terminfo/a/alacritty", + "etc/terminfo/a/ansi", + "etc/terminfo/d/dumb", + "etc/terminfo/g/gnome", + "etc/terminfo/g/gnome-256color", + "etc/terminfo/k/konsole", + "etc/terminfo/k/konsole-256color", + "etc/terminfo/k/konsole-linux", + "etc/terminfo/l/linux", + "etc/terminfo/p/putty", + "etc/terminfo/p/putty-256color", + "etc/terminfo/r/rxvt", + "etc/terminfo/r/rxvt-256color", + "etc/terminfo/s/screen", + "etc/terminfo/s/screen-256color", + "etc/terminfo/s/st-0.6", + "etc/terminfo/s/st-0.7", + "etc/terminfo/s/st-0.8", + "etc/terminfo/s/st-0.8.5", + "etc/terminfo/s/st-16color", + "etc/terminfo/s/st-256color", + "etc/terminfo/s/st-direct", + "etc/terminfo/s/sun", + "etc/terminfo/t/terminator", + "etc/terminfo/t/terminology", + "etc/terminfo/t/terminology-0.6.1", + "etc/terminfo/t/terminology-1.0.0", + "etc/terminfo/t/terminology-1.8.1", + "etc/terminfo/t/tmux", + "etc/terminfo/t/tmux-256color", + "etc/terminfo/v/vt100", + "etc/terminfo/v/vt102", + "etc/terminfo/v/vt200", + "etc/terminfo/v/vt220", + "etc/terminfo/v/vt52", + "etc/terminfo/v/vte", + "etc/terminfo/v/vte-256color", + "etc/terminfo/x/xterm", + "etc/terminfo/x/xterm-256color", + "etc/terminfo/x/xterm-color", + "etc/terminfo/x/xterm-xfree86" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "readline@8.3.3-r1", + "Name": "readline", + "Identifier": { + "PURL": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "f50058781c93e1f2" + }, + "Version": "8.3.3-r1", + "Arch": "x86_64", + "SrcName": "readline", + "SrcVersion": "8.3.3-r1", + "Licenses": [ + "GPL-3.0-or-later" + ], + "Maintainer": "qaqland \u003cqaq@qaq.land\u003e", + "DependsOn": [ + "libncursesw@6.6_p20260516-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:945b16e378bc00e44d89d4de8124bba7647fdf4d", + "InstalledFiles": [ + "etc/inputrc", + "usr/lib/libreadline.so.8", + "usr/lib/libreadline.so.8.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "scanelf@1.3.9-r1", + "Name": "scanelf", + "Identifier": { + "PURL": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "936394657a1626fb" + }, + "Version": "1.3.9-r1", + "Arch": "x86_64", + "SrcName": "pax-utils", + "SrcVersion": "1.3.9-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:013f903d0ba219673aebbdd04f74bb5ed82b01f0", + "InstalledFiles": [ + "usr/bin/scanelf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "sqlite-libs@3.53.4-r0", + "Name": "sqlite-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "8b10aee2ccc192de" + }, + "Version": "3.53.4-r0", + "Arch": "x86_64", + "SrcName": "sqlite", + "SrcVersion": "3.53.4-r0", + "Licenses": [ + "blessing" + ], + "Maintainer": "Jingyun Hua \u003chuajingyun@loongson.cn\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:f7630ceb37c232b6609861aeab6cdb9cd120e6fa", + "InstalledFiles": [ + "usr/lib/libsqlite3.so.0", + "usr/lib/libsqlite3.so.3.53.4" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ssl_client@1.37.0-r31", + "Name": "ssl_client", + "Identifier": { + "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "d42e31f15a4ce47a" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c220f4a5125a313af733e98def94132bb1e9d40d", + "InstalledFiles": [ + "usr/bin/ssl_client" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "tzdata@2026c-r0", + "Name": "tzdata", + "Identifier": { + "PURL": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "52c6b50eff629f9d" + }, + "Version": "2026c-r0", + "Arch": "x86_64", + "SrcName": "tzdata", + "SrcVersion": "2026c-r0", + "Licenses": [ + "Public-Domain" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + "Digest": "sha1:61f7544ecd8dd63eac23fe3e645702fda92ef02a", + "InstalledFiles": [ + "usr/share/zoneinfo/CET", + "usr/share/zoneinfo/CST6CDT", + "usr/share/zoneinfo/Cuba", + "usr/share/zoneinfo/EET", + "usr/share/zoneinfo/EST", + "usr/share/zoneinfo/EST5EDT", + "usr/share/zoneinfo/Egypt", + "usr/share/zoneinfo/Eire", + "usr/share/zoneinfo/Factory", + "usr/share/zoneinfo/GB", + "usr/share/zoneinfo/GB-Eire", + "usr/share/zoneinfo/GMT", + "usr/share/zoneinfo/GMT+0", + "usr/share/zoneinfo/GMT-0", + "usr/share/zoneinfo/GMT0", + "usr/share/zoneinfo/Greenwich", + "usr/share/zoneinfo/HST", + "usr/share/zoneinfo/Hongkong", + "usr/share/zoneinfo/Iceland", + "usr/share/zoneinfo/Iran", + "usr/share/zoneinfo/Israel", + "usr/share/zoneinfo/Jamaica", + "usr/share/zoneinfo/Japan", + "usr/share/zoneinfo/Kwajalein", + "usr/share/zoneinfo/Libya", + "usr/share/zoneinfo/MET", + "usr/share/zoneinfo/MST", + "usr/share/zoneinfo/MST7MDT", + "usr/share/zoneinfo/NZ", + "usr/share/zoneinfo/NZ-CHAT", + "usr/share/zoneinfo/Navajo", + "usr/share/zoneinfo/PRC", + "usr/share/zoneinfo/PST8PDT", + "usr/share/zoneinfo/Poland", + "usr/share/zoneinfo/Portugal", + "usr/share/zoneinfo/ROC", + "usr/share/zoneinfo/ROK", + "usr/share/zoneinfo/Singapore", + "usr/share/zoneinfo/Turkey", + "usr/share/zoneinfo/UCT", + "usr/share/zoneinfo/UTC", + "usr/share/zoneinfo/Universal", + "usr/share/zoneinfo/W-SU", + "usr/share/zoneinfo/WET", + "usr/share/zoneinfo/Zulu", + "usr/share/zoneinfo/iso3166.tab", + "usr/share/zoneinfo/leap-seconds.list", + "usr/share/zoneinfo/posixrules", + "usr/share/zoneinfo/zone.tab", + "usr/share/zoneinfo/zone1970.tab", + "usr/share/zoneinfo/Africa/Abidjan", + "usr/share/zoneinfo/Africa/Accra", + "usr/share/zoneinfo/Africa/Addis_Ababa", + "usr/share/zoneinfo/Africa/Algiers", + "usr/share/zoneinfo/Africa/Asmara", + "usr/share/zoneinfo/Africa/Asmera", + "usr/share/zoneinfo/Africa/Bamako", + "usr/share/zoneinfo/Africa/Bangui", + "usr/share/zoneinfo/Africa/Banjul", + "usr/share/zoneinfo/Africa/Bissau", + "usr/share/zoneinfo/Africa/Blantyre", + "usr/share/zoneinfo/Africa/Brazzaville", + "usr/share/zoneinfo/Africa/Bujumbura", + "usr/share/zoneinfo/Africa/Cairo", + "usr/share/zoneinfo/Africa/Casablanca", + "usr/share/zoneinfo/Africa/Ceuta", + "usr/share/zoneinfo/Africa/Conakry", + "usr/share/zoneinfo/Africa/Dakar", + "usr/share/zoneinfo/Africa/Dar_es_Salaam", + "usr/share/zoneinfo/Africa/Djibouti", + "usr/share/zoneinfo/Africa/Douala", + "usr/share/zoneinfo/Africa/El_Aaiun", + "usr/share/zoneinfo/Africa/Freetown", + "usr/share/zoneinfo/Africa/Gaborone", + "usr/share/zoneinfo/Africa/Harare", + "usr/share/zoneinfo/Africa/Johannesburg", + "usr/share/zoneinfo/Africa/Juba", + "usr/share/zoneinfo/Africa/Kampala", + "usr/share/zoneinfo/Africa/Khartoum", + "usr/share/zoneinfo/Africa/Kigali", + "usr/share/zoneinfo/Africa/Kinshasa", + "usr/share/zoneinfo/Africa/Lagos", + "usr/share/zoneinfo/Africa/Libreville", + "usr/share/zoneinfo/Africa/Lome", + "usr/share/zoneinfo/Africa/Luanda", + "usr/share/zoneinfo/Africa/Lubumbashi", + "usr/share/zoneinfo/Africa/Lusaka", + "usr/share/zoneinfo/Africa/Malabo", + "usr/share/zoneinfo/Africa/Maputo", + "usr/share/zoneinfo/Africa/Maseru", + "usr/share/zoneinfo/Africa/Mbabane", + "usr/share/zoneinfo/Africa/Mogadishu", + "usr/share/zoneinfo/Africa/Monrovia", + "usr/share/zoneinfo/Africa/Nairobi", + "usr/share/zoneinfo/Africa/Ndjamena", + "usr/share/zoneinfo/Africa/Niamey", + "usr/share/zoneinfo/Africa/Nouakchott", + "usr/share/zoneinfo/Africa/Ouagadougou", + "usr/share/zoneinfo/Africa/Porto-Novo", + "usr/share/zoneinfo/Africa/Sao_Tome", + "usr/share/zoneinfo/Africa/Timbuktu", + "usr/share/zoneinfo/Africa/Tripoli", + "usr/share/zoneinfo/Africa/Tunis", + "usr/share/zoneinfo/Africa/Windhoek", + "usr/share/zoneinfo/America/Adak", + "usr/share/zoneinfo/America/Anchorage", + "usr/share/zoneinfo/America/Anguilla", + "usr/share/zoneinfo/America/Antigua", + "usr/share/zoneinfo/America/Araguaina", + "usr/share/zoneinfo/America/Aruba", + "usr/share/zoneinfo/America/Asuncion", + "usr/share/zoneinfo/America/Atikokan", + "usr/share/zoneinfo/America/Atka", + "usr/share/zoneinfo/America/Bahia", + "usr/share/zoneinfo/America/Bahia_Banderas", + "usr/share/zoneinfo/America/Barbados", + "usr/share/zoneinfo/America/Belem", + "usr/share/zoneinfo/America/Belize", + "usr/share/zoneinfo/America/Blanc-Sablon", + "usr/share/zoneinfo/America/Boa_Vista", + "usr/share/zoneinfo/America/Bogota", + "usr/share/zoneinfo/America/Boise", + "usr/share/zoneinfo/America/Buenos_Aires", + "usr/share/zoneinfo/America/Cambridge_Bay", + "usr/share/zoneinfo/America/Campo_Grande", + "usr/share/zoneinfo/America/Cancun", + "usr/share/zoneinfo/America/Caracas", + "usr/share/zoneinfo/America/Catamarca", + "usr/share/zoneinfo/America/Cayenne", + "usr/share/zoneinfo/America/Cayman", + "usr/share/zoneinfo/America/Chicago", + "usr/share/zoneinfo/America/Chihuahua", + "usr/share/zoneinfo/America/Ciudad_Juarez", + "usr/share/zoneinfo/America/Coral_Harbour", + "usr/share/zoneinfo/America/Cordoba", + "usr/share/zoneinfo/America/Costa_Rica", + "usr/share/zoneinfo/America/Coyhaique", + "usr/share/zoneinfo/America/Creston", + "usr/share/zoneinfo/America/Cuiaba", + "usr/share/zoneinfo/America/Curacao", + "usr/share/zoneinfo/America/Danmarkshavn", + "usr/share/zoneinfo/America/Dawson", + "usr/share/zoneinfo/America/Dawson_Creek", + "usr/share/zoneinfo/America/Denver", + "usr/share/zoneinfo/America/Detroit", + "usr/share/zoneinfo/America/Dominica", + "usr/share/zoneinfo/America/Edmonton", + "usr/share/zoneinfo/America/Eirunepe", + "usr/share/zoneinfo/America/El_Salvador", + "usr/share/zoneinfo/America/Ensenada", + "usr/share/zoneinfo/America/Fort_Nelson", + "usr/share/zoneinfo/America/Fort_Wayne", + "usr/share/zoneinfo/America/Fortaleza", + "usr/share/zoneinfo/America/Glace_Bay", + "usr/share/zoneinfo/America/Godthab", + "usr/share/zoneinfo/America/Goose_Bay", + "usr/share/zoneinfo/America/Grand_Turk", + "usr/share/zoneinfo/America/Grenada", + "usr/share/zoneinfo/America/Guadeloupe", + "usr/share/zoneinfo/America/Guatemala", + "usr/share/zoneinfo/America/Guayaquil", + "usr/share/zoneinfo/America/Guyana", + "usr/share/zoneinfo/America/Halifax", + "usr/share/zoneinfo/America/Havana", + "usr/share/zoneinfo/America/Hermosillo", + "usr/share/zoneinfo/America/Indianapolis", + "usr/share/zoneinfo/America/Inuvik", + "usr/share/zoneinfo/America/Iqaluit", + "usr/share/zoneinfo/America/Jamaica", + "usr/share/zoneinfo/America/Jujuy", + "usr/share/zoneinfo/America/Juneau", + "usr/share/zoneinfo/America/Knox_IN", + "usr/share/zoneinfo/America/Kralendijk", + "usr/share/zoneinfo/America/La_Paz", + "usr/share/zoneinfo/America/Lima", + "usr/share/zoneinfo/America/Los_Angeles", + "usr/share/zoneinfo/America/Louisville", + "usr/share/zoneinfo/America/Lower_Princes", + "usr/share/zoneinfo/America/Maceio", + "usr/share/zoneinfo/America/Managua", + "usr/share/zoneinfo/America/Manaus", + "usr/share/zoneinfo/America/Marigot", + "usr/share/zoneinfo/America/Martinique", + "usr/share/zoneinfo/America/Matamoros", + "usr/share/zoneinfo/America/Mazatlan", + "usr/share/zoneinfo/America/Mendoza", + "usr/share/zoneinfo/America/Menominee", + "usr/share/zoneinfo/America/Merida", + "usr/share/zoneinfo/America/Metlakatla", + "usr/share/zoneinfo/America/Mexico_City", + "usr/share/zoneinfo/America/Miquelon", + "usr/share/zoneinfo/America/Moncton", + "usr/share/zoneinfo/America/Monterrey", + "usr/share/zoneinfo/America/Montevideo", + "usr/share/zoneinfo/America/Montreal", + "usr/share/zoneinfo/America/Montserrat", + "usr/share/zoneinfo/America/Nassau", + "usr/share/zoneinfo/America/New_York", + "usr/share/zoneinfo/America/Nipigon", + "usr/share/zoneinfo/America/Nome", + "usr/share/zoneinfo/America/Noronha", + "usr/share/zoneinfo/America/Nuuk", + "usr/share/zoneinfo/America/Ojinaga", + "usr/share/zoneinfo/America/Panama", + "usr/share/zoneinfo/America/Pangnirtung", + "usr/share/zoneinfo/America/Paramaribo", + "usr/share/zoneinfo/America/Phoenix", + "usr/share/zoneinfo/America/Port-au-Prince", + "usr/share/zoneinfo/America/Port_of_Spain", + "usr/share/zoneinfo/America/Porto_Acre", + "usr/share/zoneinfo/America/Porto_Velho", + "usr/share/zoneinfo/America/Puerto_Rico", + "usr/share/zoneinfo/America/Punta_Arenas", + "usr/share/zoneinfo/America/Rainy_River", + "usr/share/zoneinfo/America/Rankin_Inlet", + "usr/share/zoneinfo/America/Recife", + "usr/share/zoneinfo/America/Regina", + "usr/share/zoneinfo/America/Resolute", + "usr/share/zoneinfo/America/Rio_Branco", + "usr/share/zoneinfo/America/Rosario", + "usr/share/zoneinfo/America/Santa_Isabel", + "usr/share/zoneinfo/America/Santarem", + "usr/share/zoneinfo/America/Santiago", + "usr/share/zoneinfo/America/Santo_Domingo", + "usr/share/zoneinfo/America/Sao_Paulo", + "usr/share/zoneinfo/America/Scoresbysund", + "usr/share/zoneinfo/America/Shiprock", + "usr/share/zoneinfo/America/Sitka", + "usr/share/zoneinfo/America/St_Barthelemy", + "usr/share/zoneinfo/America/St_Johns", + "usr/share/zoneinfo/America/St_Kitts", + "usr/share/zoneinfo/America/St_Lucia", + "usr/share/zoneinfo/America/St_Thomas", + "usr/share/zoneinfo/America/St_Vincent", + "usr/share/zoneinfo/America/Swift_Current", + "usr/share/zoneinfo/America/Tegucigalpa", + "usr/share/zoneinfo/America/Thule", + "usr/share/zoneinfo/America/Thunder_Bay", + "usr/share/zoneinfo/America/Tijuana", + "usr/share/zoneinfo/America/Toronto", + "usr/share/zoneinfo/America/Tortola", + "usr/share/zoneinfo/America/Vancouver", + "usr/share/zoneinfo/America/Virgin", + "usr/share/zoneinfo/America/Whitehorse", + "usr/share/zoneinfo/America/Winnipeg", + "usr/share/zoneinfo/America/Yakutat", + "usr/share/zoneinfo/America/Yellowknife", + "usr/share/zoneinfo/America/Argentina/Buenos_Aires", + "usr/share/zoneinfo/America/Argentina/Catamarca", + "usr/share/zoneinfo/America/Argentina/ComodRivadavia", + "usr/share/zoneinfo/America/Argentina/Cordoba", + "usr/share/zoneinfo/America/Argentina/Jujuy", + "usr/share/zoneinfo/America/Argentina/La_Rioja", + "usr/share/zoneinfo/America/Argentina/Mendoza", + "usr/share/zoneinfo/America/Argentina/Rio_Gallegos", + "usr/share/zoneinfo/America/Argentina/Salta", + "usr/share/zoneinfo/America/Argentina/San_Juan", + "usr/share/zoneinfo/America/Argentina/San_Luis", + "usr/share/zoneinfo/America/Argentina/Tucuman", + "usr/share/zoneinfo/America/Argentina/Ushuaia", + "usr/share/zoneinfo/America/Indiana/Indianapolis", + "usr/share/zoneinfo/America/Indiana/Knox", + "usr/share/zoneinfo/America/Indiana/Marengo", + "usr/share/zoneinfo/America/Indiana/Petersburg", + "usr/share/zoneinfo/America/Indiana/Tell_City", + "usr/share/zoneinfo/America/Indiana/Vevay", + "usr/share/zoneinfo/America/Indiana/Vincennes", + "usr/share/zoneinfo/America/Indiana/Winamac", + "usr/share/zoneinfo/America/Kentucky/Louisville", + "usr/share/zoneinfo/America/Kentucky/Monticello", + "usr/share/zoneinfo/America/North_Dakota/Beulah", + "usr/share/zoneinfo/America/North_Dakota/Center", + "usr/share/zoneinfo/America/North_Dakota/New_Salem", + "usr/share/zoneinfo/Antarctica/Casey", + "usr/share/zoneinfo/Antarctica/Davis", + "usr/share/zoneinfo/Antarctica/DumontDUrville", + "usr/share/zoneinfo/Antarctica/Macquarie", + "usr/share/zoneinfo/Antarctica/Mawson", + "usr/share/zoneinfo/Antarctica/McMurdo", + "usr/share/zoneinfo/Antarctica/Palmer", + "usr/share/zoneinfo/Antarctica/Rothera", + "usr/share/zoneinfo/Antarctica/South_Pole", + "usr/share/zoneinfo/Antarctica/Syowa", + "usr/share/zoneinfo/Antarctica/Troll", + "usr/share/zoneinfo/Antarctica/Vostok", + "usr/share/zoneinfo/Arctic/Longyearbyen", + "usr/share/zoneinfo/Asia/Aden", + "usr/share/zoneinfo/Asia/Almaty", + "usr/share/zoneinfo/Asia/Amman", + "usr/share/zoneinfo/Asia/Anadyr", + "usr/share/zoneinfo/Asia/Aqtau", + "usr/share/zoneinfo/Asia/Aqtobe", + "usr/share/zoneinfo/Asia/Ashgabat", + "usr/share/zoneinfo/Asia/Ashkhabad", + "usr/share/zoneinfo/Asia/Atyrau", + "usr/share/zoneinfo/Asia/Baghdad", + "usr/share/zoneinfo/Asia/Bahrain", + "usr/share/zoneinfo/Asia/Baku", + "usr/share/zoneinfo/Asia/Bangkok", + "usr/share/zoneinfo/Asia/Barnaul", + "usr/share/zoneinfo/Asia/Beirut", + "usr/share/zoneinfo/Asia/Bishkek", + "usr/share/zoneinfo/Asia/Brunei", + "usr/share/zoneinfo/Asia/Calcutta", + "usr/share/zoneinfo/Asia/Chita", + "usr/share/zoneinfo/Asia/Choibalsan", + "usr/share/zoneinfo/Asia/Chongqing", + "usr/share/zoneinfo/Asia/Chungking", + "usr/share/zoneinfo/Asia/Colombo", + "usr/share/zoneinfo/Asia/Dacca", + "usr/share/zoneinfo/Asia/Damascus", + "usr/share/zoneinfo/Asia/Dhaka", + "usr/share/zoneinfo/Asia/Dili", + "usr/share/zoneinfo/Asia/Dubai", + "usr/share/zoneinfo/Asia/Dushanbe", + "usr/share/zoneinfo/Asia/Famagusta", + "usr/share/zoneinfo/Asia/Gaza", + "usr/share/zoneinfo/Asia/Harbin", + "usr/share/zoneinfo/Asia/Hebron", + "usr/share/zoneinfo/Asia/Ho_Chi_Minh", + "usr/share/zoneinfo/Asia/Hong_Kong", + "usr/share/zoneinfo/Asia/Hovd", + "usr/share/zoneinfo/Asia/Irkutsk", + "usr/share/zoneinfo/Asia/Istanbul", + "usr/share/zoneinfo/Asia/Jakarta", + "usr/share/zoneinfo/Asia/Jayapura", + "usr/share/zoneinfo/Asia/Jerusalem", + "usr/share/zoneinfo/Asia/Kabul", + "usr/share/zoneinfo/Asia/Kamchatka", + "usr/share/zoneinfo/Asia/Karachi", + "usr/share/zoneinfo/Asia/Kashgar", + "usr/share/zoneinfo/Asia/Kathmandu", + "usr/share/zoneinfo/Asia/Katmandu", + "usr/share/zoneinfo/Asia/Khandyga", + "usr/share/zoneinfo/Asia/Kolkata", + "usr/share/zoneinfo/Asia/Krasnoyarsk", + "usr/share/zoneinfo/Asia/Kuala_Lumpur", + "usr/share/zoneinfo/Asia/Kuching", + "usr/share/zoneinfo/Asia/Kuwait", + "usr/share/zoneinfo/Asia/Macao", + "usr/share/zoneinfo/Asia/Macau", + "usr/share/zoneinfo/Asia/Magadan", + "usr/share/zoneinfo/Asia/Makassar", + "usr/share/zoneinfo/Asia/Manila", + "usr/share/zoneinfo/Asia/Muscat", + "usr/share/zoneinfo/Asia/Nicosia", + "usr/share/zoneinfo/Asia/Novokuznetsk", + "usr/share/zoneinfo/Asia/Novosibirsk", + "usr/share/zoneinfo/Asia/Omsk", + "usr/share/zoneinfo/Asia/Oral", + "usr/share/zoneinfo/Asia/Phnom_Penh", + "usr/share/zoneinfo/Asia/Pontianak", + "usr/share/zoneinfo/Asia/Pyongyang", + "usr/share/zoneinfo/Asia/Qatar", + "usr/share/zoneinfo/Asia/Qostanay", + "usr/share/zoneinfo/Asia/Qyzylorda", + "usr/share/zoneinfo/Asia/Rangoon", + "usr/share/zoneinfo/Asia/Riyadh", + "usr/share/zoneinfo/Asia/Saigon", + "usr/share/zoneinfo/Asia/Sakhalin", + "usr/share/zoneinfo/Asia/Samarkand", + "usr/share/zoneinfo/Asia/Seoul", + "usr/share/zoneinfo/Asia/Shanghai", + "usr/share/zoneinfo/Asia/Singapore", + "usr/share/zoneinfo/Asia/Srednekolymsk", + "usr/share/zoneinfo/Asia/Taipei", + "usr/share/zoneinfo/Asia/Tashkent", + "usr/share/zoneinfo/Asia/Tbilisi", + "usr/share/zoneinfo/Asia/Tehran", + "usr/share/zoneinfo/Asia/Tel_Aviv", + "usr/share/zoneinfo/Asia/Thimbu", + "usr/share/zoneinfo/Asia/Thimphu", + "usr/share/zoneinfo/Asia/Tokyo", + "usr/share/zoneinfo/Asia/Tomsk", + "usr/share/zoneinfo/Asia/Ujung_Pandang", + "usr/share/zoneinfo/Asia/Ulaanbaatar", + "usr/share/zoneinfo/Asia/Ulan_Bator", + "usr/share/zoneinfo/Asia/Urumqi", + "usr/share/zoneinfo/Asia/Ust-Nera", + "usr/share/zoneinfo/Asia/Vientiane", + "usr/share/zoneinfo/Asia/Vladivostok", + "usr/share/zoneinfo/Asia/Yakutsk", + "usr/share/zoneinfo/Asia/Yangon", + "usr/share/zoneinfo/Asia/Yekaterinburg", + "usr/share/zoneinfo/Asia/Yerevan", + "usr/share/zoneinfo/Atlantic/Azores", + "usr/share/zoneinfo/Atlantic/Bermuda", + "usr/share/zoneinfo/Atlantic/Canary", + "usr/share/zoneinfo/Atlantic/Cape_Verde", + "usr/share/zoneinfo/Atlantic/Faeroe", + "usr/share/zoneinfo/Atlantic/Faroe", + "usr/share/zoneinfo/Atlantic/Jan_Mayen", + "usr/share/zoneinfo/Atlantic/Madeira", + "usr/share/zoneinfo/Atlantic/Reykjavik", + "usr/share/zoneinfo/Atlantic/South_Georgia", + "usr/share/zoneinfo/Atlantic/St_Helena", + "usr/share/zoneinfo/Atlantic/Stanley", + "usr/share/zoneinfo/Australia/ACT", + "usr/share/zoneinfo/Australia/Adelaide", + "usr/share/zoneinfo/Australia/Brisbane", + "usr/share/zoneinfo/Australia/Broken_Hill", + "usr/share/zoneinfo/Australia/Canberra", + "usr/share/zoneinfo/Australia/Currie", + "usr/share/zoneinfo/Australia/Darwin", + "usr/share/zoneinfo/Australia/Eucla", + "usr/share/zoneinfo/Australia/Hobart", + "usr/share/zoneinfo/Australia/LHI", + "usr/share/zoneinfo/Australia/Lindeman", + "usr/share/zoneinfo/Australia/Lord_Howe", + "usr/share/zoneinfo/Australia/Melbourne", + "usr/share/zoneinfo/Australia/NSW", + "usr/share/zoneinfo/Australia/North", + "usr/share/zoneinfo/Australia/Perth", + "usr/share/zoneinfo/Australia/Queensland", + "usr/share/zoneinfo/Australia/South", + "usr/share/zoneinfo/Australia/Sydney", + "usr/share/zoneinfo/Australia/Tasmania", + "usr/share/zoneinfo/Australia/Victoria", + "usr/share/zoneinfo/Australia/West", + "usr/share/zoneinfo/Australia/Yancowinna", + "usr/share/zoneinfo/Brazil/Acre", + "usr/share/zoneinfo/Brazil/DeNoronha", + "usr/share/zoneinfo/Brazil/East", + "usr/share/zoneinfo/Brazil/West", + "usr/share/zoneinfo/Canada/Atlantic", + "usr/share/zoneinfo/Canada/Central", + "usr/share/zoneinfo/Canada/Eastern", + "usr/share/zoneinfo/Canada/Mountain", + "usr/share/zoneinfo/Canada/Newfoundland", + "usr/share/zoneinfo/Canada/Pacific", + "usr/share/zoneinfo/Canada/Saskatchewan", + "usr/share/zoneinfo/Canada/Yukon", + "usr/share/zoneinfo/Chile/Continental", + "usr/share/zoneinfo/Chile/EasterIsland", + "usr/share/zoneinfo/Etc/GMT", + "usr/share/zoneinfo/Etc/GMT+0", + "usr/share/zoneinfo/Etc/GMT+1", + "usr/share/zoneinfo/Etc/GMT+10", + "usr/share/zoneinfo/Etc/GMT+11", + "usr/share/zoneinfo/Etc/GMT+12", + "usr/share/zoneinfo/Etc/GMT+2", + "usr/share/zoneinfo/Etc/GMT+3", + "usr/share/zoneinfo/Etc/GMT+4", + "usr/share/zoneinfo/Etc/GMT+5", + "usr/share/zoneinfo/Etc/GMT+6", + "usr/share/zoneinfo/Etc/GMT+7", + "usr/share/zoneinfo/Etc/GMT+8", + "usr/share/zoneinfo/Etc/GMT+9", + "usr/share/zoneinfo/Etc/GMT-0", + "usr/share/zoneinfo/Etc/GMT-1", + "usr/share/zoneinfo/Etc/GMT-10", + "usr/share/zoneinfo/Etc/GMT-11", + "usr/share/zoneinfo/Etc/GMT-12", + "usr/share/zoneinfo/Etc/GMT-13", + "usr/share/zoneinfo/Etc/GMT-14", + "usr/share/zoneinfo/Etc/GMT-2", + "usr/share/zoneinfo/Etc/GMT-3", + "usr/share/zoneinfo/Etc/GMT-4", + "usr/share/zoneinfo/Etc/GMT-5", + "usr/share/zoneinfo/Etc/GMT-6", + "usr/share/zoneinfo/Etc/GMT-7", + "usr/share/zoneinfo/Etc/GMT-8", + "usr/share/zoneinfo/Etc/GMT-9", + "usr/share/zoneinfo/Etc/GMT0", + "usr/share/zoneinfo/Etc/Greenwich", + "usr/share/zoneinfo/Etc/UCT", + "usr/share/zoneinfo/Etc/UTC", + "usr/share/zoneinfo/Etc/Universal", + "usr/share/zoneinfo/Etc/Zulu", + "usr/share/zoneinfo/Europe/Amsterdam", + "usr/share/zoneinfo/Europe/Andorra", + "usr/share/zoneinfo/Europe/Astrakhan", + "usr/share/zoneinfo/Europe/Athens", + "usr/share/zoneinfo/Europe/Belfast", + "usr/share/zoneinfo/Europe/Belgrade", + "usr/share/zoneinfo/Europe/Berlin", + "usr/share/zoneinfo/Europe/Bratislava", + "usr/share/zoneinfo/Europe/Brussels", + "usr/share/zoneinfo/Europe/Bucharest", + "usr/share/zoneinfo/Europe/Budapest", + "usr/share/zoneinfo/Europe/Busingen", + "usr/share/zoneinfo/Europe/Chisinau", + "usr/share/zoneinfo/Europe/Copenhagen", + "usr/share/zoneinfo/Europe/Dublin", + "usr/share/zoneinfo/Europe/Gibraltar", + "usr/share/zoneinfo/Europe/Guernsey", + "usr/share/zoneinfo/Europe/Helsinki", + "usr/share/zoneinfo/Europe/Isle_of_Man", + "usr/share/zoneinfo/Europe/Istanbul", + "usr/share/zoneinfo/Europe/Jersey", + "usr/share/zoneinfo/Europe/Kaliningrad", + "usr/share/zoneinfo/Europe/Kiev", + "usr/share/zoneinfo/Europe/Kirov", + "usr/share/zoneinfo/Europe/Kyiv", + "usr/share/zoneinfo/Europe/Lisbon", + "usr/share/zoneinfo/Europe/Ljubljana", + "usr/share/zoneinfo/Europe/London", + "usr/share/zoneinfo/Europe/Luxembourg", + "usr/share/zoneinfo/Europe/Madrid", + "usr/share/zoneinfo/Europe/Malta", + "usr/share/zoneinfo/Europe/Mariehamn", + "usr/share/zoneinfo/Europe/Minsk", + "usr/share/zoneinfo/Europe/Monaco", + "usr/share/zoneinfo/Europe/Moscow", + "usr/share/zoneinfo/Europe/Nicosia", + "usr/share/zoneinfo/Europe/Oslo", + "usr/share/zoneinfo/Europe/Paris", + "usr/share/zoneinfo/Europe/Podgorica", + "usr/share/zoneinfo/Europe/Prague", + "usr/share/zoneinfo/Europe/Riga", + "usr/share/zoneinfo/Europe/Rome", + "usr/share/zoneinfo/Europe/Samara", + "usr/share/zoneinfo/Europe/San_Marino", + "usr/share/zoneinfo/Europe/Sarajevo", + "usr/share/zoneinfo/Europe/Saratov", + "usr/share/zoneinfo/Europe/Simferopol", + "usr/share/zoneinfo/Europe/Skopje", + "usr/share/zoneinfo/Europe/Sofia", + "usr/share/zoneinfo/Europe/Stockholm", + "usr/share/zoneinfo/Europe/Tallinn", + "usr/share/zoneinfo/Europe/Tirane", + "usr/share/zoneinfo/Europe/Tiraspol", + "usr/share/zoneinfo/Europe/Ulyanovsk", + "usr/share/zoneinfo/Europe/Uzhgorod", + "usr/share/zoneinfo/Europe/Vaduz", + "usr/share/zoneinfo/Europe/Vatican", + "usr/share/zoneinfo/Europe/Vienna", + "usr/share/zoneinfo/Europe/Vilnius", + "usr/share/zoneinfo/Europe/Volgograd", + "usr/share/zoneinfo/Europe/Warsaw", + "usr/share/zoneinfo/Europe/Zagreb", + "usr/share/zoneinfo/Europe/Zaporozhye", + "usr/share/zoneinfo/Europe/Zurich", + "usr/share/zoneinfo/Indian/Antananarivo", + "usr/share/zoneinfo/Indian/Chagos", + "usr/share/zoneinfo/Indian/Christmas", + "usr/share/zoneinfo/Indian/Cocos", + "usr/share/zoneinfo/Indian/Comoro", + "usr/share/zoneinfo/Indian/Kerguelen", + "usr/share/zoneinfo/Indian/Mahe", + "usr/share/zoneinfo/Indian/Maldives", + "usr/share/zoneinfo/Indian/Mauritius", + "usr/share/zoneinfo/Indian/Mayotte", + "usr/share/zoneinfo/Indian/Reunion", + "usr/share/zoneinfo/Mexico/BajaNorte", + "usr/share/zoneinfo/Mexico/BajaSur", + "usr/share/zoneinfo/Mexico/General", + "usr/share/zoneinfo/Pacific/Apia", + "usr/share/zoneinfo/Pacific/Auckland", + "usr/share/zoneinfo/Pacific/Bougainville", + "usr/share/zoneinfo/Pacific/Chatham", + "usr/share/zoneinfo/Pacific/Chuuk", + "usr/share/zoneinfo/Pacific/Easter", + "usr/share/zoneinfo/Pacific/Efate", + "usr/share/zoneinfo/Pacific/Enderbury", + "usr/share/zoneinfo/Pacific/Fakaofo", + "usr/share/zoneinfo/Pacific/Fiji", + "usr/share/zoneinfo/Pacific/Funafuti", + "usr/share/zoneinfo/Pacific/Galapagos", + "usr/share/zoneinfo/Pacific/Gambier", + "usr/share/zoneinfo/Pacific/Guadalcanal", + "usr/share/zoneinfo/Pacific/Guam", + "usr/share/zoneinfo/Pacific/Honolulu", + "usr/share/zoneinfo/Pacific/Johnston", + "usr/share/zoneinfo/Pacific/Kanton", + "usr/share/zoneinfo/Pacific/Kiritimati", + "usr/share/zoneinfo/Pacific/Kosrae", + "usr/share/zoneinfo/Pacific/Kwajalein", + "usr/share/zoneinfo/Pacific/Majuro", + "usr/share/zoneinfo/Pacific/Marquesas", + "usr/share/zoneinfo/Pacific/Midway", + "usr/share/zoneinfo/Pacific/Nauru", + "usr/share/zoneinfo/Pacific/Niue", + "usr/share/zoneinfo/Pacific/Norfolk", + "usr/share/zoneinfo/Pacific/Noumea", + "usr/share/zoneinfo/Pacific/Pago_Pago", + "usr/share/zoneinfo/Pacific/Palau", + "usr/share/zoneinfo/Pacific/Pitcairn", + "usr/share/zoneinfo/Pacific/Pohnpei", + "usr/share/zoneinfo/Pacific/Ponape", + "usr/share/zoneinfo/Pacific/Port_Moresby", + "usr/share/zoneinfo/Pacific/Rarotonga", + "usr/share/zoneinfo/Pacific/Saipan", + "usr/share/zoneinfo/Pacific/Samoa", + "usr/share/zoneinfo/Pacific/Tahiti", + "usr/share/zoneinfo/Pacific/Tarawa", + "usr/share/zoneinfo/Pacific/Tongatapu", + "usr/share/zoneinfo/Pacific/Truk", + "usr/share/zoneinfo/Pacific/Wake", + "usr/share/zoneinfo/Pacific/Wallis", + "usr/share/zoneinfo/Pacific/Yap", + "usr/share/zoneinfo/US/Alaska", + "usr/share/zoneinfo/US/Aleutian", + "usr/share/zoneinfo/US/Arizona", + "usr/share/zoneinfo/US/Central", + "usr/share/zoneinfo/US/East-Indiana", + "usr/share/zoneinfo/US/Eastern", + "usr/share/zoneinfo/US/Hawaii", + "usr/share/zoneinfo/US/Indiana-Starke", + "usr/share/zoneinfo/US/Michigan", + "usr/share/zoneinfo/US/Mountain", + "usr/share/zoneinfo/US/Pacific", + "usr/share/zoneinfo/US/Samoa" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "xz-libs@5.8.3-r0", + "Name": "xz-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "1ae658a5f132a091" + }, + "Version": "5.8.3-r0", + "Arch": "x86_64", + "SrcName": "xz", + "SrcVersion": "5.8.3-r0", + "Licenses": [ + "GPL-2.0-or-later", + "0BSD", + "Public-Domain", + "LGPL-2.1-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:4c92c5be0c5bef404e93c880eba9037a9b147347", + "InstalledFiles": [ + "usr/lib/liblzma.so.5", + "usr/lib/liblzma.so.5.8.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "zlib@1.3.2-r0", + "Name": "zlib", + "Identifier": { + "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e37054a2982d6c16" + }, + "Version": "1.3.2-r0", + "Arch": "x86_64", + "SrcName": "zlib", + "SrcVersion": "1.3.2-r0", + "Licenses": [ + "Zlib" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:dd4c3d102acaef2a71a1495951d55fabc8680613", + "InstalledFiles": [ + "usr/lib/libz.so.1", + "usr/lib/libz.so.1.3.2" + ], + "AnalyzedBy": "apk" + } + ] + }, + { + "Target": "Python", + "Class": "lang-pkgs", + "Type": "python-pkg", + "Packages": [ + { + "Name": "PyJWT", + "Identifier": { + "PURL": "pkg:pypi/pyjwt@2.15.1", + "UID": "d3f5f9a421b8abc9" + }, + "Version": "2.15.1", + "Licenses": [ + "MIT" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/pyjwt-2.15.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "cffi", + "Identifier": { + "PURL": "pkg:pypi/cffi@2.1.1", + "UID": "21042e2f37e33c05" + }, + "Version": "2.1.1", + "Licenses": [ + "MIT-0" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "cryptography", + "Identifier": { + "PURL": "pkg:pypi/cryptography@50.0.1", + "UID": "dcb3df6383fe2a60" + }, + "Version": "50.0.1", + "Licenses": [ + "Apache-2.0 OR BSD-3-Clause" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/cryptography-50.0.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "informed-decision", + "Identifier": { + "PURL": "pkg:pypi/informed-decision@0.2.0", + "UID": "7989f2afae8ff568" + }, + "Version": "0.2.0", + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/informed_decision-0.2.0.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "pycparser", + "Identifier": { + "PURL": "pkg:pypi/pycparser@3.0", + "UID": "e5a4d03f15a695ff" + }, + "Version": "3.0", + "Licenses": [ + "BSD-3-Clause" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/pycparser-3.0.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "waitress", + "Identifier": { + "PURL": "pkg:pypi/waitress@3.0.2", + "UID": "806e218e1c1e85f" + }, + "Version": "3.0.2", + "Licenses": [ + "ZPL-2.1" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/waitress-3.0.2.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + } + ] + } + ] +} diff --git a/informed_decision/policy.py b/informed_decision/policy.py index 2a754a9..b1d9232 100644 --- a/informed_decision/policy.py +++ b/informed_decision/policy.py @@ -149,6 +149,12 @@ class PolicyClient: if not isinstance(data.get("id"), str) or not data["id"] or len(data["id"]) > 256: raise ValueError() binding, provenance = data["binding"], data["provenance"] + # FLEX-DEC-2026-019: advisory readback decisions are never act + # authorization. Canonical enforcement purpose is absent (Go + # omitempty) or the exact empty string; malformed values fail closed. + purpose = binding.get("purpose", "") + if type(purpose) is not str or purpose != "": + raise ValueError() if (binding["submitted_request_digest"] != submitted or not DIGEST.fullmatch(binding["request_digest"]) or binding["tenant"] != request["tenant"] or binding["action"] != request["action"] diff --git a/tests/test_lifecycle_policy_component.py b/tests/test_lifecycle_policy_component.py index 6cc5ae0..5605a08 100644 --- a/tests/test_lifecycle_policy_component.py +++ b/tests/test_lifecycle_policy_component.py @@ -54,3 +54,66 @@ def test_initial_audience_collaborates_across_revisions_with_real_pdp(workspace, reopened.retrieve(foreign, memo.id) assert calls and all(c['known'] and c['audiences'] == ['flex-auth'] for c in calls) assert (fixture / 'pin.json').read_bytes() == pins + + +@pytest.mark.parametrize("stale_field", ["version", "package_digest"]) +def test_stale_consumer_pin_fails_closed_until_exact_owner_repin(workspace, tmp_path, signing_key, stale_field): + binary = os.environ.get('INFD_FLEX_AUTH_BINARY') + source = os.environ.get('INFD_FLEX_AUTH_SOURCE') + if not binary or not source: + pytest.skip('set INFD_FLEX_AUTH_BINARY and INFD_FLEX_AUTH_SOURCE for candidate owner policy') + fixture = Path(source) / 'examples/informed-decision-lifecycle' + with flex_component(binary, tmp_path, signing_key, fixture=fixture) as (pdp, calls): + repo, memo = workspace + app = LifecycleService(repo, pdp) + hub = Caller(Attribution('tenant:platform', Actor('system:serviceaccount:state-hub:state-hub', ActorKind.SERVICE)), + time.time() + 600, dumps({'principal_type_source': 'authentication-derived', + 'tenant_source': 'registration-supplied', 'authentication_audience': 'informed-decision-lifecycle', + 'workload_uid': 'synthetic-verified-uid'})) + current = getattr(pdp, stale_field) + setattr(pdp, stale_field, 'v1' if stale_field == 'version' else + 'sha256:cee6a79f74e81d0d389a2c2e2451a92be3434ea9dfcee4986e8c7e6cfdbb1827') + with pytest.raises(LifecycleError) as refused: + app.register(hub, memo, key='repin-proof') + assert refused.value.status == 503 and refused.value.code == 'invalid_decision' + with repo.store._connection() as db: + assert db.execute('SELECT count(*) FROM memos').fetchone()[0] == 0 + assert db.execute('SELECT count(*) FROM lifecycle_events').fetchone()[0] == 0 + setattr(pdp, stale_field, current) + app.register(hub, memo, key='repin-proof') + assert app.retrieve(hub, memo.id) == memo + assert calls and all(c['known'] and c['audiences'] == ['flex-auth'] for c in calls) + + +def test_real_enforcement_response_with_readback_purpose_cannot_authorize(workspace, tmp_path, signing_key): + binary = os.environ.get('INFD_FLEX_AUTH_BINARY') + source = os.environ.get('INFD_FLEX_AUTH_SOURCE') + if not binary or not source: + pytest.skip('set INFD_FLEX_AUTH_BINARY and INFD_FLEX_AUTH_SOURCE for candidate owner policy') + fixture = Path(source) / 'examples/informed-decision-lifecycle' + with flex_component(binary, tmp_path, signing_key, fixture=fixture) as (pdp, calls): + repo, memo = workspace + app = LifecycleService(repo, pdp) + hub = Caller(Attribution('tenant:platform', Actor('system:serviceaccount:state-hub:state-hub', ActorKind.SERVICE)), + time.time() + 600, dumps({'principal_type_source': 'authentication-derived', + 'tenant_source': 'registration-supplied', 'authentication_audience': 'informed-decision-lifecycle', + 'workload_uid': 'synthetic-verified-uid'})) + original = pdp.transport.request + def advisory_response(*args, **kwargs): + status, data = original(*args, **kwargs) + assert status == 200 and data['effect'] == 'allow' + assert data['binding'].get('purpose', '') == '' + # Keep the real request binding, digest, pins and TTL unchanged: + # even an otherwise exact allow cannot cross the advisory boundary. + data['binding']['purpose'] = 'readback' + return status, data + pdp.transport.request = advisory_response + with pytest.raises(LifecycleError) as refused: + app.register(hub, memo, key='advisory-proof') + assert refused.value.status == 503 and refused.value.code == 'invalid_decision' + with repo.store._connection() as db: + assert db.execute('SELECT count(*) FROM memos').fetchone()[0] == 0 + assert db.execute('SELECT count(*) FROM lifecycle_events').fetchone()[0] == 0 + pdp.transport.request = original + app.register(hub, memo, key='advisory-proof') + assert app.retrieve(hub, memo.id) == memo diff --git a/tests/test_policy_client.py b/tests/test_policy_client.py index ae7a350..b1a9c3e 100644 --- a/tests/test_policy_client.py +++ b/tests/test_policy_client.py @@ -113,3 +113,17 @@ def test_transport_and_missing_caller_have_typed_observations(): client=policy(Broken());assert client.check(request()).outcome=="policy_unavailable" client.token_provider=lambda:None assert client.check(request()).outcome=="caller_unavailable" + + +@pytest.mark.parametrize("purpose", ["", "readback", "enforcement", "unknown", None, False, 0, [], {}]) +def test_binding_purpose_only_allows_exact_enforcement_form(purpose): + transport = PolicyTransport() + transport.change = lambda d: d["binding"].update(purpose=purpose) + observed = policy(transport).check(request()) + if type(purpose) is str and purpose == "": + observed.require_current(time.time()) + assert json.loads(observed.decision_json)["binding"]["purpose"] == "" + else: + assert observed.outcome == "invalid_decision" and observed.decision_json is None + with pytest.raises(PolicyError): + observed.require_current(time.time()) diff --git a/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md b/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md new file mode 100644 index 0000000..9be0feb --- /dev/null +++ b/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md @@ -0,0 +1,107 @@ +--- +id: INFD-WP-0009 +type: workplan +title: "Repair lifecycle consumer pin after Access Engine v2 policy release" +domain: infotech +repo: informed-decision +status: active +owner: codex +topic_slug: netkingdom +created: "2026-10-10" +updated: "2026-10-11" +flavor: implementation +depends_on: [] +related: + - FLEX-WP-0035 + - INFD-WP-0007 +state_hub_workstream_id: "77eaeabf-0644-595f-b3d5-1168e6a294c4" +--- + +## Diagnose and prepare exact config repair + +```task +id: INFD-WP-0009-T01 +status: done +priority: high +state_hub_task_id: "5c30c308-8fe2-5956-b0c1-66c80bcb07e9" +``` + +Native State Hub lifecycle submission returns HTTP 503 `invalid_decision`. +The service remains Ready but its configured lifecycle package is v1/cee6a79; +Access Engine lifecycle provider now runs v2/da01e045 after FLEX-WP-0035. +The envelope contract remains `flex-auth.decision-record.v1`; this is a policy +pin mismatch, not an envelope compatibility migration. Keep exact package, +version and digest enforcement. Source preparation and regression evidence are +in `docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.md`. + +## Release and verify the config-only repair + +```task +id: INFD-WP-0009-T02 +status: done +priority: high +needs_human: false +state_hub_task_id: "1e6684d7-7676-5c70-b701-9dad124b4f07" +``` + +Apply only the reviewed immutable runtime ConfigMap and Deployment reference +through the existing owner GitOps path after exact scoped supervisor approval. +Image, schema, credentials, audience and review policy remain pinned. Retain +server dry-run/diff, readiness and native State Hub register/publish receipts; +retry with stable write keys, do not infer success from readiness. Root agent +owns live evidence and approval recording. This is a repair of the shipped +initial lifecycle, separate from INFD-WP-0008 expansion. + +**Verified 2026-10-11:** founder approved exact config-only revision +`7db8485ffecdebfabd77a9daec085553c74bf0bf`. Manual Argo Application operation +synced only `informed-decision-runtime-6c221878d051` and Deployment, prune false. +Application Succeeded/Healthy; generation24 observed24 Ready1; `/readyz`200; +consumer v2/da01e045 and unchanged image7f5c6cb verified. Native lifecycle +registration and publication succeeded (events28/29). A later review request +rejected packet validation; this separate caller error does not undo verified +authoring. Custodian evidence records original approval, execution and rollback: +`docs/evidence/2026-10-10-security-consolidation/infd-pin-repair-preflight.json`. + +## Explicitly reject advisory purpose at consumer boundary + +```task +id: INFD-WP-0009-T03 +status: done +priority: medium +state_hub_task_id: "ee798d7d-5e60-5247-9c9b-285a7f65cf11" +``` + +PolicyClient now validates binding purpose: absent or exact empty string only; +readback and malformed purposes are refused. Nine purpose variants and a real +provider response contamination test preserve the binding, pin, expiry and +obligations gates. This task covers source implementation and regression tests. +The current runtime image lacks this patch. Service build/native release belongs +to T04, separate from the config-only T02 repair. + + +## Release the advisory-purpose source correction + +```task +id: INFD-WP-0009-T04 +status: progress +priority: medium +state_hub_task_id: "0e1bb868-7bc2-5d4d-953c-e0edaf660ad0" +``` + +Build and scan a new service image including T03, retain provenance and backup +compatibility evidence, prepare a separate scoped image proposal, and verify +native binding/refusal after the owner's approved release. Do not fold an image +change into the config-only T02 proposal. Current runtime 7f5c6cb remains exact. + +**Prepared 2026-10-11:** narrow single-module image overlay on immutable running +7f5c6cb; exact source policy SHA-256 9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62. +Local image/index b8b58944786015a5375304241c149d1dab885eb539d6d8945f56b01a3c2bc821 +is built and retained, unpublished and undeployed. Base layer prefix and runtime +configuration are preserved; installed-image 10 purpose variants pass; 13 +container checks include restart and synthetic consistent backup/restore. A +fresh Trivy database scan has zero HIGH/CRITICAL findings, with its Alpine EOL +warning retained. See `docs/evidence/2026-10-11-purpose-hardening/README.md`. +Remaining gates: source-bound registry publication and exact digest verification, +fresh native snapshot/restore compatibility, owner GitOps server dry-run/diff, +separate scoped supervisor approval and native post-release binding/refusal. +No release approval or actual production-data restore is inferred from fixtures.