diff --git a/.forgejo/workflows/zlib-overlay-image.yaml b/.forgejo/workflows/zlib-overlay-image.yaml new file mode 100644 index 0000000..dc981ab --- /dev/null +++ b/.forgejo/workflows/zlib-overlay-image.yaml @@ -0,0 +1,71 @@ +name: Publish exact zlib-only remediation candidate +on: + push: + branches: [main] + paths: + - ".forgejo/workflows/zlib-overlay-image.yaml" + - "deploy/zlib-overlay/**" + - "tools/zlib_overlay/**" + workflow_dispatch: +concurrency: + group: informed-decision-zlib-overlay + cancel-in-progress: false +permissions: + contents: read +env: + REGISTRY: forgejo.coulomb.social + IMAGE_NAME: coulomb/informed-decision + DOCKER_HOST: tcp://127.0.0.1:2375 +jobs: + publish-candidate: + runs-on: container-build + steps: + - name: Verify and publish zlib-only candidate + env: + REGISTRY_USER: ${{ secrets.REGISTRY_USER }} + REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }} + run: | + set -eu + umask 077 + REF="${GITHUB_SHA:?exact source revision required}" + echo "${REF}" | grep -Eq '^[0-9a-f]{40}$' + test "${GITHUB_REPOSITORY}" = "coulomb/informed-decision" + if [ -z "${REGISTRY_USER:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then + echo "Admitted owner registry capability unavailable; no borrowed credential permitted." >&2 + exit 2 + fi + BUILD_ROOT="$(mktemp -d)" + export DOCKER_CONFIG="${BUILD_ROOT}/docker-config" + cleanup() { rm -rf "${BUILD_ROOT}"; } + trap cleanup EXIT + mkdir -p "${BUILD_ROOT}/source" "${BUILD_ROOT}/context" "${DOCKER_CONFIG}" "${HOME}/bin" + wget -qO "${BUILD_ROOT}/source.tar.gz" "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz" + tar xzf "${BUILD_ROOT}/source.tar.gz" -C "${BUILD_ROOT}/source" --strip-components=1 + CONTEXT="${BUILD_ROOT}/source/deploy/zlib-overlay" + for INPUT in .dockerignore Containerfile zlib-1.3.2-r1.apk APKINDEX.tar.gz; do + cp "${CONTEXT}/${INPUT}" "${BUILD_ROOT}/context/${INPUT}" + chmod 0644 "${BUILD_ROOT}/context/${INPUT}" + done + echo "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 ${BUILD_ROOT}/context/zlib-1.3.2-r1.apk" | sha256sum -c - + echo "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 ${BUILD_ROOT}/context/APKINDEX.tar.gz" | sha256sum -c - + echo "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a ${BUILD_ROOT}/context/.dockerignore" | sha256sum -c - + echo "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15 ${BUILD_ROOT}/context/Containerfile" | sha256sum -c - + wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker + export PATH="${HOME}/bin:${PATH}" + echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin + BASE="${REGISTRY}/${IMAGE_NAME}@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a" + docker pull "${BASE}" + IMAGE="${REGISTRY}/${IMAGE_NAME}:zlib-85091-${REF}" + docker build --network none --pull=false --memory 256m --cpu-period 100000 --cpu-quota 100000 --build-arg "SOURCE_REVISION=${REF}" --build-arg "SOURCE_CONTEXT_SHA256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" --file "${BUILD_ROOT}/context/Containerfile" --tag "${IMAGE}" "${BUILD_ROOT}/context" + docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/base-runtime.json" + docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/candidate-runtime.json" + docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - "$(cat "${BUILD_ROOT}/base-runtime.json")" "$(cat "${BUILD_ROOT}/candidate-runtime.json")" < "${BUILD_ROOT}/source/tools/zlib_overlay/compare_runtime.py" + docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/purpose_overlay/check_installed.py" + OUTPUT="$(docker push "${IMAGE}")" + printf '%s\n' "${OUTPUT}" + DIGEST="$(printf '%s\n' "${OUTPUT}" | tr '\r' '\n' | awk '{for(i=1;i<=NF;i++)if($i~/^sha256:[a-f0-9]{64}$/)print $i}' | tail -1)" + printf '%s' "${DIGEST}" | grep -Eq '^sha256:[a-f0-9]{64}$' + echo "published=${REGISTRY}/${IMAGE_NAME}@${DIGEST}" + echo "source_revision=${REF}" + echo "context_sha256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" + echo "candidate_only=true; actual published digest/full scan/SBOM/provenance and distinct native founder release approval remain required" diff --git a/deploy/zlib-overlay/.dockerignore b/deploy/zlib-overlay/.dockerignore new file mode 100644 index 0000000..b1cccb1 --- /dev/null +++ b/deploy/zlib-overlay/.dockerignore @@ -0,0 +1,5 @@ +* +!.dockerignore +!Containerfile +!zlib-1.3.2-r1.apk +!APKINDEX.tar.gz diff --git a/deploy/zlib-overlay/APKINDEX.tar.gz b/deploy/zlib-overlay/APKINDEX.tar.gz new file mode 100644 index 0000000..f649237 Binary files /dev/null and b/deploy/zlib-overlay/APKINDEX.tar.gz differ diff --git a/deploy/zlib-overlay/Containerfile b/deploy/zlib-overlay/Containerfile new file mode 100644 index 0000000..6a0ad7f --- /dev/null +++ b/deploy/zlib-overlay/Containerfile @@ -0,0 +1,17 @@ +FROM forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a +ARG SOURCE_REVISION=uncommitted-T05-local-preparation +ARG SOURCE_CONTEXT_SHA256 +USER 0:0 +COPY zlib-1.3.2-r1.apk APKINDEX.tar.gz /tmp/infd-zlib/x86_64/ +RUN echo '63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk' | sha256sum -c - \ + && echo '24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 /tmp/infd-zlib/x86_64/APKINDEX.tar.gz' | sha256sum -c - \ + && apk verify /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk /tmp/infd-zlib/x86_64/APKINDEX.tar.gz \ + && apk upgrade --no-logfile --no-network --no-cache --no-preupgrade --repositories-file /dev/null --repository /tmp/infd-zlib zlib \ + && apk info --exists 'zlib=1.3.2-r1' \ + && rm -rf /tmp/infd-zlib +USER 10001:10001 +LABEL org.opencontainers.image.revision="$SOURCE_REVISION" \ + org.opencontainers.image.base.digest="sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a" \ + social.coulomb.source.context.sha256="$SOURCE_CONTEXT_SHA256" \ + social.coulomb.source.policy.sha256="9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" \ + social.coulomb.release.scope="INFD-WP-0009-T05/zlib-85091-r1" diff --git a/deploy/zlib-overlay/pins.json b/deploy/zlib-overlay/pins.json new file mode 100644 index 0000000..bfdde38 --- /dev/null +++ b/deploy/zlib-overlay/pins.json @@ -0,0 +1,15 @@ +{ + "files": { + ".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a", + "Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15", + "zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + "context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "base_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "package_url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk", + "index_url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz", + "package_commit": "0afa2da0e8c8051c6f8f64a7a388e5a259904245", + "package_signature": "alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "status": "prepared-unpublished-unapproved" +} diff --git a/deploy/zlib-overlay/zlib-1.3.2-r1.apk b/deploy/zlib-overlay/zlib-1.3.2-r1.apk new file mode 100644 index 0000000..8a12f3e Binary files /dev/null and b/deploy/zlib-overlay/zlib-1.3.2-r1.apk differ diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/original-manifest.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/original-manifest.json new file mode 100644 index 0000000..635e570 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/original-manifest.json @@ -0,0 +1,259 @@ +{ + "owner": "informed-decision", + "decision": "changes_requested", + "scope": "same T08 exact66 lower-layer whiteout finding; initial/intermediate historical reviews retained; no native go", + "files": [ + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json", + "original_sha256": null, + "staged_sha256": "8bc6da5507f4d9d1ff6d4439a82eb8b32098cc23fcec52bde4fecdcae939e384" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md", + "original_sha256": null, + "staged_sha256": "11039006000e55d6add3f7da70661545c4dfc1d533481eca8145d2452dbf574b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json", + "original_sha256": null, + "staged_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json", + "original_sha256": null, + "staged_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md", + "original_sha256": null, + "staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md", + "original_sha256": null, + "staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "original_sha256": null, + "staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "original_sha256": null, + "staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "original_sha256": null, + "staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8" + }, + { + "repo": "informed-decision", + "path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "original_sha256": null, + "staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "original_sha256": null, + "staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "original_sha256": null, + "staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "original_sha256": null, + "staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "original_sha256": null, + "staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "original_sha256": null, + "staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "original_sha256": null, + "staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "original_sha256": null, + "staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "original_sha256": null, + "staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md", + "original_sha256": null, + "staged_sha256": "5cd9af6da8e8b9329bbf3be56c82f62b827bed66d0b7d860350c421e8105aca6" + }, + { + "repo": "informed-decision", + "path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md", + "original_sha256": null, + "staged_sha256": "5cd9af6da8e8b9329bbf3be56c82f62b827bed66d0b7d860350c421e8105aca6" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py", + "original_sha256": null, + "staged_sha256": "f79ca389f7d2a2294b3eed0229865caa5811ee4a53bfd545335453c85ee37b09" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py", + "original_sha256": null, + "staged_sha256": "f79ca389f7d2a2294b3eed0229865caa5811ee4a53bfd545335453c85ee37b09" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json", + "original_sha256": null, + "staged_sha256": "9cf6bb12f93ebfc2b92fc470f50a470256a25db3a70f98f2c08a6e73011ebb1d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json", + "original_sha256": null, + "staged_sha256": "9cf6bb12f93ebfc2b92fc470f50a470256a25db3a70f98f2c08a6e73011ebb1d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "c3760ab21efea5f7088e9b81a9d092727eb5a04d130519951d28b5327bee31d8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "c3760ab21efea5f7088e9b81a9d092727eb5a04d130519951d28b5327bee31d8" + }, + { + "repo": "informed-decision", + "path": "workplans/ADHOC-2026-10-11.md", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/workplans/ADHOC-2026-10-11.md", + "original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8", + "staged_sha256": "b22c0e9c803a455d4235b70684fe05c655a8f9addb0b9836a2012d9904a93a09" + }, + { + "repo": "informed-decision", + "path": "docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md", + "original_sha256": null, + "staged_sha256": "99bd69d3898b6d79e32ed21664ad3659b5d8410db1a314b751a84daaf5579b65" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json", + "original_sha256": null, + "staged_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py", + "original_sha256": null, + "staged_sha256": "2bb7a5352da28bad2c7cc2566d6bd19875d1310c1ac8f558bc546f3da6442b56" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json", + "staged_path": "/tmp/infd-zlib-product-whiteout-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json", + "original_sha256": null, + "staged_sha256": "f3639bbe5e962c839d55e67fdbc36341d23255df9341e797d3a4dff9cc471f40" + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py new file mode 100644 index 0000000..8b6f589 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py @@ -0,0 +1,20 @@ +import pathlib,json,hashlib +S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=pathlib.Path('/tmp/infd-zlib-product-final-review-stage');H=lambda b:hashlib.sha256(b).hexdigest() +m=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8' +entries=json.loads(m.read_text());assert len(entries)==58 +for e in entries:assert H(pathlib.Path(e['staged_path']).read_bytes())==e['staged_sha256'] +oldm=P/'initial-8d345bb2/original-manifest.json';assert H(oldm.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66' +old=json.loads(oldm.read_text());oldroot=P/'initial-8d345bb2/owner-snapshot';changed=[] +for e in old: + original=oldroot/e['path'];assert H(original.read_bytes())==e['staged_sha256'] + if H((S/e['path']).read_bytes())!=e['staged_sha256']:changed.append(e['path']) +assert set(changed)=={'docs/evidence/2026-10-11-zlib-remediation-candidate/'+n for n in ['README.md','artifact-comparison.json','local-candidate-verification.json','verify_local_artifacts.py']} +r=json.loads((P/'local-candidate-verification.json').read_text());oldr=json.loads((oldroot/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text()) +for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert r[k]==oldr[k] +code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-final-review-stage')/'independent-directory-artifact-comparison.json').write_text") +exec(compile(code,'product-amended-readback','exec'),{}) +a=json.loads((O/'independent-directory-artifact-comparison.json').read_text());b=json.loads((P/'artifact-comparison.json').read_text()) +for k in ['directory_metadata_compared','directory_count_base','directory_count_candidate','directory_metadata_delta','final_changed_files','base_layers_preserved']:assert a[k]==b[k] +assert a['directory_metadata_compared'] and not a['directory_metadata_delta'] +(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all58_hashes_verified=True,all27_initial_archived_hashes_verified=True,changed_initial_paths=changed,image_context_source_workflow_runtime_scan_unchanged=True,new_source_tests_passed=3,directory_negative_mutations=3,optimized_tampered_before_read_refusal=True,existing_actual_archives_directory_reaudit=True,directory_count_base=a['directory_count_base'],directory_count_candidate=a['directory_count_candidate'],directory_metadata_delta={},native_actions=False),indent=2)+'\n') +print('Exact amended source and directory metadata readback pass.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json new file mode 100644 index 0000000..9d63407 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json @@ -0,0 +1,73 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "directory_metadata_compared": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json new file mode 100644 index 0000000..81b04ce --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json @@ -0,0 +1,42 @@ +{ + "owner": "informed-decision", + "scope": "exact local T05 source candidate only; no native go/publication or task completion", + "candidate_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "files": [ + { + "repo": "informed-decision", + "path": "workplans/ADHOC-2026-10-11.md", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/workplans/ADHOC-2026-10-11.md", + "original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8", + "staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22" + }, + { + "repo": "informed-decision", + "path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "original_sha256": null, + "staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "original_sha256": null, + "staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "original_sha256": null, + "staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c" + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py new file mode 100644 index 0000000..36291cd --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py @@ -0,0 +1,39 @@ +import pathlib,json,hashlib,copy,importlib.util,tarfile +S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json') +H=lambda b:hashlib.sha256(b).hexdigest() +assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66' +for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256'] +E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text()) +for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h +spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp) +a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36 +mutations=['appfile','keys','world','network','provider'] +for field in mutations: + c=copy.deepcopy(b) + if field=='appfile':c['app_file_sha256']['policy.py']='0'*64 + elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64 + elif field=='world':c['apk_world_sha256']='0'*64 + elif field=='network':c['network_accessed']=True + else:c['provider_or_customer_data_used']=True + try:cmp.compare(a,c) + except ValueError:pass + else:raise AssertionError(field) +# Read local image archives, source verifier operations are limited to these public local artifacts. +code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text") +exec(compile(code,'product-local-artifact-readback','exec'),{}) +proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']: + assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key] +# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline. +for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']: + with tarfile.open(S/'deploy/zlib-overlay'/n) as t: + signs=[x.name for x in t if x.name.startswith('.SIGN.')] + assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs + assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256'] +base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text()) +assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44 +assert base_scan['Metadata']['OS']==scan['Metadata']['OS'] +assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])] +container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container +result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False} +(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json new file mode 100644 index 0000000..2db5495 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json @@ -0,0 +1,69 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json new file mode 100644 index 0000000..d09a3fc --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json @@ -0,0 +1,21 @@ +{ + "manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "all27_staged_hashes_verified": true, + "evidence_hashes_verified": true, + "existing_source_tests": 4, + "existing_source_negative_mutations": 8, + "additional_product_negative_mutations": [ + "appfile", + "keys", + "world", + "network", + "provider" + ], + "saved_image_fs_and_layer_runtime_readback": true, + "sbom_only_zlib_delta": true, + "scan44_packages_zero_at_retained_db": true, + "signed_archive_named_key_matches_unchanged_baseline_truststore": true, + "signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.", + "native_actions": false, + "candidate_published": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md new file mode 100644 index 0000000..461d4d1 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md @@ -0,0 +1,74 @@ +# Bounded zlib candidate Product owner review + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact local zlib-only source candidate technical preparation +manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66 +comment: >- + Informed-decision intent requires human binding and preserved evidence; this + candidate changes only a native compression dependency while preserving + application authorization/presentation behavior. T08 review work record was + completed first. This is technical source agreement, not native go, publication + receipt, founder acceptance or T05 completion. +``` + +All27 staged hashes and retained evidence-file hashes independently verify. +Independent saved-image archive readback confirms all nine exact763 base diff_ids +as prefix, equal effective runtime configuration with only explicitly normalized +empty/false/null defaults, and final filesystem changes exactly +`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent. +Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL +and UID/GID10001 remain equal. Root build identity returns to10001:10001. +No service values, namespace, DB, customer data, config, PVC, schema, audience, +policy pins, protected helper or existing release journal is changed. + +Package/index bytes match pinned official HTTPS download hashes. Both signed +archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present +in unchanged baseline trust metadata. Retained actual maker apk verify success +against exact763 installed keys is the execution evidence; this review separately +checks archive signatures' metadata, bytes and trust identity, without claiming +a new signature-verification execution. Containerfile requires digest checks and +`apk verify` success before offline named-package upgrade; no allow-untrusted or +keys-dir override. Existing trusted keys are not replaced. +[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd) +defines integrity/signature checking and nonzero failure. +Upgrade selects only zlib from retained local signed index, disables network, +preupgrade and logging, and removes temporary public artifacts. + +Both full CycloneDX/Trivy artifacts independently show44 packages and only +zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM +CVE-2026-85091; candidate has zero findings at the retained same database +03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917. +No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning +and actual38 OS/6 Python detector coverage remain disclosed. This is bounded +scan improvement at that snapshot, not estate risk grading or future safety. +Local daemon image78bfdcc and saved OCI config625d are distinct disclosed +representations; neither is a published registry digest or native image proof. + +Four existing source tests pass, covering eight mutations; five additional Product +mutations of app source, trust keys, APK world, network and provider/data flags +refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt. +Retained four compression vectors/three malformed refusals/crypto/JWT/waitress +and ten installed purpose variants are local synthetic checks, not live PDP +or customer/native-data testing. No new container or native execution by reviewer. + +Workflow publishes only a source-bound candidate through existing admitted owner +registry capability after root source review/commit: exact40hex source revision, +fixed owner archive, four input hashes/contextc554, exact763 base, no-network +bounded build, unchanged runtime comparison and purpose checks before push. +It has no kubectl, Argo, DB/admin, namespace or runtime deployment action. +The workflow is unexecuted; source review does not attest CI credentials, actual +publication or published artifact equivalence. Root must retain actual CI/source +revision and registry descriptor/layer/config/package/signature/context readback, +then full published scan/SBOM and scoped candidate release preparation. Only +distinct exact informed-decision founder native approval followed by installedr1, +runtime/purpose and full-rescan proof can close T05. Future image-only rollback +to763 preserves latest DB; no historical snapshot restore. + +T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic +controller is implied. T04/c96 accepted outcome and original uncertain journals +remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted. +No new native authority, owner checkout write, credential/login, deployment or +customer-data access occurred in this review. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md new file mode 100644 index 0000000..b39c57f --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md @@ -0,0 +1,259 @@ +--- +id: INFD-WP-ADHOC-2026-10-11 +type: workplan +title: "Application-owner catalogue facts review" +domain: infotech +repo: informed-decision +status: finished +owner: codex +topic_slug: netkingdom +created: "2026-10-11" +updated: "2026-10-11" +flavor: planning +state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be" +--- + +## Review exact one-application catalogue facts + +```task +id: INFD-WP-ADHOC-2026-10-11-T01 +status: done +priority: medium +state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305" +``` + +Completed informed-decision application-owner source review under INTENT.md +Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10, +and Layer Placement. Read actual owner OIDC, requester and policy-request +code, governing Staff/PEP-shaped declaration, User Engine model, and existing +value-free native registration/Ingress/preflight receipts. Exact canonical +facts agree. Browser client is distinct from create-only requester. + +Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md. +Canonical facts SHA-256: +`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`. +Reviewed refined nine-file executor manifest SHA-256: +`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`. + +This task completes the application-facts source review only. It grants no +maintenance exception, native dry-run/apply/recovery, IAM permission, image +release or human disposition. Existing User Engine native acceptance work +remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is +created by this bounded review. No tests were needed for this evidence-only +review; no native, credential or login action occurred. + +## Independently review purpose overlay release preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T02 +status: done +priority: medium +``` + +Completed same-role informed-decision-owner technical review of frozen36-path +purpose release manifest SHA-256 +`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`. +All36 staged file hashes and exact source PolicyClient9d7 hash were verified. +Source candidates and captured candidate Deployment differ only in the image. +Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding; +T05 keeps its2026-10-18 follow-through. Actual published-image receipts and +sealed native read-only preflight support preparation, not native deployment. + +Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed +binding forms across register, replay, publish, annotate and revise. Each +refusal preserves every domain table, records a truthful invalid-decision +observation and leaves the same idempotency key reusable after restoring a +canonical enforcement response. These are synthetic source tests only. +Test: tests/test_purpose_owner_mutation_negatives.py. +Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json. +Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md. + +This bounded review grants no native backup/export/restore, image rollout, +credentials, login, human disposition or vulnerability acceptance. Existing +INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual +is created or claimed completed. Catalogue ACK/T01 remains unchanged. + +## Confirm amended purpose release custody and preflight gates + +```task +id: INFD-WP-ADHOC-2026-10-11-T03 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed amended78-path release manifest SHA-256 +`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`. +All78 file hashes verified, original36 archive retained, source PolicyClient9d7 +and both image-only source candidates unchanged. Prior50 source lifecycle +mutation/idempotency negatives remain applicable and were not repeated. + +Confirmed stdlib read-only schema5/integrity/count gate before ANY native or +restored Store/admin open, explicit local/remote optimized-interpreter refusal, +sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count +equality distinguished from legitimate concurrent live commits. Revised20-doc +184912-byte packet and01:39 read-only dry-run receipts remain preparation. +Native schema gate, backup/export/restore/release and founder disposition remain +unperformed; T04/T05 obligations and temporary vulnerability review persist. + +Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md. +Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/ +receipt remain unchanged. No new residual or authority is created by this review. + +## Reconcile Staff evidence source declaration and current guarantees + +```task +id: INFD-WP-ADHOC-2026-10-11-T04 +status: done +priority: medium +``` + +Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source +class definitions, transactional recording, heartbeat/reconciliation scheduling, +existing component-test assertions and native count/receipt evidence. Reconciled +stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening +finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending +NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual +source intake for remaining class-specific declaration/verification gaps, +origin INFD-WP-0007. No residual implementation or native action occurred. + +Source evidence reconciliation: +docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md. +Formal source review: +docs/reviews/2026-10-11-staff-evidence-source-owner-review.md. +Existing Staff/PEP-shaped classification, three load-bearing class classifications, +compromised-source and commitment/content availability limits remain unchanged. + +## Independently review supervised purpose actuator product boundaries + +```task +id: INFD-WP-ADHOC-2026-10-11-T05 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed exact23-path helper manifest +`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`, +all staged hashes and embedded source bundle/plan. Product evidence/schema5, +private snapshot custody, confined offline UID0 initialization followed by +UID10001 pre/post-admin verification, independent failed-candidate rollback +and all-phase start deadline are technically agreed as source preparation. + +No purpose-policy or candidate image change. Retained helper16 synthetic tests +and platform5 independent recovery negatives are mechanism proof; prior50 +product policy negatives remain applicable. No new test run was needed for this +unchanged-source review. Native-provider acceptance remains distinct from the +installed10 synthetic purpose forms; T04 is not complete. Before first human +post, amend exact20-document packet to hash-bind helper/plan, four render inputs, +initializer/recovery/deadline refinements and preserved full scan provenance. +Exact combined packet acknowledgement remains a separate review gate. + +Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md. +No native reads/backups/export/restore/release, credentials, human disposition, +founder approval or phase authority was exercised by this review. + +## Prepare separately gated provider-derived denial mechanism probe + +```task +id: INFD-WP-ADHOC-2026-10-11-T06 +status: done +priority: medium +``` + +Prepared source-only readonly lifecycle.search provider-derived mechanism probe +with truthful informed-decision/review SERVICE and no human/StateHub attributes. +Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a +canonical real DENY is required; no claims are invented to obtain ALLOW. +One actual provider response will remain in Pod memory; ten transformed +noncanonical purpose copies test installed consumer refusal without further +provider calls, DB/admin or act effects. This is a denial/binding mechanism +proof candidate, not actual authorized lifecycle or full T04 acceptance. + +Source: docs/evidence/2026-10-11-purpose-provider-probe/. +Ten synthetic source tests pass; no actual provider, credential, runtime config, +DB, native data or live action was accessed. Posted frozen112 packet/helper +remain unchanged. Exact separate founder go for this newly prepared probe and +its target must precede any execution; current memo has no acceptance and this +new helper is not hash-bound in that submitted packet. T04 remains progress. + +## Review exact existing-snapshot rescue version2 preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T07 +status: done +priority: medium +``` + +Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7 +under the same informed-decision-owner role. Actual original backupCOMPLETE/copy +UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1 +require fresh founder acceptance. Immutable reads are bounded to proven frozen +closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose. +Independent existing26 mocked tests plus41 subtests pass, and10 new product scope +guards pass (including eight refusal mutations and a frozen initial packet check). +No native command, DB open, credentials or rescue operation occurred. + +Initial review decision changes_requested: proposal.json misleadingly names old +f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed; +label it original/historical and refreeze all dependent packet hashes. Correct +current bundle/plan digests already exist. The normalized test fixture is not an +owner edit or approval. Initial review/failure must remain after correction; +exact amended confirmation is still required before newhuman submission/execution. + +Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md. +Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/. +T04 remains progress; original version1 approval is not newversion2 authority. + +**Amended source confirmation, same T07 trial:** exact134-path manifest +`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d` +corrects only the historical helper provenance label and dependent packet hashes; +original66 source and initial changes-requested review remain retained. Current +helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1 +and20documents validate:173469packetbytes/240451revisionbytes. Eight scope +mutations and three packet mutations independently refuse. Final technical +source acknowledgement approved; no new human acceptance or native rescue. +Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md. + + +**Actual-outcome assessment preparation, same completed T07 trial:** independently +verified original receipt-byte hashes and source consumer path after approved +source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover +backup/private copy matches live post-release counts16/56/0, delivered336, +confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001 +checks pass. Actual post-rollout authenticated provider-backed outcomes readback +is separate from installed ten synthetic purpose forms (2allow/8refuse). +Completed source-only assessment supports T04 done, T05 todo and WP0009 active. +Original failed copy and verifier UNCERTAIN remain preserved, with no replay or +helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission +handling correction; no implementation, native action or authority grant. +This work-record preparation precedes the formal actual-outcome review entry. +Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md. +Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/. + + +## Independently review bounded zlib-only T05 source candidate + +```task +id: INFD-WP-ADHOC-2026-10-11-T08 +status: done +priority: medium +``` + +Completed informed-decision Product source review of exact27-path candidate +manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66. +All staged/evidence hashes verify. Independently reread local saved base/candidate +image archives, effective runtime config, nine base layer prefix, two final file +changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs; +44 packages/base1MED to candidate0 at retained same scanner database. +Signed APK/index named key matches unchanged base trust metadata; enforced +apk verify against existing keys retained, no allow-untrusted or truststore override. +Four existing source tests pass (eight refusal mutations), plus five independent +appfile/trustkeys/world/network/provider metadata mutations refuse. +Purpose/backend checks remain local and synthetic, not actual PDP or data proof. +Technical source preparation agreement only: local image78bfdcc is unpublished, +T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and +new native founder approval/installed proof are still required. Current763/native +DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010 +is unpromoted/unimplemented. No native actions, credentials or owner source writes. +This completed work record is prepared before the formal review entry. +Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md. +Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json new file mode 100644 index 0000000..5548150 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json @@ -0,0 +1,20 @@ +{ + "exact_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8", + "all58_hashes_verified": true, + "all27_initial_archived_hashes_verified": true, + "changed_initial_paths": [ + "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py" + ], + "image_context_source_workflow_runtime_scan_unchanged": true, + "new_source_tests_passed": 3, + "directory_negative_mutations": 3, + "optimized_tampered_before_read_refusal": true, + "existing_actual_archives_directory_reaudit": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "native_actions": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py new file mode 100644 index 0000000..36291cd --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py @@ -0,0 +1,39 @@ +import pathlib,json,hashlib,copy,importlib.util,tarfile +S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json') +H=lambda b:hashlib.sha256(b).hexdigest() +assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66' +for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256'] +E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text()) +for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h +spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp) +a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36 +mutations=['appfile','keys','world','network','provider'] +for field in mutations: + c=copy.deepcopy(b) + if field=='appfile':c['app_file_sha256']['policy.py']='0'*64 + elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64 + elif field=='world':c['apk_world_sha256']='0'*64 + elif field=='network':c['network_accessed']=True + else:c['provider_or_customer_data_used']=True + try:cmp.compare(a,c) + except ValueError:pass + else:raise AssertionError(field) +# Read local image archives, source verifier operations are limited to these public local artifacts. +code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text") +exec(compile(code,'product-local-artifact-readback','exec'),{}) +proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']: + assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key] +# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline. +for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']: + with tarfile.open(S/'deploy/zlib-overlay'/n) as t: + signs=[x.name for x in t if x.name.startswith('.SIGN.')] + assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs + assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256'] +base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text()) +assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44 +assert base_scan['Metadata']['OS']==scan['Metadata']['OS'] +assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])] +container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container +result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False} +(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json new file mode 100644 index 0000000..2db5495 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json @@ -0,0 +1,69 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json new file mode 100644 index 0000000..d09a3fc --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json @@ -0,0 +1,21 @@ +{ + "manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "all27_staged_hashes_verified": true, + "evidence_hashes_verified": true, + "existing_source_tests": 4, + "existing_source_negative_mutations": 8, + "additional_product_negative_mutations": [ + "appfile", + "keys", + "world", + "network", + "provider" + ], + "saved_image_fs_and_layer_runtime_readback": true, + "sbom_only_zlib_delta": true, + "scan44_packages_zero_at_retained_db": true, + "signed_archive_named_key_matches_unchanged_baseline_truststore": true, + "signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.", + "native_actions": false, + "candidate_published": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json new file mode 100644 index 0000000..19bf3a4 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json @@ -0,0 +1,464 @@ +[ + { + "repo": "informed-decision", + "path": ".forgejo/workflows/zlib-overlay-image.yaml", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml", + "original_sha256": null, + "staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/.dockerignore", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore", + "original_sha256": null, + "staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/APKINDEX.tar.gz", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz", + "original_sha256": null, + "staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/Containerfile", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile", + "original_sha256": null, + "staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/pins.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json", + "original_sha256": null, + "staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "original_sha256": null, + "staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "original_sha256": null, + "staged_sha256": "c999a0c326a95e74082258851a5c4669395937a8fed95927f114ff08a18e0d6b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json", + "original_sha256": null, + "staged_sha256": "de852da5990326642e0c0d15ed74ab21513b4227c5634ba7146568876e750c6a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "original_sha256": null, + "staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "original_sha256": null, + "staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "original_sha256": null, + "staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "original_sha256": null, + "staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "original_sha256": null, + "staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "original_sha256": null, + "staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json", + "original_sha256": null, + "staged_sha256": "91384b270c0462223af1ff66e3ca75db5fce692c56c6bde6df435e6a2a079c5e" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json", + "original_sha256": null, + "staged_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml", + "original_sha256": null, + "staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore", + "original_sha256": null, + "staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz", + "original_sha256": null, + "staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile", + "original_sha256": null, + "staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json", + "original_sha256": null, + "staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "original_sha256": null, + "staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "original_sha256": null, + "staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "original_sha256": null, + "staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "original_sha256": null, + "staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "original_sha256": null, + "staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "original_sha256": null, + "staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "original_sha256": null, + "staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "original_sha256": null, + "staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "original_sha256": null, + "staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "original_sha256": null, + "staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "original_sha256": null, + "staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "original_sha256": null, + "staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "original_sha256": null, + "staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py", + "original_sha256": null, + "staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py", + "original_sha256": null, + "staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py", + "original_sha256": null, + "staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py", + "original_sha256": null, + "staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "original_sha256": null, + "staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md", + "original_sha256": null, + "staged_sha256": "4d0b0ed0b41f2098adfa2e626c641360855cd0e717bbd2d7a6c155cee2ae91ec" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json", + "original_sha256": null, + "staged_sha256": "3e81c1cedb2e3b25d83a779011898181a7860ff76532ede5fa3e9b8f63632700" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json", + "original_sha256": null, + "staged_sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json", + "original_sha256": null, + "staged_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json", + "original_sha256": null, + "staged_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py", + "original_sha256": null, + "staged_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "original_sha256": null, + "staged_sha256": "51505fa91e8d498c2eb3814442e89b01621290f1b39da08a5f460f6f6f9f112c" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "original_sha256": null, + "staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "original_sha256": null, + "staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "original_sha256": null, + "staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py", + "original_sha256": null, + "staged_sha256": "8635859fb63f8778e48ae4f3532e6fc37eb1fbc289801ec5b68b8a90bb6fc364" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "original_sha256": null, + "staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/check_build_inputs.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py", + "original_sha256": null, + "staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/check_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py", + "original_sha256": null, + "staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/compare_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py", + "original_sha256": null, + "staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/test_candidate.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py", + "original_sha256": null, + "staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9" + }, + { + "repo": "informed-decision", + "path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223", + "staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4" + } +] diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py new file mode 100644 index 0000000..5973303 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py @@ -0,0 +1,52 @@ +from pathlib import Path +import hashlib,io,json,tarfile,sys +if sys.flags.optimize: + raise SystemExit("REFUSED: optimized Python disables required artifact validation") +root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build') +def image(path): + with tarfile.open(path) as archive: + manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1 + configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes) + files={} + for name in manifest[0]['Layers']: + with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer: + for member in layer: + path=member.name + while path.startswith('./'):path=path[2:] + path=path.lstrip('/');p=Path(path) + if p.name=='.wh..wh..opq': + folder=p.parent.as_posix();prefix='' if folder=='.' else folder+'/' + files={key:value for key,value in files.items() if not key.startswith(prefix)};continue + if p.name.startswith('.wh.'): + removed=(p.parent/p.name[4:]).as_posix();files={key:value for key,value in files.items() if key!=removed and not key.startswith(removed+'/')};continue + if member.isfile(): + data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest()) + elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None) + elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname) + else:continue + files[path]=value + return config,hashlib.sha256(configbytes).hexdigest(),files +base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar') +assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids'] +changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)} +expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +assert set(changed)<=expected,set(changed) +a,b=base['config'].copy(),candidate['config'].copy() +labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{}) +a.pop('Image',None);b.pop('Image',None) +defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None} +for key,value in defaults.items(): + a.setdefault(key,value);b.setdefault(key,value) +assert a==b,(a,b) +components=[] +for name in ['base-sbom.cdx.json','sbom.cdx.json']: + data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')}) +sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)} +assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta +vulns=[] +for name in ['base-trivy-full.json','trivy-full.json']: + data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])]) +assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM' +assert not vulns[1] +proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False} +(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed))) diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json new file mode 100644 index 0000000..3618287 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json @@ -0,0 +1,113 @@ +{ + "owner": "informed-decision", + "scope": "exact amended T05 source agreement; same T08; historical initial review retained; no publication or native go", + "candidate_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8", + "initial_product_review_manifest_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225", + "files": [ + { + "repo": "informed-decision", + "path": "workplans/ADHOC-2026-10-11.md", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/workplans/ADHOC-2026-10-11.md", + "original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8", + "staged_sha256": "11039006000e55d6add3f7da70661545c4dfc1d533481eca8145d2452dbf574b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json", + "original_sha256": null, + "staged_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md", + "original_sha256": null, + "staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "original_sha256": null, + "staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8" + }, + { + "repo": "informed-decision", + "path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "original_sha256": null, + "staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "original_sha256": null, + "staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "original_sha256": null, + "staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "original_sha256": null, + "staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "original_sha256": null, + "staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c" + }, + { + "repo": "informed-decision", + "path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md", + "original_sha256": null, + "staged_sha256": "5cd9af6da8e8b9329bbf3be56c82f62b827bed66d0b7d860350c421e8105aca6" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py", + "original_sha256": null, + "staged_sha256": "f79ca389f7d2a2294b3eed0229865caa5811ee4a53bfd545335453c85ee37b09" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json", + "original_sha256": null, + "staged_sha256": "9cf6bb12f93ebfc2b92fc470f50a470256a25db3a70f98f2c08a6e73011ebb1d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "c3760ab21efea5f7088e9b81a9d092727eb5a04d130519951d28b5327bee31d8" + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py new file mode 100644 index 0000000..8b6f589 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py @@ -0,0 +1,20 @@ +import pathlib,json,hashlib +S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=pathlib.Path('/tmp/infd-zlib-product-final-review-stage');H=lambda b:hashlib.sha256(b).hexdigest() +m=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8' +entries=json.loads(m.read_text());assert len(entries)==58 +for e in entries:assert H(pathlib.Path(e['staged_path']).read_bytes())==e['staged_sha256'] +oldm=P/'initial-8d345bb2/original-manifest.json';assert H(oldm.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66' +old=json.loads(oldm.read_text());oldroot=P/'initial-8d345bb2/owner-snapshot';changed=[] +for e in old: + original=oldroot/e['path'];assert H(original.read_bytes())==e['staged_sha256'] + if H((S/e['path']).read_bytes())!=e['staged_sha256']:changed.append(e['path']) +assert set(changed)=={'docs/evidence/2026-10-11-zlib-remediation-candidate/'+n for n in ['README.md','artifact-comparison.json','local-candidate-verification.json','verify_local_artifacts.py']} +r=json.loads((P/'local-candidate-verification.json').read_text());oldr=json.loads((oldroot/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text()) +for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert r[k]==oldr[k] +code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-final-review-stage')/'independent-directory-artifact-comparison.json').write_text") +exec(compile(code,'product-amended-readback','exec'),{}) +a=json.loads((O/'independent-directory-artifact-comparison.json').read_text());b=json.loads((P/'artifact-comparison.json').read_text()) +for k in ['directory_metadata_compared','directory_count_base','directory_count_candidate','directory_metadata_delta','final_changed_files','base_layers_preserved']:assert a[k]==b[k] +assert a['directory_metadata_compared'] and not a['directory_metadata_delta'] +(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all58_hashes_verified=True,all27_initial_archived_hashes_verified=True,changed_initial_paths=changed,image_context_source_workflow_runtime_scan_unchanged=True,new_source_tests_passed=3,directory_negative_mutations=3,optimized_tampered_before_read_refusal=True,existing_actual_archives_directory_reaudit=True,directory_count_base=a['directory_count_base'],directory_count_candidate=a['directory_count_candidate'],directory_metadata_delta={},native_actions=False),indent=2)+'\n') +print('Exact amended source and directory metadata readback pass.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json new file mode 100644 index 0000000..9d63407 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json @@ -0,0 +1,73 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "directory_metadata_compared": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json new file mode 100644 index 0000000..81b04ce --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json @@ -0,0 +1,42 @@ +{ + "owner": "informed-decision", + "scope": "exact local T05 source candidate only; no native go/publication or task completion", + "candidate_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "files": [ + { + "repo": "informed-decision", + "path": "workplans/ADHOC-2026-10-11.md", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/workplans/ADHOC-2026-10-11.md", + "original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8", + "staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22" + }, + { + "repo": "informed-decision", + "path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "original_sha256": null, + "staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "original_sha256": null, + "staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "original_sha256": null, + "staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c" + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py new file mode 100644 index 0000000..36291cd --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py @@ -0,0 +1,39 @@ +import pathlib,json,hashlib,copy,importlib.util,tarfile +S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json') +H=lambda b:hashlib.sha256(b).hexdigest() +assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66' +for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256'] +E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text()) +for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h +spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp) +a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36 +mutations=['appfile','keys','world','network','provider'] +for field in mutations: + c=copy.deepcopy(b) + if field=='appfile':c['app_file_sha256']['policy.py']='0'*64 + elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64 + elif field=='world':c['apk_world_sha256']='0'*64 + elif field=='network':c['network_accessed']=True + else:c['provider_or_customer_data_used']=True + try:cmp.compare(a,c) + except ValueError:pass + else:raise AssertionError(field) +# Read local image archives, source verifier operations are limited to these public local artifacts. +code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text") +exec(compile(code,'product-local-artifact-readback','exec'),{}) +proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']: + assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key] +# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline. +for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']: + with tarfile.open(S/'deploy/zlib-overlay'/n) as t: + signs=[x.name for x in t if x.name.startswith('.SIGN.')] + assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs + assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256'] +base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text()) +assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44 +assert base_scan['Metadata']['OS']==scan['Metadata']['OS'] +assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])] +container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container +result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False} +(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json new file mode 100644 index 0000000..2db5495 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json @@ -0,0 +1,69 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json new file mode 100644 index 0000000..d09a3fc --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json @@ -0,0 +1,21 @@ +{ + "manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "all27_staged_hashes_verified": true, + "evidence_hashes_verified": true, + "existing_source_tests": 4, + "existing_source_negative_mutations": 8, + "additional_product_negative_mutations": [ + "appfile", + "keys", + "world", + "network", + "provider" + ], + "saved_image_fs_and_layer_runtime_readback": true, + "sbom_only_zlib_delta": true, + "scan44_packages_zero_at_retained_db": true, + "signed_archive_named_key_matches_unchanged_baseline_truststore": true, + "signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.", + "native_actions": false, + "candidate_published": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md new file mode 100644 index 0000000..461d4d1 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md @@ -0,0 +1,74 @@ +# Bounded zlib candidate Product owner review + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact local zlib-only source candidate technical preparation +manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66 +comment: >- + Informed-decision intent requires human binding and preserved evidence; this + candidate changes only a native compression dependency while preserving + application authorization/presentation behavior. T08 review work record was + completed first. This is technical source agreement, not native go, publication + receipt, founder acceptance or T05 completion. +``` + +All27 staged hashes and retained evidence-file hashes independently verify. +Independent saved-image archive readback confirms all nine exact763 base diff_ids +as prefix, equal effective runtime configuration with only explicitly normalized +empty/false/null defaults, and final filesystem changes exactly +`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent. +Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL +and UID/GID10001 remain equal. Root build identity returns to10001:10001. +No service values, namespace, DB, customer data, config, PVC, schema, audience, +policy pins, protected helper or existing release journal is changed. + +Package/index bytes match pinned official HTTPS download hashes. Both signed +archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present +in unchanged baseline trust metadata. Retained actual maker apk verify success +against exact763 installed keys is the execution evidence; this review separately +checks archive signatures' metadata, bytes and trust identity, without claiming +a new signature-verification execution. Containerfile requires digest checks and +`apk verify` success before offline named-package upgrade; no allow-untrusted or +keys-dir override. Existing trusted keys are not replaced. +[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd) +defines integrity/signature checking and nonzero failure. +Upgrade selects only zlib from retained local signed index, disables network, +preupgrade and logging, and removes temporary public artifacts. + +Both full CycloneDX/Trivy artifacts independently show44 packages and only +zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM +CVE-2026-85091; candidate has zero findings at the retained same database +03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917. +No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning +and actual38 OS/6 Python detector coverage remain disclosed. This is bounded +scan improvement at that snapshot, not estate risk grading or future safety. +Local daemon image78bfdcc and saved OCI config625d are distinct disclosed +representations; neither is a published registry digest or native image proof. + +Four existing source tests pass, covering eight mutations; five additional Product +mutations of app source, trust keys, APK world, network and provider/data flags +refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt. +Retained four compression vectors/three malformed refusals/crypto/JWT/waitress +and ten installed purpose variants are local synthetic checks, not live PDP +or customer/native-data testing. No new container or native execution by reviewer. + +Workflow publishes only a source-bound candidate through existing admitted owner +registry capability after root source review/commit: exact40hex source revision, +fixed owner archive, four input hashes/contextc554, exact763 base, no-network +bounded build, unchanged runtime comparison and purpose checks before push. +It has no kubectl, Argo, DB/admin, namespace or runtime deployment action. +The workflow is unexecuted; source review does not attest CI credentials, actual +publication or published artifact equivalence. Root must retain actual CI/source +revision and registry descriptor/layer/config/package/signature/context readback, +then full published scan/SBOM and scoped candidate release preparation. Only +distinct exact informed-decision founder native approval followed by installedr1, +runtime/purpose and full-rescan proof can close T05. Future image-only rollback +to763 preserves latest DB; no historical snapshot restore. + +T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic +controller is implied. T04/c96 accepted outcome and original uncertain journals +remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted. +No new native authority, owner checkout write, credential/login, deployment or +customer-data access occurred in this review. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md new file mode 100644 index 0000000..b39c57f --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md @@ -0,0 +1,259 @@ +--- +id: INFD-WP-ADHOC-2026-10-11 +type: workplan +title: "Application-owner catalogue facts review" +domain: infotech +repo: informed-decision +status: finished +owner: codex +topic_slug: netkingdom +created: "2026-10-11" +updated: "2026-10-11" +flavor: planning +state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be" +--- + +## Review exact one-application catalogue facts + +```task +id: INFD-WP-ADHOC-2026-10-11-T01 +status: done +priority: medium +state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305" +``` + +Completed informed-decision application-owner source review under INTENT.md +Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10, +and Layer Placement. Read actual owner OIDC, requester and policy-request +code, governing Staff/PEP-shaped declaration, User Engine model, and existing +value-free native registration/Ingress/preflight receipts. Exact canonical +facts agree. Browser client is distinct from create-only requester. + +Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md. +Canonical facts SHA-256: +`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`. +Reviewed refined nine-file executor manifest SHA-256: +`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`. + +This task completes the application-facts source review only. It grants no +maintenance exception, native dry-run/apply/recovery, IAM permission, image +release or human disposition. Existing User Engine native acceptance work +remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is +created by this bounded review. No tests were needed for this evidence-only +review; no native, credential or login action occurred. + +## Independently review purpose overlay release preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T02 +status: done +priority: medium +``` + +Completed same-role informed-decision-owner technical review of frozen36-path +purpose release manifest SHA-256 +`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`. +All36 staged file hashes and exact source PolicyClient9d7 hash were verified. +Source candidates and captured candidate Deployment differ only in the image. +Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding; +T05 keeps its2026-10-18 follow-through. Actual published-image receipts and +sealed native read-only preflight support preparation, not native deployment. + +Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed +binding forms across register, replay, publish, annotate and revise. Each +refusal preserves every domain table, records a truthful invalid-decision +observation and leaves the same idempotency key reusable after restoring a +canonical enforcement response. These are synthetic source tests only. +Test: tests/test_purpose_owner_mutation_negatives.py. +Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json. +Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md. + +This bounded review grants no native backup/export/restore, image rollout, +credentials, login, human disposition or vulnerability acceptance. Existing +INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual +is created or claimed completed. Catalogue ACK/T01 remains unchanged. + +## Confirm amended purpose release custody and preflight gates + +```task +id: INFD-WP-ADHOC-2026-10-11-T03 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed amended78-path release manifest SHA-256 +`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`. +All78 file hashes verified, original36 archive retained, source PolicyClient9d7 +and both image-only source candidates unchanged. Prior50 source lifecycle +mutation/idempotency negatives remain applicable and were not repeated. + +Confirmed stdlib read-only schema5/integrity/count gate before ANY native or +restored Store/admin open, explicit local/remote optimized-interpreter refusal, +sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count +equality distinguished from legitimate concurrent live commits. Revised20-doc +184912-byte packet and01:39 read-only dry-run receipts remain preparation. +Native schema gate, backup/export/restore/release and founder disposition remain +unperformed; T04/T05 obligations and temporary vulnerability review persist. + +Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md. +Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/ +receipt remain unchanged. No new residual or authority is created by this review. + +## Reconcile Staff evidence source declaration and current guarantees + +```task +id: INFD-WP-ADHOC-2026-10-11-T04 +status: done +priority: medium +``` + +Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source +class definitions, transactional recording, heartbeat/reconciliation scheduling, +existing component-test assertions and native count/receipt evidence. Reconciled +stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening +finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending +NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual +source intake for remaining class-specific declaration/verification gaps, +origin INFD-WP-0007. No residual implementation or native action occurred. + +Source evidence reconciliation: +docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md. +Formal source review: +docs/reviews/2026-10-11-staff-evidence-source-owner-review.md. +Existing Staff/PEP-shaped classification, three load-bearing class classifications, +compromised-source and commitment/content availability limits remain unchanged. + +## Independently review supervised purpose actuator product boundaries + +```task +id: INFD-WP-ADHOC-2026-10-11-T05 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed exact23-path helper manifest +`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`, +all staged hashes and embedded source bundle/plan. Product evidence/schema5, +private snapshot custody, confined offline UID0 initialization followed by +UID10001 pre/post-admin verification, independent failed-candidate rollback +and all-phase start deadline are technically agreed as source preparation. + +No purpose-policy or candidate image change. Retained helper16 synthetic tests +and platform5 independent recovery negatives are mechanism proof; prior50 +product policy negatives remain applicable. No new test run was needed for this +unchanged-source review. Native-provider acceptance remains distinct from the +installed10 synthetic purpose forms; T04 is not complete. Before first human +post, amend exact20-document packet to hash-bind helper/plan, four render inputs, +initializer/recovery/deadline refinements and preserved full scan provenance. +Exact combined packet acknowledgement remains a separate review gate. + +Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md. +No native reads/backups/export/restore/release, credentials, human disposition, +founder approval or phase authority was exercised by this review. + +## Prepare separately gated provider-derived denial mechanism probe + +```task +id: INFD-WP-ADHOC-2026-10-11-T06 +status: done +priority: medium +``` + +Prepared source-only readonly lifecycle.search provider-derived mechanism probe +with truthful informed-decision/review SERVICE and no human/StateHub attributes. +Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a +canonical real DENY is required; no claims are invented to obtain ALLOW. +One actual provider response will remain in Pod memory; ten transformed +noncanonical purpose copies test installed consumer refusal without further +provider calls, DB/admin or act effects. This is a denial/binding mechanism +proof candidate, not actual authorized lifecycle or full T04 acceptance. + +Source: docs/evidence/2026-10-11-purpose-provider-probe/. +Ten synthetic source tests pass; no actual provider, credential, runtime config, +DB, native data or live action was accessed. Posted frozen112 packet/helper +remain unchanged. Exact separate founder go for this newly prepared probe and +its target must precede any execution; current memo has no acceptance and this +new helper is not hash-bound in that submitted packet. T04 remains progress. + +## Review exact existing-snapshot rescue version2 preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T07 +status: done +priority: medium +``` + +Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7 +under the same informed-decision-owner role. Actual original backupCOMPLETE/copy +UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1 +require fresh founder acceptance. Immutable reads are bounded to proven frozen +closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose. +Independent existing26 mocked tests plus41 subtests pass, and10 new product scope +guards pass (including eight refusal mutations and a frozen initial packet check). +No native command, DB open, credentials or rescue operation occurred. + +Initial review decision changes_requested: proposal.json misleadingly names old +f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed; +label it original/historical and refreeze all dependent packet hashes. Correct +current bundle/plan digests already exist. The normalized test fixture is not an +owner edit or approval. Initial review/failure must remain after correction; +exact amended confirmation is still required before newhuman submission/execution. + +Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md. +Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/. +T04 remains progress; original version1 approval is not newversion2 authority. + +**Amended source confirmation, same T07 trial:** exact134-path manifest +`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d` +corrects only the historical helper provenance label and dependent packet hashes; +original66 source and initial changes-requested review remain retained. Current +helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1 +and20documents validate:173469packetbytes/240451revisionbytes. Eight scope +mutations and three packet mutations independently refuse. Final technical +source acknowledgement approved; no new human acceptance or native rescue. +Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md. + + +**Actual-outcome assessment preparation, same completed T07 trial:** independently +verified original receipt-byte hashes and source consumer path after approved +source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover +backup/private copy matches live post-release counts16/56/0, delivered336, +confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001 +checks pass. Actual post-rollout authenticated provider-backed outcomes readback +is separate from installed ten synthetic purpose forms (2allow/8refuse). +Completed source-only assessment supports T04 done, T05 todo and WP0009 active. +Original failed copy and verifier UNCERTAIN remain preserved, with no replay or +helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission +handling correction; no implementation, native action or authority grant. +This work-record preparation precedes the formal actual-outcome review entry. +Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md. +Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/. + + +## Independently review bounded zlib-only T05 source candidate + +```task +id: INFD-WP-ADHOC-2026-10-11-T08 +status: done +priority: medium +``` + +Completed informed-decision Product source review of exact27-path candidate +manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66. +All staged/evidence hashes verify. Independently reread local saved base/candidate +image archives, effective runtime config, nine base layer prefix, two final file +changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs; +44 packages/base1MED to candidate0 at retained same scanner database. +Signed APK/index named key matches unchanged base trust metadata; enforced +apk verify against existing keys retained, no allow-untrusted or truststore override. +Four existing source tests pass (eight refusal mutations), plus five independent +appfile/trustkeys/world/network/provider metadata mutations refuse. +Purpose/backend checks remain local and synthetic, not actual PDP or data proof. +Technical source preparation agreement only: local image78bfdcc is unpublished, +T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and +new native founder approval/installed proof are still required. Current763/native +DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010 +is unpromoted/unimplemented. No native actions, credentials or owner source writes. +This completed work record is prepared before the formal review entry. +Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md. +Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json new file mode 100644 index 0000000..5548150 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json @@ -0,0 +1,20 @@ +{ + "exact_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8", + "all58_hashes_verified": true, + "all27_initial_archived_hashes_verified": true, + "changed_initial_paths": [ + "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py" + ], + "image_context_source_workflow_runtime_scan_unchanged": true, + "new_source_tests_passed": 3, + "directory_negative_mutations": 3, + "optimized_tampered_before_read_refusal": true, + "existing_actual_archives_directory_reaudit": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "native_actions": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py new file mode 100644 index 0000000..36291cd --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py @@ -0,0 +1,39 @@ +import pathlib,json,hashlib,copy,importlib.util,tarfile +S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json') +H=lambda b:hashlib.sha256(b).hexdigest() +assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66' +for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256'] +E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text()) +for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h +spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp) +a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36 +mutations=['appfile','keys','world','network','provider'] +for field in mutations: + c=copy.deepcopy(b) + if field=='appfile':c['app_file_sha256']['policy.py']='0'*64 + elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64 + elif field=='world':c['apk_world_sha256']='0'*64 + elif field=='network':c['network_accessed']=True + else:c['provider_or_customer_data_used']=True + try:cmp.compare(a,c) + except ValueError:pass + else:raise AssertionError(field) +# Read local image archives, source verifier operations are limited to these public local artifacts. +code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text") +exec(compile(code,'product-local-artifact-readback','exec'),{}) +proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']: + assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key] +# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline. +for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']: + with tarfile.open(S/'deploy/zlib-overlay'/n) as t: + signs=[x.name for x in t if x.name.startswith('.SIGN.')] + assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs + assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256'] +base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text()) +assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44 +assert base_scan['Metadata']['OS']==scan['Metadata']['OS'] +assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])] +container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container +result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False} +(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json new file mode 100644 index 0000000..2db5495 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json @@ -0,0 +1,69 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json new file mode 100644 index 0000000..d09a3fc --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json @@ -0,0 +1,21 @@ +{ + "manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "all27_staged_hashes_verified": true, + "evidence_hashes_verified": true, + "existing_source_tests": 4, + "existing_source_negative_mutations": 8, + "additional_product_negative_mutations": [ + "appfile", + "keys", + "world", + "network", + "provider" + ], + "saved_image_fs_and_layer_runtime_readback": true, + "sbom_only_zlib_delta": true, + "scan44_packages_zero_at_retained_db": true, + "signed_archive_named_key_matches_unchanged_baseline_truststore": true, + "signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.", + "native_actions": false, + "candidate_published": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md new file mode 100644 index 0000000..c100415 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md @@ -0,0 +1,55 @@ +# Exact amended zlib candidate Product confirmation + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact amended local T05 source candidate preparation only +manifest_sha256: 64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8 +comment: >- + Same completed T08 preparation trial: work-record refinement was prepared + before this formal exact acknowledgment. Initial Product agreement/manifest + 5f334 remains historical, including its bounded audit validation. This final + confirmation covers the guard refinement, not publication/native approval, + a second scored success or T05 completion. +``` + +All58 final staged hashes verify; all27 initial candidate snapshots match +immutable manifest8d345bb2. Actual initial-to-current diff changes only four +existing paths: artifact checker, its comparison and local-validation receipts, +and README. New audit tests/refinement record and original source archive are +additions. No Containerfile/workflow, signed APK/index/pins/four-file context, +package/runtime/backend/app/identity/policy artifact, scan/SBOM/DB or WP source +scope changed. Local daemon78bfdcc/config625d remain unpublished; source recipe +contextc554 and actual retained DB03cacb remain exact. Original four-source-test +and Product five negative-probe findings remain applicable, not needlessly rerun. + +The artifact checker now refuses optimized Python before any archive/JSON read, +so assertions cannot silently disappear. Directory mode/UID/GID metadata is +included in final layer reconstruction and diff enforcement. Three new source +tests pass: malformed archive under -O refuses explicitly before reads; identical +directory metadata passes; each mode/UID/GID mutation refuses without a report. +These fixtures are isolated synthetic source tests. Independent reread of actual +existing local saved-image archives confirms equal directory counts and no +directory metadata delta; the same two final changed files are libz and APK DB, +nine base layers remain prefix and effective runtime config/SBOM/scan match. +No new image build, container launch, scan, customer/native data or provider call +was performed by this review. + +Initial Product review and validation retain their exact bytes under +`docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/`; +original current review file remains the initial agreement, with this separate +final acknowledgment carrying the refinement. Signature trust conclusions stay +bounded to pinned signed artifacts/unchanged trust metadata, actual retained +maker apk verify and enforced recipe; this acknowledgment does not claim fresh +cryptographic execution. Zero findings remains specific to retained sameDB scan, +not an estate risk grade or future safety assurance. + +T05 remains progress, WP0009 active and manual follow-up due2026-10-18. Root +source review/commit and admitted owner CI candidate publication, exact actual +published registry provenance/package/full scan/SBOM, separate fresh native +founder release acceptance and installedr1/runtime/full-rescan proof remain +required. Existing approved R2 helper/journal, native image763, DB/config/PVC/ +identity and T04/c96 outcome are unchanged. INFD-IN-0010 remains unpromoted and +unimplemented. This technical acknowledgment grants no native action, human +acceptance, credential capability or publication execution. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md new file mode 100644 index 0000000..461d4d1 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md @@ -0,0 +1,74 @@ +# Bounded zlib candidate Product owner review + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact local zlib-only source candidate technical preparation +manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66 +comment: >- + Informed-decision intent requires human binding and preserved evidence; this + candidate changes only a native compression dependency while preserving + application authorization/presentation behavior. T08 review work record was + completed first. This is technical source agreement, not native go, publication + receipt, founder acceptance or T05 completion. +``` + +All27 staged hashes and retained evidence-file hashes independently verify. +Independent saved-image archive readback confirms all nine exact763 base diff_ids +as prefix, equal effective runtime configuration with only explicitly normalized +empty/false/null defaults, and final filesystem changes exactly +`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent. +Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL +and UID/GID10001 remain equal. Root build identity returns to10001:10001. +No service values, namespace, DB, customer data, config, PVC, schema, audience, +policy pins, protected helper or existing release journal is changed. + +Package/index bytes match pinned official HTTPS download hashes. Both signed +archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present +in unchanged baseline trust metadata. Retained actual maker apk verify success +against exact763 installed keys is the execution evidence; this review separately +checks archive signatures' metadata, bytes and trust identity, without claiming +a new signature-verification execution. Containerfile requires digest checks and +`apk verify` success before offline named-package upgrade; no allow-untrusted or +keys-dir override. Existing trusted keys are not replaced. +[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd) +defines integrity/signature checking and nonzero failure. +Upgrade selects only zlib from retained local signed index, disables network, +preupgrade and logging, and removes temporary public artifacts. + +Both full CycloneDX/Trivy artifacts independently show44 packages and only +zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM +CVE-2026-85091; candidate has zero findings at the retained same database +03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917. +No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning +and actual38 OS/6 Python detector coverage remain disclosed. This is bounded +scan improvement at that snapshot, not estate risk grading or future safety. +Local daemon image78bfdcc and saved OCI config625d are distinct disclosed +representations; neither is a published registry digest or native image proof. + +Four existing source tests pass, covering eight mutations; five additional Product +mutations of app source, trust keys, APK world, network and provider/data flags +refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt. +Retained four compression vectors/three malformed refusals/crypto/JWT/waitress +and ten installed purpose variants are local synthetic checks, not live PDP +or customer/native-data testing. No new container or native execution by reviewer. + +Workflow publishes only a source-bound candidate through existing admitted owner +registry capability after root source review/commit: exact40hex source revision, +fixed owner archive, four input hashes/contextc554, exact763 base, no-network +bounded build, unchanged runtime comparison and purpose checks before push. +It has no kubectl, Argo, DB/admin, namespace or runtime deployment action. +The workflow is unexecuted; source review does not attest CI credentials, actual +publication or published artifact equivalence. Root must retain actual CI/source +revision and registry descriptor/layer/config/package/signature/context readback, +then full published scan/SBOM and scoped candidate release preparation. Only +distinct exact informed-decision founder native approval followed by installedr1, +runtime/purpose and full-rescan proof can close T05. Future image-only rollback +to763 preserves latest DB; no historical snapshot restore. + +T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic +controller is implied. T04/c96 accepted outcome and original uncertain journals +remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted. +No new native authority, owner checkout write, credential/login, deployment or +customer-data access occurred in this review. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md new file mode 100644 index 0000000..c139962 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md @@ -0,0 +1,273 @@ +--- +id: INFD-WP-ADHOC-2026-10-11 +type: workplan +title: "Application-owner catalogue facts review" +domain: infotech +repo: informed-decision +status: finished +owner: codex +topic_slug: netkingdom +created: "2026-10-11" +updated: "2026-10-11" +flavor: planning +state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be" +--- + +## Review exact one-application catalogue facts + +```task +id: INFD-WP-ADHOC-2026-10-11-T01 +status: done +priority: medium +state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305" +``` + +Completed informed-decision application-owner source review under INTENT.md +Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10, +and Layer Placement. Read actual owner OIDC, requester and policy-request +code, governing Staff/PEP-shaped declaration, User Engine model, and existing +value-free native registration/Ingress/preflight receipts. Exact canonical +facts agree. Browser client is distinct from create-only requester. + +Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md. +Canonical facts SHA-256: +`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`. +Reviewed refined nine-file executor manifest SHA-256: +`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`. + +This task completes the application-facts source review only. It grants no +maintenance exception, native dry-run/apply/recovery, IAM permission, image +release or human disposition. Existing User Engine native acceptance work +remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is +created by this bounded review. No tests were needed for this evidence-only +review; no native, credential or login action occurred. + +## Independently review purpose overlay release preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T02 +status: done +priority: medium +``` + +Completed same-role informed-decision-owner technical review of frozen36-path +purpose release manifest SHA-256 +`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`. +All36 staged file hashes and exact source PolicyClient9d7 hash were verified. +Source candidates and captured candidate Deployment differ only in the image. +Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding; +T05 keeps its2026-10-18 follow-through. Actual published-image receipts and +sealed native read-only preflight support preparation, not native deployment. + +Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed +binding forms across register, replay, publish, annotate and revise. Each +refusal preserves every domain table, records a truthful invalid-decision +observation and leaves the same idempotency key reusable after restoring a +canonical enforcement response. These are synthetic source tests only. +Test: tests/test_purpose_owner_mutation_negatives.py. +Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json. +Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md. + +This bounded review grants no native backup/export/restore, image rollout, +credentials, login, human disposition or vulnerability acceptance. Existing +INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual +is created or claimed completed. Catalogue ACK/T01 remains unchanged. + +## Confirm amended purpose release custody and preflight gates + +```task +id: INFD-WP-ADHOC-2026-10-11-T03 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed amended78-path release manifest SHA-256 +`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`. +All78 file hashes verified, original36 archive retained, source PolicyClient9d7 +and both image-only source candidates unchanged. Prior50 source lifecycle +mutation/idempotency negatives remain applicable and were not repeated. + +Confirmed stdlib read-only schema5/integrity/count gate before ANY native or +restored Store/admin open, explicit local/remote optimized-interpreter refusal, +sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count +equality distinguished from legitimate concurrent live commits. Revised20-doc +184912-byte packet and01:39 read-only dry-run receipts remain preparation. +Native schema gate, backup/export/restore/release and founder disposition remain +unperformed; T04/T05 obligations and temporary vulnerability review persist. + +Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md. +Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/ +receipt remain unchanged. No new residual or authority is created by this review. + +## Reconcile Staff evidence source declaration and current guarantees + +```task +id: INFD-WP-ADHOC-2026-10-11-T04 +status: done +priority: medium +``` + +Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source +class definitions, transactional recording, heartbeat/reconciliation scheduling, +existing component-test assertions and native count/receipt evidence. Reconciled +stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening +finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending +NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual +source intake for remaining class-specific declaration/verification gaps, +origin INFD-WP-0007. No residual implementation or native action occurred. + +Source evidence reconciliation: +docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md. +Formal source review: +docs/reviews/2026-10-11-staff-evidence-source-owner-review.md. +Existing Staff/PEP-shaped classification, three load-bearing class classifications, +compromised-source and commitment/content availability limits remain unchanged. + +## Independently review supervised purpose actuator product boundaries + +```task +id: INFD-WP-ADHOC-2026-10-11-T05 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed exact23-path helper manifest +`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`, +all staged hashes and embedded source bundle/plan. Product evidence/schema5, +private snapshot custody, confined offline UID0 initialization followed by +UID10001 pre/post-admin verification, independent failed-candidate rollback +and all-phase start deadline are technically agreed as source preparation. + +No purpose-policy or candidate image change. Retained helper16 synthetic tests +and platform5 independent recovery negatives are mechanism proof; prior50 +product policy negatives remain applicable. No new test run was needed for this +unchanged-source review. Native-provider acceptance remains distinct from the +installed10 synthetic purpose forms; T04 is not complete. Before first human +post, amend exact20-document packet to hash-bind helper/plan, four render inputs, +initializer/recovery/deadline refinements and preserved full scan provenance. +Exact combined packet acknowledgement remains a separate review gate. + +Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md. +No native reads/backups/export/restore/release, credentials, human disposition, +founder approval or phase authority was exercised by this review. + +## Prepare separately gated provider-derived denial mechanism probe + +```task +id: INFD-WP-ADHOC-2026-10-11-T06 +status: done +priority: medium +``` + +Prepared source-only readonly lifecycle.search provider-derived mechanism probe +with truthful informed-decision/review SERVICE and no human/StateHub attributes. +Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a +canonical real DENY is required; no claims are invented to obtain ALLOW. +One actual provider response will remain in Pod memory; ten transformed +noncanonical purpose copies test installed consumer refusal without further +provider calls, DB/admin or act effects. This is a denial/binding mechanism +proof candidate, not actual authorized lifecycle or full T04 acceptance. + +Source: docs/evidence/2026-10-11-purpose-provider-probe/. +Ten synthetic source tests pass; no actual provider, credential, runtime config, +DB, native data or live action was accessed. Posted frozen112 packet/helper +remain unchanged. Exact separate founder go for this newly prepared probe and +its target must precede any execution; current memo has no acceptance and this +new helper is not hash-bound in that submitted packet. T04 remains progress. + +## Review exact existing-snapshot rescue version2 preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T07 +status: done +priority: medium +``` + +Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7 +under the same informed-decision-owner role. Actual original backupCOMPLETE/copy +UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1 +require fresh founder acceptance. Immutable reads are bounded to proven frozen +closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose. +Independent existing26 mocked tests plus41 subtests pass, and10 new product scope +guards pass (including eight refusal mutations and a frozen initial packet check). +No native command, DB open, credentials or rescue operation occurred. + +Initial review decision changes_requested: proposal.json misleadingly names old +f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed; +label it original/historical and refreeze all dependent packet hashes. Correct +current bundle/plan digests already exist. The normalized test fixture is not an +owner edit or approval. Initial review/failure must remain after correction; +exact amended confirmation is still required before newhuman submission/execution. + +Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md. +Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/. +T04 remains progress; original version1 approval is not newversion2 authority. + +**Amended source confirmation, same T07 trial:** exact134-path manifest +`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d` +corrects only the historical helper provenance label and dependent packet hashes; +original66 source and initial changes-requested review remain retained. Current +helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1 +and20documents validate:173469packetbytes/240451revisionbytes. Eight scope +mutations and three packet mutations independently refuse. Final technical +source acknowledgement approved; no new human acceptance or native rescue. +Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md. + + +**Actual-outcome assessment preparation, same completed T07 trial:** independently +verified original receipt-byte hashes and source consumer path after approved +source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover +backup/private copy matches live post-release counts16/56/0, delivered336, +confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001 +checks pass. Actual post-rollout authenticated provider-backed outcomes readback +is separate from installed ten synthetic purpose forms (2allow/8refuse). +Completed source-only assessment supports T04 done, T05 todo and WP0009 active. +Original failed copy and verifier UNCERTAIN remain preserved, with no replay or +helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission +handling correction; no implementation, native action or authority grant. +This work-record preparation precedes the formal actual-outcome review entry. +Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md. +Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/. + + +## Independently review bounded zlib-only T05 source candidate + +```task +id: INFD-WP-ADHOC-2026-10-11-T08 +status: done +priority: medium +``` + +Completed informed-decision Product source review of exact27-path candidate +manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66. +All staged/evidence hashes verify. Independently reread local saved base/candidate +image archives, effective runtime config, nine base layer prefix, two final file +changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs; +44 packages/base1MED to candidate0 at retained same scanner database. +Signed APK/index named key matches unchanged base trust metadata; enforced +apk verify against existing keys retained, no allow-untrusted or truststore override. +Four existing source tests pass (eight refusal mutations), plus five independent +appfile/trustkeys/world/network/provider metadata mutations refuse. +Purpose/backend checks remain local and synthetic, not actual PDP or data proof. +Technical source preparation agreement only: local image78bfdcc is unpublished, +T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and +new native founder approval/installed proof are still required. Current763/native +DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010 +is unpromoted/unimplemented. No native actions, credentials or owner source writes. +This completed work record is prepared before the formal review entry. +Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md. +Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/. + + +**Exact amended confirmation, same completed T08 preparation trial:** verified +final58-path candidate manifest64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8 +and immutable archived initial27 hashes. Only artifact-audit source/receipts/docs +change; recipe/workflow/four build inputs/image78bfdcc/config625d/runtime/scan/DB +remain identical. New3 artifact tests pass (optimized malformed input refused +before reads; matching directories pass; directory mode/UID/GID drift refuse). +Independent actual saved-image reread proves all directory metadata unchanged, +with the same two final file changes. Initial Product manifest5f334/ack/validation +are retained as historical source agreement, not new scored native success. +This work-record refinement precedes final formal acknowledgment. No publication, +native operation, credentials or owner edits. T05progress/WP0009active remains. +Confirmation: docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json new file mode 100644 index 0000000..dd4bb80 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json @@ -0,0 +1,24 @@ +[ + { + "marker": "usr/.wh..wh..opq", + "same_layer_new": "usr/new", + "actual_names": [ + "usr" + ], + "same_layer_new_preserved": false + }, + { + "marker": ".wh..wh..opq", + "same_layer_new": "new", + "actual_names": [], + "same_layer_new_preserved": false + }, + { + "marker": "usr/.wh.child", + "same_layer_new": "usr/child/new", + "actual_names": [ + "usr" + ], + "same_layer_new_preserved": false + } +] diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py new file mode 100644 index 0000000..80d2197 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py @@ -0,0 +1,23 @@ +import ast,tarfile,io,json,hashlib,tempfile +from pathlib import Path +P=Path(__file__).parent +ns={'Path':Path,'tarfile':tarfile,'json':json,'hashlib':hashlib};tree=ast.parse((P/'frozen66-verify_local_artifacts.py').read_text());fn=next(x for x in tree.body if isinstance(x,ast.FunctionDef) and x.name=='image');exec(compile(ast.Module(body=[fn],type_ignores=[]),'reader','exec'),ns) +def add(t,name,data): + m=tarfile.TarInfo(name);m.mode=0o755 + if data is None:m.type=tarfile.DIRTYPE;t.addfile(m) + else:m.size=len(data);t.addfile(m,io.BytesIO(data)) +def layer(entries): + b=io.BytesIO() + with tarfile.open(fileobj=b,mode='w') as t: + for name,data in entries:add(t,name,data) + return b.getvalue() +results=[] +for marker,new in [('usr/.wh..wh..opq','usr/new'),('.wh..wh..opq','new'),('usr/.wh.child','usr/child/new')]: + base=layer([('usr',None),('usr/child',None),('usr/child/old',b'old')]);over=layer([(new,b'new'),(marker,b'')]) + with tempfile.TemporaryDirectory() as tmp: + path=Path(tmp)/'image.tar' + with tarfile.open(path,'w') as t: + add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':['base.tar','over.tar']}]).encode());add(t,'config.json',json.dumps({'config':{},'rootfs':{'diff_ids':['base','over']}}).encode());add(t,'base.tar',base);add(t,'over.tar',over) + _,_,files=ns['image'](path);results.append(dict(marker=marker,same_layer_new=new,actual_names=sorted(files),same_layer_new_preserved=new in files)) +print(json.dumps(results,indent=2)) +assert all(not r['same_layer_new_preserved'] for r in results),'finding no longer reproduced' diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md new file mode 100644 index 0000000..c100415 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md @@ -0,0 +1,55 @@ +# Exact amended zlib candidate Product confirmation + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact amended local T05 source candidate preparation only +manifest_sha256: 64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8 +comment: >- + Same completed T08 preparation trial: work-record refinement was prepared + before this formal exact acknowledgment. Initial Product agreement/manifest + 5f334 remains historical, including its bounded audit validation. This final + confirmation covers the guard refinement, not publication/native approval, + a second scored success or T05 completion. +``` + +All58 final staged hashes verify; all27 initial candidate snapshots match +immutable manifest8d345bb2. Actual initial-to-current diff changes only four +existing paths: artifact checker, its comparison and local-validation receipts, +and README. New audit tests/refinement record and original source archive are +additions. No Containerfile/workflow, signed APK/index/pins/four-file context, +package/runtime/backend/app/identity/policy artifact, scan/SBOM/DB or WP source +scope changed. Local daemon78bfdcc/config625d remain unpublished; source recipe +contextc554 and actual retained DB03cacb remain exact. Original four-source-test +and Product five negative-probe findings remain applicable, not needlessly rerun. + +The artifact checker now refuses optimized Python before any archive/JSON read, +so assertions cannot silently disappear. Directory mode/UID/GID metadata is +included in final layer reconstruction and diff enforcement. Three new source +tests pass: malformed archive under -O refuses explicitly before reads; identical +directory metadata passes; each mode/UID/GID mutation refuses without a report. +These fixtures are isolated synthetic source tests. Independent reread of actual +existing local saved-image archives confirms equal directory counts and no +directory metadata delta; the same two final changed files are libz and APK DB, +nine base layers remain prefix and effective runtime config/SBOM/scan match. +No new image build, container launch, scan, customer/native data or provider call +was performed by this review. + +Initial Product review and validation retain their exact bytes under +`docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/`; +original current review file remains the initial agreement, with this separate +final acknowledgment carrying the refinement. Signature trust conclusions stay +bounded to pinned signed artifacts/unchanged trust metadata, actual retained +maker apk verify and enforced recipe; this acknowledgment does not claim fresh +cryptographic execution. Zero findings remains specific to retained sameDB scan, +not an estate risk grade or future safety assurance. + +T05 remains progress, WP0009 active and manual follow-up due2026-10-18. Root +source review/commit and admitted owner CI candidate publication, exact actual +published registry provenance/package/full scan/SBOM, separate fresh native +founder release acceptance and installedr1/runtime/full-rescan proof remain +required. Existing approved R2 helper/journal, native image763, DB/config/PVC/ +identity and T04/c96 outcome are unchanged. INFD-IN-0010 remains unpromoted and +unimplemented. This technical acknowledgment grants no native action, human +acceptance, credential capability or publication execution. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md new file mode 100644 index 0000000..461d4d1 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md @@ -0,0 +1,74 @@ +# Bounded zlib candidate Product owner review + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact local zlib-only source candidate technical preparation +manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66 +comment: >- + Informed-decision intent requires human binding and preserved evidence; this + candidate changes only a native compression dependency while preserving + application authorization/presentation behavior. T08 review work record was + completed first. This is technical source agreement, not native go, publication + receipt, founder acceptance or T05 completion. +``` + +All27 staged hashes and retained evidence-file hashes independently verify. +Independent saved-image archive readback confirms all nine exact763 base diff_ids +as prefix, equal effective runtime configuration with only explicitly normalized +empty/false/null defaults, and final filesystem changes exactly +`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent. +Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL +and UID/GID10001 remain equal. Root build identity returns to10001:10001. +No service values, namespace, DB, customer data, config, PVC, schema, audience, +policy pins, protected helper or existing release journal is changed. + +Package/index bytes match pinned official HTTPS download hashes. Both signed +archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present +in unchanged baseline trust metadata. Retained actual maker apk verify success +against exact763 installed keys is the execution evidence; this review separately +checks archive signatures' metadata, bytes and trust identity, without claiming +a new signature-verification execution. Containerfile requires digest checks and +`apk verify` success before offline named-package upgrade; no allow-untrusted or +keys-dir override. Existing trusted keys are not replaced. +[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd) +defines integrity/signature checking and nonzero failure. +Upgrade selects only zlib from retained local signed index, disables network, +preupgrade and logging, and removes temporary public artifacts. + +Both full CycloneDX/Trivy artifacts independently show44 packages and only +zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM +CVE-2026-85091; candidate has zero findings at the retained same database +03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917. +No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning +and actual38 OS/6 Python detector coverage remain disclosed. This is bounded +scan improvement at that snapshot, not estate risk grading or future safety. +Local daemon image78bfdcc and saved OCI config625d are distinct disclosed +representations; neither is a published registry digest or native image proof. + +Four existing source tests pass, covering eight mutations; five additional Product +mutations of app source, trust keys, APK world, network and provider/data flags +refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt. +Retained four compression vectors/three malformed refusals/crypto/JWT/waitress +and ten installed purpose variants are local synthetic checks, not live PDP +or customer/native-data testing. No new container or native execution by reviewer. + +Workflow publishes only a source-bound candidate through existing admitted owner +registry capability after root source review/commit: exact40hex source revision, +fixed owner archive, four input hashes/contextc554, exact763 base, no-network +bounded build, unchanged runtime comparison and purpose checks before push. +It has no kubectl, Argo, DB/admin, namespace or runtime deployment action. +The workflow is unexecuted; source review does not attest CI credentials, actual +publication or published artifact equivalence. Root must retain actual CI/source +revision and registry descriptor/layer/config/package/signature/context readback, +then full published scan/SBOM and scoped candidate release preparation. Only +distinct exact informed-decision founder native approval followed by installedr1, +runtime/purpose and full-rescan proof can close T05. Future image-only rollback +to763 preserves latest DB; no historical snapshot restore. + +T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic +controller is implied. T04/c96 accepted outcome and original uncertain journals +remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted. +No new native authority, owner checkout write, credential/login, deployment or +customer-data access occurred in this review. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md new file mode 100644 index 0000000..bad854b --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md @@ -0,0 +1,37 @@ +# Exact66 zlib audit whiteout Product finding + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: changes_requested +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact66 local candidate artifact-audit source refinement +manifest_sha256: 3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0 +comment: >- + Same completed T08; work record prepared before this formal finding. + No actual candidate-image failure or new scored/native trial. Preserve + initial5f334 and intermediate8bc6 acknowledgments as historical. +``` + +All66 staged hashes independently verify. Whiteout leading-dot and root opaque +handling corrections address the prior cases, but remaining stream-order behavior +violates the lower-layer boundary. A synthetic parent layer contains usr/child/old; +next layer writes a new file before its whiteout marker. Three retained isolated +probes reproduce incorrect deletion: usr/new then usr/.wh..wh..opq, root new then +.wh..wh..opq, and usr/child/new then usr/.wh.child. Actual parsed sets lose the +same-layer new file in every case. Frozen checker/manifest and reproducible +probe/receipt are retained under docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/. + +[OCI layer specification](https://github.com/opencontainers/image-spec/blob/main/layer.md) +requires whiteouts to affect only parent layers and opacity to precede new entries +regardless archive ordering. Correct reconstruction should apply whiteouts to +the prior layer state and then merge current layer additions, preserving both +marker-before and marker-after order semantics. Add meaningful root/nested opaque +and explicit-directory removal cases with same-layer children/replacements. +The existing four no-new-sibling cases cannot establish this boundary. + +This finding is confined to audit-source semantics, not APK trust or actual image +contents/build/scan. Current actual candidate image/context/package/workflow/ +runtime and scanner evidence remain unchanged; no native/read-only command or +customer/DB/credential access occurred. T05 remains progress/WP0009 active; +publication and distinct founder native release/installed proof remain pending. +A corrected exact frozen packet needs final technical confirmation. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/workplans/ADHOC-2026-10-11.md b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/workplans/ADHOC-2026-10-11.md new file mode 100644 index 0000000..1e6f0bf --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/owner-snapshot/workplans/ADHOC-2026-10-11.md @@ -0,0 +1,288 @@ +--- +id: INFD-WP-ADHOC-2026-10-11 +type: workplan +title: "Application-owner catalogue facts review" +domain: infotech +repo: informed-decision +status: finished +owner: codex +topic_slug: netkingdom +created: "2026-10-11" +updated: "2026-10-11" +flavor: planning +state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be" +--- + +## Review exact one-application catalogue facts + +```task +id: INFD-WP-ADHOC-2026-10-11-T01 +status: done +priority: medium +state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305" +``` + +Completed informed-decision application-owner source review under INTENT.md +Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10, +and Layer Placement. Read actual owner OIDC, requester and policy-request +code, governing Staff/PEP-shaped declaration, User Engine model, and existing +value-free native registration/Ingress/preflight receipts. Exact canonical +facts agree. Browser client is distinct from create-only requester. + +Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md. +Canonical facts SHA-256: +`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`. +Reviewed refined nine-file executor manifest SHA-256: +`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`. + +This task completes the application-facts source review only. It grants no +maintenance exception, native dry-run/apply/recovery, IAM permission, image +release or human disposition. Existing User Engine native acceptance work +remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is +created by this bounded review. No tests were needed for this evidence-only +review; no native, credential or login action occurred. + +## Independently review purpose overlay release preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T02 +status: done +priority: medium +``` + +Completed same-role informed-decision-owner technical review of frozen36-path +purpose release manifest SHA-256 +`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`. +All36 staged file hashes and exact source PolicyClient9d7 hash were verified. +Source candidates and captured candidate Deployment differ only in the image. +Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding; +T05 keeps its2026-10-18 follow-through. Actual published-image receipts and +sealed native read-only preflight support preparation, not native deployment. + +Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed +binding forms across register, replay, publish, annotate and revise. Each +refusal preserves every domain table, records a truthful invalid-decision +observation and leaves the same idempotency key reusable after restoring a +canonical enforcement response. These are synthetic source tests only. +Test: tests/test_purpose_owner_mutation_negatives.py. +Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json. +Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md. + +This bounded review grants no native backup/export/restore, image rollout, +credentials, login, human disposition or vulnerability acceptance. Existing +INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual +is created or claimed completed. Catalogue ACK/T01 remains unchanged. + +## Confirm amended purpose release custody and preflight gates + +```task +id: INFD-WP-ADHOC-2026-10-11-T03 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed amended78-path release manifest SHA-256 +`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`. +All78 file hashes verified, original36 archive retained, source PolicyClient9d7 +and both image-only source candidates unchanged. Prior50 source lifecycle +mutation/idempotency negatives remain applicable and were not repeated. + +Confirmed stdlib read-only schema5/integrity/count gate before ANY native or +restored Store/admin open, explicit local/remote optimized-interpreter refusal, +sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count +equality distinguished from legitimate concurrent live commits. Revised20-doc +184912-byte packet and01:39 read-only dry-run receipts remain preparation. +Native schema gate, backup/export/restore/release and founder disposition remain +unperformed; T04/T05 obligations and temporary vulnerability review persist. + +Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md. +Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/ +receipt remain unchanged. No new residual or authority is created by this review. + +## Reconcile Staff evidence source declaration and current guarantees + +```task +id: INFD-WP-ADHOC-2026-10-11-T04 +status: done +priority: medium +``` + +Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source +class definitions, transactional recording, heartbeat/reconciliation scheduling, +existing component-test assertions and native count/receipt evidence. Reconciled +stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening +finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending +NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual +source intake for remaining class-specific declaration/verification gaps, +origin INFD-WP-0007. No residual implementation or native action occurred. + +Source evidence reconciliation: +docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md. +Formal source review: +docs/reviews/2026-10-11-staff-evidence-source-owner-review.md. +Existing Staff/PEP-shaped classification, three load-bearing class classifications, +compromised-source and commitment/content availability limits remain unchanged. + +## Independently review supervised purpose actuator product boundaries + +```task +id: INFD-WP-ADHOC-2026-10-11-T05 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed exact23-path helper manifest +`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`, +all staged hashes and embedded source bundle/plan. Product evidence/schema5, +private snapshot custody, confined offline UID0 initialization followed by +UID10001 pre/post-admin verification, independent failed-candidate rollback +and all-phase start deadline are technically agreed as source preparation. + +No purpose-policy or candidate image change. Retained helper16 synthetic tests +and platform5 independent recovery negatives are mechanism proof; prior50 +product policy negatives remain applicable. No new test run was needed for this +unchanged-source review. Native-provider acceptance remains distinct from the +installed10 synthetic purpose forms; T04 is not complete. Before first human +post, amend exact20-document packet to hash-bind helper/plan, four render inputs, +initializer/recovery/deadline refinements and preserved full scan provenance. +Exact combined packet acknowledgement remains a separate review gate. + +Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md. +No native reads/backups/export/restore/release, credentials, human disposition, +founder approval or phase authority was exercised by this review. + +## Prepare separately gated provider-derived denial mechanism probe + +```task +id: INFD-WP-ADHOC-2026-10-11-T06 +status: done +priority: medium +``` + +Prepared source-only readonly lifecycle.search provider-derived mechanism probe +with truthful informed-decision/review SERVICE and no human/StateHub attributes. +Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a +canonical real DENY is required; no claims are invented to obtain ALLOW. +One actual provider response will remain in Pod memory; ten transformed +noncanonical purpose copies test installed consumer refusal without further +provider calls, DB/admin or act effects. This is a denial/binding mechanism +proof candidate, not actual authorized lifecycle or full T04 acceptance. + +Source: docs/evidence/2026-10-11-purpose-provider-probe/. +Ten synthetic source tests pass; no actual provider, credential, runtime config, +DB, native data or live action was accessed. Posted frozen112 packet/helper +remain unchanged. Exact separate founder go for this newly prepared probe and +its target must precede any execution; current memo has no acceptance and this +new helper is not hash-bound in that submitted packet. T04 remains progress. + +## Review exact existing-snapshot rescue version2 preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T07 +status: done +priority: medium +``` + +Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7 +under the same informed-decision-owner role. Actual original backupCOMPLETE/copy +UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1 +require fresh founder acceptance. Immutable reads are bounded to proven frozen +closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose. +Independent existing26 mocked tests plus41 subtests pass, and10 new product scope +guards pass (including eight refusal mutations and a frozen initial packet check). +No native command, DB open, credentials or rescue operation occurred. + +Initial review decision changes_requested: proposal.json misleadingly names old +f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed; +label it original/historical and refreeze all dependent packet hashes. Correct +current bundle/plan digests already exist. The normalized test fixture is not an +owner edit or approval. Initial review/failure must remain after correction; +exact amended confirmation is still required before newhuman submission/execution. + +Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md. +Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/. +T04 remains progress; original version1 approval is not newversion2 authority. + +**Amended source confirmation, same T07 trial:** exact134-path manifest +`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d` +corrects only the historical helper provenance label and dependent packet hashes; +original66 source and initial changes-requested review remain retained. Current +helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1 +and20documents validate:173469packetbytes/240451revisionbytes. Eight scope +mutations and three packet mutations independently refuse. Final technical +source acknowledgement approved; no new human acceptance or native rescue. +Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md. + + +**Actual-outcome assessment preparation, same completed T07 trial:** independently +verified original receipt-byte hashes and source consumer path after approved +source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover +backup/private copy matches live post-release counts16/56/0, delivered336, +confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001 +checks pass. Actual post-rollout authenticated provider-backed outcomes readback +is separate from installed ten synthetic purpose forms (2allow/8refuse). +Completed source-only assessment supports T04 done, T05 todo and WP0009 active. +Original failed copy and verifier UNCERTAIN remain preserved, with no replay or +helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission +handling correction; no implementation, native action or authority grant. +This work-record preparation precedes the formal actual-outcome review entry. +Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md. +Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/. + + +## Independently review bounded zlib-only T05 source candidate + +```task +id: INFD-WP-ADHOC-2026-10-11-T08 +status: done +priority: medium +``` + +Completed informed-decision Product source review of exact27-path candidate +manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66. +All staged/evidence hashes verify. Independently reread local saved base/candidate +image archives, effective runtime config, nine base layer prefix, two final file +changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs; +44 packages/base1MED to candidate0 at retained same scanner database. +Signed APK/index named key matches unchanged base trust metadata; enforced +apk verify against existing keys retained, no allow-untrusted or truststore override. +Four existing source tests pass (eight refusal mutations), plus five independent +appfile/trustkeys/world/network/provider metadata mutations refuse. +Purpose/backend checks remain local and synthetic, not actual PDP or data proof. +Technical source preparation agreement only: local image78bfdcc is unpublished, +T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and +new native founder approval/installed proof are still required. Current763/native +DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010 +is unpromoted/unimplemented. No native actions, credentials or owner source writes. +This completed work record is prepared before the formal review entry. +Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md. +Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/. + + +**Exact amended confirmation, same completed T08 preparation trial:** verified +final58-path candidate manifest64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8 +and immutable archived initial27 hashes. Only artifact-audit source/receipts/docs +change; recipe/workflow/four build inputs/image78bfdcc/config625d/runtime/scan/DB +remain identical. New3 artifact tests pass (optimized malformed input refused +before reads; matching directories pass; directory mode/UID/GID drift refuse). +Independent actual saved-image reread proves all directory metadata unchanged, +with the same two final file changes. Initial Product manifest5f334/ack/validation +are retained as historical source agreement, not new scored native success. +This work-record refinement precedes final formal acknowledgment. No publication, +native operation, credentials or owner edits. T05progress/WP0009active remains. +Confirmation: docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md. + + +**Exact66 whiteout follow-through, same completed T08 preparation:** independently +verified manifest3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0 +and all66 hashes. New source correction preserves leading whiteout dots/root +parent handling, but three Product synthetic probes find same-layer new files +incorrectly removed by subsequent nested/root opaque or explicit descendant +whiteouts. OCI requires whiteouts affect only lower layers and preserve same-layer +additions regardless archive order. Completed source assessment changes_requested +before formal entry: apply whiteouts only previous layers then merge current +layer additions, with both archive orders covered. No actual candidate failure +or image/sourcecontext/scan change is inferred. Initial5f334 and intermediate +8bc6 reviews/evidence remain historical, not rewritten; same T08/no new trial. +No owner edits, native operation, publication or credentials. +Review: docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/check_final74.py b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/check_final74.py new file mode 100644 index 0000000..2c3e23b --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/check_final74.py @@ -0,0 +1,23 @@ +from pathlib import Path +import json,hashlib,subprocess +S=Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=Path('/tmp/infd-zlib-product-complete-ack-stage');H=lambda b:hashlib.sha256(b).hexdigest() +m=Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec';entries=json.loads(m.read_text());assert len(entries)==74 +for e in entries:assert H(Path(e['staged_path']).read_bytes())==e['staged_sha256'] +old=Path('/tmp/infd-zlib-product-whiteout-review-stage/frozen66-candidate-manifest.json');oldentries=json.loads(old.read_text());changed=[] +for e in oldentries: + p=S/e['path'];assert p.exists() + if H(p.read_bytes())!=e['staged_sha256']:changed.append(e['path']) +assert all(p.startswith('docs/evidence/2026-10-11-zlib-remediation-candidate/') for p in changed) +initial=P/'initial-8d345bb2/owner-snapshot';a=json.loads((initial/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text());b=json.loads((P/'local-candidate-verification.json').read_text()) +for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert a[k]==b[k] +(O/'frozen74-verify_local_artifacts.py').write_bytes((P/'verify_local_artifacts.py').read_bytes()) +code=Path('/tmp/infd-zlib-product-whiteout-review-stage/probe_same_layer_whiteout.py').read_text().replace('frozen66-verify_local_artifacts.py','frozen74-verify_local_artifacts.py').replace("all(not r['same_layer_new_preserved'] for r in results),'finding no longer reproduced'","all(r['same_layer_new_preserved'] for r in results),'same-layer addition lost'") +(O/'probe_corrected_same_layer_whiteout.py').write_text(code) +r=subprocess.run(['python3',str(O/'probe_corrected_same_layer_whiteout.py')],capture_output=True,text=True);assert r.returncode==0,r.stderr;(O/'corrected-probe-receipt.json').write_text(r.stdout) +code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-complete-ack-stage')/'independent-final-artifact-comparison.json').write_text") +exec(compile(code,'product-final74-readback','exec'),{}) +proof=json.loads((O/'independent-final-artifact-comparison.json').read_text());official=json.loads((P/'artifact-comparison.json').read_text()) +for k in ['final_changed_files','directory_count_base','directory_count_candidate','directory_metadata_delta','base_layers_preserved','sbom_only_delta']:assert proof[k]==official[k] +assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} and not proof['directory_metadata_delta'] +(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all74_hashes_verified=True,changed_from66=changed,source_recipe_workflow_context_image_scan_unchanged=True,new_audit_tests_passed=5,whiteout_semantic_cases=12,additional_product_original_counterexamples_now_preserved=3,actual_saved_archive_reaudit_pass=True,directory_count_base=proof['directory_count_base'],directory_count_candidate=proof['directory_count_candidate'],directory_metadata_delta={},sameT08=True,native_actions=False,publication=False),indent=2)+'\n') +print('Exact74 and all original Product counterexamples now pass; existing actual image re-audit passes.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/corrected-probe-receipt.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/corrected-probe-receipt.json new file mode 100644 index 0000000..9242852 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/corrected-probe-receipt.json @@ -0,0 +1,28 @@ +[ + { + "marker": "usr/.wh..wh..opq", + "same_layer_new": "usr/new", + "actual_names": [ + "usr", + "usr/new" + ], + "same_layer_new_preserved": true + }, + { + "marker": ".wh..wh..opq", + "same_layer_new": "new", + "actual_names": [ + "new" + ], + "same_layer_new_preserved": true + }, + { + "marker": "usr/.wh.child", + "same_layer_new": "usr/child/new", + "actual_names": [ + "usr", + "usr/child/new" + ], + "same_layer_new_preserved": true + } +] diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/frozen74-verify_local_artifacts.py b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/frozen74-verify_local_artifacts.py new file mode 100644 index 0000000..76e9bca --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/frozen74-verify_local_artifacts.py @@ -0,0 +1,56 @@ +from pathlib import Path +import hashlib,io,json,tarfile,sys +if sys.flags.optimize: + raise SystemExit("REFUSED: optimized Python disables required artifact validation") +root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build') +def image(path): + with tarfile.open(path) as archive: + manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1 + configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes) + files={} + for name in manifest[0]['Layers']: + additions={};removed=[];opaque=[] + with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer: + for member in layer: + path=member.name + while path.startswith('./'):path=path[2:] + path=path.lstrip('/');p=Path(path) + if p.name=='.wh..wh..opq': + parent=p.parent.as_posix();opaque.append('' if parent=='.' else parent+'/');continue + if p.name.startswith('.wh.'): + removed.append((p.parent/p.name[4:]).as_posix());continue + if member.isfile(): + data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest()) + elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None) + elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname) + else:continue + additions[path]=value + # OCI whiteouts mask lower-layer entries only; same-layer additions survive + # independently of where the marker appeared in the layer tar stream. + files={key:value for key,value in files.items() if not any(key.startswith(prefix) for prefix in opaque) and not any(key==target or key.startswith(target+'/') for target in removed)} + files.update(additions) + return config,hashlib.sha256(configbytes).hexdigest(),files +base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar') +assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids'] +changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)} +expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +assert set(changed)<=expected,set(changed) +a,b=base['config'].copy(),candidate['config'].copy() +labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{}) +a.pop('Image',None);b.pop('Image',None) +defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None} +for key,value in defaults.items(): + a.setdefault(key,value);b.setdefault(key,value) +assert a==b,(a,b) +components=[] +for name in ['base-sbom.cdx.json','sbom.cdx.json']: + data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')}) +sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)} +assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta +vulns=[] +for name in ['base-trivy-full.json','trivy-full.json']: + data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])]) +assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM' +assert not vulns[1] +proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False} +(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed))) diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/independent-final-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/independent-final-artifact-comparison.json new file mode 100644 index 0000000..9d63407 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/independent-final-artifact-comparison.json @@ -0,0 +1,73 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "directory_metadata_compared": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/probe_corrected_same_layer_whiteout.py b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/probe_corrected_same_layer_whiteout.py new file mode 100644 index 0000000..e3f587f --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/probe_corrected_same_layer_whiteout.py @@ -0,0 +1,23 @@ +import ast,tarfile,io,json,hashlib,tempfile +from pathlib import Path +P=Path(__file__).parent +ns={'Path':Path,'tarfile':tarfile,'json':json,'hashlib':hashlib};tree=ast.parse((P/'frozen74-verify_local_artifacts.py').read_text());fn=next(x for x in tree.body if isinstance(x,ast.FunctionDef) and x.name=='image');exec(compile(ast.Module(body=[fn],type_ignores=[]),'reader','exec'),ns) +def add(t,name,data): + m=tarfile.TarInfo(name);m.mode=0o755 + if data is None:m.type=tarfile.DIRTYPE;t.addfile(m) + else:m.size=len(data);t.addfile(m,io.BytesIO(data)) +def layer(entries): + b=io.BytesIO() + with tarfile.open(fileobj=b,mode='w') as t: + for name,data in entries:add(t,name,data) + return b.getvalue() +results=[] +for marker,new in [('usr/.wh..wh..opq','usr/new'),('.wh..wh..opq','new'),('usr/.wh.child','usr/child/new')]: + base=layer([('usr',None),('usr/child',None),('usr/child/old',b'old')]);over=layer([(new,b'new'),(marker,b'')]) + with tempfile.TemporaryDirectory() as tmp: + path=Path(tmp)/'image.tar' + with tarfile.open(path,'w') as t: + add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':['base.tar','over.tar']}]).encode());add(t,'config.json',json.dumps({'config':{},'rootfs':{'diff_ids':['base','over']}}).encode());add(t,'base.tar',base);add(t,'over.tar',over) + _,_,files=ns['image'](path);results.append(dict(marker=marker,same_layer_new=new,actual_names=sorted(files),same_layer_new_preserved=new in files)) +print(json.dumps(results,indent=2)) +assert all(r['same_layer_new_preserved'] for r in results),'same-layer addition lost' diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/validation.json new file mode 100644 index 0000000..1fd15a8 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-complete-review/validation.json @@ -0,0 +1,22 @@ +{ + "exact_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec", + "all74_hashes_verified": true, + "changed_from66": [ + "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json", + "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py", + "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py" + ], + "source_recipe_workflow_context_image_scan_unchanged": true, + "new_audit_tests_passed": 5, + "whiteout_semantic_cases": 12, + "additional_product_original_counterexamples_now_preserved": 3, + "actual_saved_archive_reaudit_pass": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "sameT08": true, + "native_actions": false, + "publication": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py new file mode 100644 index 0000000..8b6f589 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py @@ -0,0 +1,20 @@ +import pathlib,json,hashlib +S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=pathlib.Path('/tmp/infd-zlib-product-final-review-stage');H=lambda b:hashlib.sha256(b).hexdigest() +m=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8' +entries=json.loads(m.read_text());assert len(entries)==58 +for e in entries:assert H(pathlib.Path(e['staged_path']).read_bytes())==e['staged_sha256'] +oldm=P/'initial-8d345bb2/original-manifest.json';assert H(oldm.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66' +old=json.loads(oldm.read_text());oldroot=P/'initial-8d345bb2/owner-snapshot';changed=[] +for e in old: + original=oldroot/e['path'];assert H(original.read_bytes())==e['staged_sha256'] + if H((S/e['path']).read_bytes())!=e['staged_sha256']:changed.append(e['path']) +assert set(changed)=={'docs/evidence/2026-10-11-zlib-remediation-candidate/'+n for n in ['README.md','artifact-comparison.json','local-candidate-verification.json','verify_local_artifacts.py']} +r=json.loads((P/'local-candidate-verification.json').read_text());oldr=json.loads((oldroot/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text()) +for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert r[k]==oldr[k] +code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-final-review-stage')/'independent-directory-artifact-comparison.json').write_text") +exec(compile(code,'product-amended-readback','exec'),{}) +a=json.loads((O/'independent-directory-artifact-comparison.json').read_text());b=json.loads((P/'artifact-comparison.json').read_text()) +for k in ['directory_metadata_compared','directory_count_base','directory_count_candidate','directory_metadata_delta','final_changed_files','base_layers_preserved']:assert a[k]==b[k] +assert a['directory_metadata_compared'] and not a['directory_metadata_delta'] +(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all58_hashes_verified=True,all27_initial_archived_hashes_verified=True,changed_initial_paths=changed,image_context_source_workflow_runtime_scan_unchanged=True,new_source_tests_passed=3,directory_negative_mutations=3,optimized_tampered_before_read_refusal=True,existing_actual_archives_directory_reaudit=True,directory_count_base=a['directory_count_base'],directory_count_candidate=a['directory_count_candidate'],directory_metadata_delta={},native_actions=False),indent=2)+'\n') +print('Exact amended source and directory metadata readback pass.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json new file mode 100644 index 0000000..9d63407 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json @@ -0,0 +1,73 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "directory_metadata_compared": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json new file mode 100644 index 0000000..81b04ce --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json @@ -0,0 +1,42 @@ +{ + "owner": "informed-decision", + "scope": "exact local T05 source candidate only; no native go/publication or task completion", + "candidate_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "files": [ + { + "repo": "informed-decision", + "path": "workplans/ADHOC-2026-10-11.md", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/workplans/ADHOC-2026-10-11.md", + "original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8", + "staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22" + }, + { + "repo": "informed-decision", + "path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "original_sha256": null, + "staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "original_sha256": null, + "staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "original_sha256": null, + "staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c" + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py new file mode 100644 index 0000000..36291cd --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py @@ -0,0 +1,39 @@ +import pathlib,json,hashlib,copy,importlib.util,tarfile +S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json') +H=lambda b:hashlib.sha256(b).hexdigest() +assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66' +for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256'] +E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text()) +for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h +spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp) +a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36 +mutations=['appfile','keys','world','network','provider'] +for field in mutations: + c=copy.deepcopy(b) + if field=='appfile':c['app_file_sha256']['policy.py']='0'*64 + elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64 + elif field=='world':c['apk_world_sha256']='0'*64 + elif field=='network':c['network_accessed']=True + else:c['provider_or_customer_data_used']=True + try:cmp.compare(a,c) + except ValueError:pass + else:raise AssertionError(field) +# Read local image archives, source verifier operations are limited to these public local artifacts. +code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text") +exec(compile(code,'product-local-artifact-readback','exec'),{}) +proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']: + assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key] +# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline. +for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']: + with tarfile.open(S/'deploy/zlib-overlay'/n) as t: + signs=[x.name for x in t if x.name.startswith('.SIGN.')] + assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs + assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256'] +base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text()) +assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44 +assert base_scan['Metadata']['OS']==scan['Metadata']['OS'] +assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])] +container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container +result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False} +(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json new file mode 100644 index 0000000..2db5495 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json @@ -0,0 +1,69 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json new file mode 100644 index 0000000..d09a3fc --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json @@ -0,0 +1,21 @@ +{ + "manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "all27_staged_hashes_verified": true, + "evidence_hashes_verified": true, + "existing_source_tests": 4, + "existing_source_negative_mutations": 8, + "additional_product_negative_mutations": [ + "appfile", + "keys", + "world", + "network", + "provider" + ], + "saved_image_fs_and_layer_runtime_readback": true, + "sbom_only_zlib_delta": true, + "scan44_packages_zero_at_retained_db": true, + "signed_archive_named_key_matches_unchanged_baseline_truststore": true, + "signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.", + "native_actions": false, + "candidate_published": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md new file mode 100644 index 0000000..461d4d1 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md @@ -0,0 +1,74 @@ +# Bounded zlib candidate Product owner review + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact local zlib-only source candidate technical preparation +manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66 +comment: >- + Informed-decision intent requires human binding and preserved evidence; this + candidate changes only a native compression dependency while preserving + application authorization/presentation behavior. T08 review work record was + completed first. This is technical source agreement, not native go, publication + receipt, founder acceptance or T05 completion. +``` + +All27 staged hashes and retained evidence-file hashes independently verify. +Independent saved-image archive readback confirms all nine exact763 base diff_ids +as prefix, equal effective runtime configuration with only explicitly normalized +empty/false/null defaults, and final filesystem changes exactly +`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent. +Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL +and UID/GID10001 remain equal. Root build identity returns to10001:10001. +No service values, namespace, DB, customer data, config, PVC, schema, audience, +policy pins, protected helper or existing release journal is changed. + +Package/index bytes match pinned official HTTPS download hashes. Both signed +archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present +in unchanged baseline trust metadata. Retained actual maker apk verify success +against exact763 installed keys is the execution evidence; this review separately +checks archive signatures' metadata, bytes and trust identity, without claiming +a new signature-verification execution. Containerfile requires digest checks and +`apk verify` success before offline named-package upgrade; no allow-untrusted or +keys-dir override. Existing trusted keys are not replaced. +[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd) +defines integrity/signature checking and nonzero failure. +Upgrade selects only zlib from retained local signed index, disables network, +preupgrade and logging, and removes temporary public artifacts. + +Both full CycloneDX/Trivy artifacts independently show44 packages and only +zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM +CVE-2026-85091; candidate has zero findings at the retained same database +03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917. +No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning +and actual38 OS/6 Python detector coverage remain disclosed. This is bounded +scan improvement at that snapshot, not estate risk grading or future safety. +Local daemon image78bfdcc and saved OCI config625d are distinct disclosed +representations; neither is a published registry digest or native image proof. + +Four existing source tests pass, covering eight mutations; five additional Product +mutations of app source, trust keys, APK world, network and provider/data flags +refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt. +Retained four compression vectors/three malformed refusals/crypto/JWT/waitress +and ten installed purpose variants are local synthetic checks, not live PDP +or customer/native-data testing. No new container or native execution by reviewer. + +Workflow publishes only a source-bound candidate through existing admitted owner +registry capability after root source review/commit: exact40hex source revision, +fixed owner archive, four input hashes/contextc554, exact763 base, no-network +bounded build, unchanged runtime comparison and purpose checks before push. +It has no kubectl, Argo, DB/admin, namespace or runtime deployment action. +The workflow is unexecuted; source review does not attest CI credentials, actual +publication or published artifact equivalence. Root must retain actual CI/source +revision and registry descriptor/layer/config/package/signature/context readback, +then full published scan/SBOM and scoped candidate release preparation. Only +distinct exact informed-decision founder native approval followed by installedr1, +runtime/purpose and full-rescan proof can close T05. Future image-only rollback +to763 preserves latest DB; no historical snapshot restore. + +T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic +controller is implied. T04/c96 accepted outcome and original uncertain journals +remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted. +No new native authority, owner checkout write, credential/login, deployment or +customer-data access occurred in this review. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md new file mode 100644 index 0000000..b39c57f --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md @@ -0,0 +1,259 @@ +--- +id: INFD-WP-ADHOC-2026-10-11 +type: workplan +title: "Application-owner catalogue facts review" +domain: infotech +repo: informed-decision +status: finished +owner: codex +topic_slug: netkingdom +created: "2026-10-11" +updated: "2026-10-11" +flavor: planning +state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be" +--- + +## Review exact one-application catalogue facts + +```task +id: INFD-WP-ADHOC-2026-10-11-T01 +status: done +priority: medium +state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305" +``` + +Completed informed-decision application-owner source review under INTENT.md +Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10, +and Layer Placement. Read actual owner OIDC, requester and policy-request +code, governing Staff/PEP-shaped declaration, User Engine model, and existing +value-free native registration/Ingress/preflight receipts. Exact canonical +facts agree. Browser client is distinct from create-only requester. + +Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md. +Canonical facts SHA-256: +`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`. +Reviewed refined nine-file executor manifest SHA-256: +`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`. + +This task completes the application-facts source review only. It grants no +maintenance exception, native dry-run/apply/recovery, IAM permission, image +release or human disposition. Existing User Engine native acceptance work +remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is +created by this bounded review. No tests were needed for this evidence-only +review; no native, credential or login action occurred. + +## Independently review purpose overlay release preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T02 +status: done +priority: medium +``` + +Completed same-role informed-decision-owner technical review of frozen36-path +purpose release manifest SHA-256 +`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`. +All36 staged file hashes and exact source PolicyClient9d7 hash were verified. +Source candidates and captured candidate Deployment differ only in the image. +Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding; +T05 keeps its2026-10-18 follow-through. Actual published-image receipts and +sealed native read-only preflight support preparation, not native deployment. + +Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed +binding forms across register, replay, publish, annotate and revise. Each +refusal preserves every domain table, records a truthful invalid-decision +observation and leaves the same idempotency key reusable after restoring a +canonical enforcement response. These are synthetic source tests only. +Test: tests/test_purpose_owner_mutation_negatives.py. +Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json. +Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md. + +This bounded review grants no native backup/export/restore, image rollout, +credentials, login, human disposition or vulnerability acceptance. Existing +INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual +is created or claimed completed. Catalogue ACK/T01 remains unchanged. + +## Confirm amended purpose release custody and preflight gates + +```task +id: INFD-WP-ADHOC-2026-10-11-T03 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed amended78-path release manifest SHA-256 +`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`. +All78 file hashes verified, original36 archive retained, source PolicyClient9d7 +and both image-only source candidates unchanged. Prior50 source lifecycle +mutation/idempotency negatives remain applicable and were not repeated. + +Confirmed stdlib read-only schema5/integrity/count gate before ANY native or +restored Store/admin open, explicit local/remote optimized-interpreter refusal, +sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count +equality distinguished from legitimate concurrent live commits. Revised20-doc +184912-byte packet and01:39 read-only dry-run receipts remain preparation. +Native schema gate, backup/export/restore/release and founder disposition remain +unperformed; T04/T05 obligations and temporary vulnerability review persist. + +Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md. +Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/ +receipt remain unchanged. No new residual or authority is created by this review. + +## Reconcile Staff evidence source declaration and current guarantees + +```task +id: INFD-WP-ADHOC-2026-10-11-T04 +status: done +priority: medium +``` + +Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source +class definitions, transactional recording, heartbeat/reconciliation scheduling, +existing component-test assertions and native count/receipt evidence. Reconciled +stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening +finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending +NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual +source intake for remaining class-specific declaration/verification gaps, +origin INFD-WP-0007. No residual implementation or native action occurred. + +Source evidence reconciliation: +docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md. +Formal source review: +docs/reviews/2026-10-11-staff-evidence-source-owner-review.md. +Existing Staff/PEP-shaped classification, three load-bearing class classifications, +compromised-source and commitment/content availability limits remain unchanged. + +## Independently review supervised purpose actuator product boundaries + +```task +id: INFD-WP-ADHOC-2026-10-11-T05 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed exact23-path helper manifest +`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`, +all staged hashes and embedded source bundle/plan. Product evidence/schema5, +private snapshot custody, confined offline UID0 initialization followed by +UID10001 pre/post-admin verification, independent failed-candidate rollback +and all-phase start deadline are technically agreed as source preparation. + +No purpose-policy or candidate image change. Retained helper16 synthetic tests +and platform5 independent recovery negatives are mechanism proof; prior50 +product policy negatives remain applicable. No new test run was needed for this +unchanged-source review. Native-provider acceptance remains distinct from the +installed10 synthetic purpose forms; T04 is not complete. Before first human +post, amend exact20-document packet to hash-bind helper/plan, four render inputs, +initializer/recovery/deadline refinements and preserved full scan provenance. +Exact combined packet acknowledgement remains a separate review gate. + +Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md. +No native reads/backups/export/restore/release, credentials, human disposition, +founder approval or phase authority was exercised by this review. + +## Prepare separately gated provider-derived denial mechanism probe + +```task +id: INFD-WP-ADHOC-2026-10-11-T06 +status: done +priority: medium +``` + +Prepared source-only readonly lifecycle.search provider-derived mechanism probe +with truthful informed-decision/review SERVICE and no human/StateHub attributes. +Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a +canonical real DENY is required; no claims are invented to obtain ALLOW. +One actual provider response will remain in Pod memory; ten transformed +noncanonical purpose copies test installed consumer refusal without further +provider calls, DB/admin or act effects. This is a denial/binding mechanism +proof candidate, not actual authorized lifecycle or full T04 acceptance. + +Source: docs/evidence/2026-10-11-purpose-provider-probe/. +Ten synthetic source tests pass; no actual provider, credential, runtime config, +DB, native data or live action was accessed. Posted frozen112 packet/helper +remain unchanged. Exact separate founder go for this newly prepared probe and +its target must precede any execution; current memo has no acceptance and this +new helper is not hash-bound in that submitted packet. T04 remains progress. + +## Review exact existing-snapshot rescue version2 preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T07 +status: done +priority: medium +``` + +Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7 +under the same informed-decision-owner role. Actual original backupCOMPLETE/copy +UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1 +require fresh founder acceptance. Immutable reads are bounded to proven frozen +closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose. +Independent existing26 mocked tests plus41 subtests pass, and10 new product scope +guards pass (including eight refusal mutations and a frozen initial packet check). +No native command, DB open, credentials or rescue operation occurred. + +Initial review decision changes_requested: proposal.json misleadingly names old +f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed; +label it original/historical and refreeze all dependent packet hashes. Correct +current bundle/plan digests already exist. The normalized test fixture is not an +owner edit or approval. Initial review/failure must remain after correction; +exact amended confirmation is still required before newhuman submission/execution. + +Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md. +Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/. +T04 remains progress; original version1 approval is not newversion2 authority. + +**Amended source confirmation, same T07 trial:** exact134-path manifest +`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d` +corrects only the historical helper provenance label and dependent packet hashes; +original66 source and initial changes-requested review remain retained. Current +helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1 +and20documents validate:173469packetbytes/240451revisionbytes. Eight scope +mutations and three packet mutations independently refuse. Final technical +source acknowledgement approved; no new human acceptance or native rescue. +Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md. + + +**Actual-outcome assessment preparation, same completed T07 trial:** independently +verified original receipt-byte hashes and source consumer path after approved +source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover +backup/private copy matches live post-release counts16/56/0, delivered336, +confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001 +checks pass. Actual post-rollout authenticated provider-backed outcomes readback +is separate from installed ten synthetic purpose forms (2allow/8refuse). +Completed source-only assessment supports T04 done, T05 todo and WP0009 active. +Original failed copy and verifier UNCERTAIN remain preserved, with no replay or +helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission +handling correction; no implementation, native action or authority grant. +This work-record preparation precedes the formal actual-outcome review entry. +Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md. +Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/. + + +## Independently review bounded zlib-only T05 source candidate + +```task +id: INFD-WP-ADHOC-2026-10-11-T08 +status: done +priority: medium +``` + +Completed informed-decision Product source review of exact27-path candidate +manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66. +All staged/evidence hashes verify. Independently reread local saved base/candidate +image archives, effective runtime config, nine base layer prefix, two final file +changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs; +44 packages/base1MED to candidate0 at retained same scanner database. +Signed APK/index named key matches unchanged base trust metadata; enforced +apk verify against existing keys retained, no allow-untrusted or truststore override. +Four existing source tests pass (eight refusal mutations), plus five independent +appfile/trustkeys/world/network/provider metadata mutations refuse. +Purpose/backend checks remain local and synthetic, not actual PDP or data proof. +Technical source preparation agreement only: local image78bfdcc is unpublished, +T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and +new native founder approval/installed proof are still required. Current763/native +DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010 +is unpromoted/unimplemented. No native actions, credentials or owner source writes. +This completed work record is prepared before the formal review entry. +Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md. +Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json new file mode 100644 index 0000000..5548150 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json @@ -0,0 +1,20 @@ +{ + "exact_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8", + "all58_hashes_verified": true, + "all27_initial_archived_hashes_verified": true, + "changed_initial_paths": [ + "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py" + ], + "image_context_source_workflow_runtime_scan_unchanged": true, + "new_source_tests_passed": 3, + "directory_negative_mutations": 3, + "optimized_tampered_before_read_refusal": true, + "existing_actual_archives_directory_reaudit": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "native_actions": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py b/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py new file mode 100644 index 0000000..36291cd --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py @@ -0,0 +1,39 @@ +import pathlib,json,hashlib,copy,importlib.util,tarfile +S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json') +H=lambda b:hashlib.sha256(b).hexdigest() +assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66' +for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256'] +E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text()) +for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h +spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp) +a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36 +mutations=['appfile','keys','world','network','provider'] +for field in mutations: + c=copy.deepcopy(b) + if field=='appfile':c['app_file_sha256']['policy.py']='0'*64 + elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64 + elif field=='world':c['apk_world_sha256']='0'*64 + elif field=='network':c['network_accessed']=True + else:c['provider_or_customer_data_used']=True + try:cmp.compare(a,c) + except ValueError:pass + else:raise AssertionError(field) +# Read local image archives, source verifier operations are limited to these public local artifacts. +code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text") +exec(compile(code,'product-local-artifact-readback','exec'),{}) +proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']: + assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key] +# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline. +for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']: + with tarfile.open(S/'deploy/zlib-overlay'/n) as t: + signs=[x.name for x in t if x.name.startswith('.SIGN.')] + assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs + assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256'] +base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text()) +assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44 +assert base_scan['Metadata']['OS']==scan['Metadata']['OS'] +assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])] +container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container +result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False} +(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json new file mode 100644 index 0000000..2db5495 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json @@ -0,0 +1,69 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json new file mode 100644 index 0000000..d09a3fc --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json @@ -0,0 +1,21 @@ +{ + "manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "all27_staged_hashes_verified": true, + "evidence_hashes_verified": true, + "existing_source_tests": 4, + "existing_source_negative_mutations": 8, + "additional_product_negative_mutations": [ + "appfile", + "keys", + "world", + "network", + "provider" + ], + "saved_image_fs_and_layer_runtime_readback": true, + "sbom_only_zlib_delta": true, + "scan44_packages_zero_at_retained_db": true, + "signed_archive_named_key_matches_unchanged_baseline_truststore": true, + "signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.", + "native_actions": false, + "candidate_published": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json new file mode 100644 index 0000000..19bf3a4 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-candidate-manifest.json @@ -0,0 +1,464 @@ +[ + { + "repo": "informed-decision", + "path": ".forgejo/workflows/zlib-overlay-image.yaml", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml", + "original_sha256": null, + "staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/.dockerignore", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore", + "original_sha256": null, + "staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/APKINDEX.tar.gz", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz", + "original_sha256": null, + "staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/Containerfile", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile", + "original_sha256": null, + "staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/pins.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json", + "original_sha256": null, + "staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "original_sha256": null, + "staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "original_sha256": null, + "staged_sha256": "c999a0c326a95e74082258851a5c4669395937a8fed95927f114ff08a18e0d6b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json", + "original_sha256": null, + "staged_sha256": "de852da5990326642e0c0d15ed74ab21513b4227c5634ba7146568876e750c6a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "original_sha256": null, + "staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "original_sha256": null, + "staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "original_sha256": null, + "staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "original_sha256": null, + "staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "original_sha256": null, + "staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "original_sha256": null, + "staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json", + "original_sha256": null, + "staged_sha256": "91384b270c0462223af1ff66e3ca75db5fce692c56c6bde6df435e6a2a079c5e" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json", + "original_sha256": null, + "staged_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml", + "original_sha256": null, + "staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore", + "original_sha256": null, + "staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz", + "original_sha256": null, + "staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile", + "original_sha256": null, + "staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json", + "original_sha256": null, + "staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "original_sha256": null, + "staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "original_sha256": null, + "staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "original_sha256": null, + "staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "original_sha256": null, + "staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "original_sha256": null, + "staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "original_sha256": null, + "staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "original_sha256": null, + "staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "original_sha256": null, + "staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "original_sha256": null, + "staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "original_sha256": null, + "staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "original_sha256": null, + "staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "original_sha256": null, + "staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "original_sha256": null, + "staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py", + "original_sha256": null, + "staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py", + "original_sha256": null, + "staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py", + "original_sha256": null, + "staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py", + "original_sha256": null, + "staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "original_sha256": null, + "staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md", + "original_sha256": null, + "staged_sha256": "4d0b0ed0b41f2098adfa2e626c641360855cd0e717bbd2d7a6c155cee2ae91ec" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json", + "original_sha256": null, + "staged_sha256": "3e81c1cedb2e3b25d83a779011898181a7860ff76532ede5fa3e9b8f63632700" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json", + "original_sha256": null, + "staged_sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json", + "original_sha256": null, + "staged_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json", + "original_sha256": null, + "staged_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py", + "original_sha256": null, + "staged_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "original_sha256": null, + "staged_sha256": "51505fa91e8d498c2eb3814442e89b01621290f1b39da08a5f460f6f6f9f112c" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "original_sha256": null, + "staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "original_sha256": null, + "staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "original_sha256": null, + "staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py", + "original_sha256": null, + "staged_sha256": "8635859fb63f8778e48ae4f3532e6fc37eb1fbc289801ec5b68b8a90bb6fc364" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "original_sha256": null, + "staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/check_build_inputs.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py", + "original_sha256": null, + "staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/check_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py", + "original_sha256": null, + "staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/compare_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py", + "original_sha256": null, + "staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/test_candidate.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py", + "original_sha256": null, + "staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9" + }, + { + "repo": "informed-decision", + "path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223", + "staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4" + } +] diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py new file mode 100644 index 0000000..5973303 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/frozen66-verify_local_artifacts.py @@ -0,0 +1,52 @@ +from pathlib import Path +import hashlib,io,json,tarfile,sys +if sys.flags.optimize: + raise SystemExit("REFUSED: optimized Python disables required artifact validation") +root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build') +def image(path): + with tarfile.open(path) as archive: + manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1 + configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes) + files={} + for name in manifest[0]['Layers']: + with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer: + for member in layer: + path=member.name + while path.startswith('./'):path=path[2:] + path=path.lstrip('/');p=Path(path) + if p.name=='.wh..wh..opq': + folder=p.parent.as_posix();prefix='' if folder=='.' else folder+'/' + files={key:value for key,value in files.items() if not key.startswith(prefix)};continue + if p.name.startswith('.wh.'): + removed=(p.parent/p.name[4:]).as_posix();files={key:value for key,value in files.items() if key!=removed and not key.startswith(removed+'/')};continue + if member.isfile(): + data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest()) + elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None) + elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname) + else:continue + files[path]=value + return config,hashlib.sha256(configbytes).hexdigest(),files +base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar') +assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids'] +changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)} +expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +assert set(changed)<=expected,set(changed) +a,b=base['config'].copy(),candidate['config'].copy() +labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{}) +a.pop('Image',None);b.pop('Image',None) +defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None} +for key,value in defaults.items(): + a.setdefault(key,value);b.setdefault(key,value) +assert a==b,(a,b) +components=[] +for name in ['base-sbom.cdx.json','sbom.cdx.json']: + data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')}) +sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)} +assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta +vulns=[] +for name in ['base-trivy-full.json','trivy-full.json']: + data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])]) +assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM' +assert not vulns[1] +proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False} +(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed))) diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json new file mode 100644 index 0000000..3618287 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/original-manifest.json @@ -0,0 +1,113 @@ +{ + "owner": "informed-decision", + "scope": "exact amended T05 source agreement; same T08; historical initial review retained; no publication or native go", + "candidate_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8", + "initial_product_review_manifest_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225", + "files": [ + { + "repo": "informed-decision", + "path": "workplans/ADHOC-2026-10-11.md", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/workplans/ADHOC-2026-10-11.md", + "original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8", + "staged_sha256": "11039006000e55d6add3f7da70661545c4dfc1d533481eca8145d2452dbf574b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json", + "original_sha256": null, + "staged_sha256": "5f33475707f7cf4ea3a6f1ac8d653b1af566c507347d70ba09b67813a5ccf225" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md", + "original_sha256": null, + "staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "original_sha256": null, + "staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8" + }, + { + "repo": "informed-decision", + "path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "original_sha256": null, + "staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "original_sha256": null, + "staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "original_sha256": null, + "staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "original_sha256": null, + "staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "original_sha256": null, + "staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c" + }, + { + "repo": "informed-decision", + "path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md", + "original_sha256": null, + "staged_sha256": "5cd9af6da8e8b9329bbf3be56c82f62b827bed66d0b7d860350c421e8105aca6" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py", + "original_sha256": null, + "staged_sha256": "f79ca389f7d2a2294b3eed0229865caa5811ee4a53bfd545335453c85ee37b09" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json", + "original_sha256": null, + "staged_sha256": "9cf6bb12f93ebfc2b92fc470f50a470256a25db3a70f98f2c08a6e73011ebb1d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-final-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "c3760ab21efea5f7088e9b81a9d092727eb5a04d130519951d28b5327bee31d8" + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py new file mode 100644 index 0000000..8b6f589 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/check_amendment.py @@ -0,0 +1,20 @@ +import pathlib,json,hashlib +S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');P=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';O=pathlib.Path('/tmp/infd-zlib-product-final-review-stage');H=lambda b:hashlib.sha256(b).hexdigest() +m=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json');assert H(m.read_bytes())=='64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8' +entries=json.loads(m.read_text());assert len(entries)==58 +for e in entries:assert H(pathlib.Path(e['staged_path']).read_bytes())==e['staged_sha256'] +oldm=P/'initial-8d345bb2/original-manifest.json';assert H(oldm.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66' +old=json.loads(oldm.read_text());oldroot=P/'initial-8d345bb2/owner-snapshot';changed=[] +for e in old: + original=oldroot/e['path'];assert H(original.read_bytes())==e['staged_sha256'] + if H((S/e['path']).read_bytes())!=e['staged_sha256']:changed.append(e['path']) +assert set(changed)=={'docs/evidence/2026-10-11-zlib-remediation-candidate/'+n for n in ['README.md','artifact-comparison.json','local-candidate-verification.json','verify_local_artifacts.py']} +r=json.loads((P/'local-candidate-verification.json').read_text());oldr=json.loads((oldroot/'docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json').read_text()) +for k in ['candidate_docker_daemon_image_id','candidate_saved_oci_config_digest','source_context_sha256','build_inputs','scanner_db_sha256','baseline_full_scan_findings','candidate_full_scan_allseverity_findings']:assert r[k]==oldr[k] +code=(P/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-final-review-stage')/'independent-directory-artifact-comparison.json').write_text") +exec(compile(code,'product-amended-readback','exec'),{}) +a=json.loads((O/'independent-directory-artifact-comparison.json').read_text());b=json.loads((P/'artifact-comparison.json').read_text()) +for k in ['directory_metadata_compared','directory_count_base','directory_count_candidate','directory_metadata_delta','final_changed_files','base_layers_preserved']:assert a[k]==b[k] +assert a['directory_metadata_compared'] and not a['directory_metadata_delta'] +(O/'validation.json').write_text(json.dumps(dict(exact_manifest_sha256=H(m.read_bytes()),all58_hashes_verified=True,all27_initial_archived_hashes_verified=True,changed_initial_paths=changed,image_context_source_workflow_runtime_scan_unchanged=True,new_source_tests_passed=3,directory_negative_mutations=3,optimized_tampered_before_read_refusal=True,existing_actual_archives_directory_reaudit=True,directory_count_base=a['directory_count_base'],directory_count_candidate=a['directory_count_candidate'],directory_metadata_delta={},native_actions=False),indent=2)+'\n') +print('Exact amended source and directory metadata readback pass.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json new file mode 100644 index 0000000..9d63407 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/independent-directory-artifact-comparison.json @@ -0,0 +1,73 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "directory_metadata_compared": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json new file mode 100644 index 0000000..81b04ce --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/original-manifest.json @@ -0,0 +1,42 @@ +{ + "owner": "informed-decision", + "scope": "exact local T05 source candidate only; no native go/publication or task completion", + "candidate_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "files": [ + { + "repo": "informed-decision", + "path": "workplans/ADHOC-2026-10-11.md", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/workplans/ADHOC-2026-10-11.md", + "original_sha256": "da3b3f73be7c026c6a8740d548dce64a8269d0e6a02e8c438f03b43c0e9091b8", + "staged_sha256": "6b8ae1bf0f8c775873bfa37f8988169e66edd81c37ea4e23f5a00c6b868abe22" + }, + { + "repo": "informed-decision", + "path": "docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md", + "original_sha256": null, + "staged_sha256": "ab3dcfb63eb2b38844e8d45da6ccfe21a1dfc97e57a3dbf23bc38d7694437ff8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py", + "original_sha256": null, + "staged_sha256": "e660a6010a835cc618e55509f54c25a7aa9aecb1a528d14120b2f9b40bc1242b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json", + "original_sha256": null, + "staged_sha256": "e18a11328b744ab682346f4a8b37e9a6bf7965cfa84b4da939baaec22911fce5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-product-review-stage/owner/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "f76c98b9e8acbc4ad85bd7cf36cc42c8bf6c09063d9a2c25ef45cb027f71ef5c" + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py new file mode 100644 index 0000000..36291cd --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py @@ -0,0 +1,39 @@ +import pathlib,json,hashlib,copy,importlib.util,tarfile +S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json') +H=lambda b:hashlib.sha256(b).hexdigest() +assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66' +for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256'] +E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text()) +for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h +spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp) +a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36 +mutations=['appfile','keys','world','network','provider'] +for field in mutations: + c=copy.deepcopy(b) + if field=='appfile':c['app_file_sha256']['policy.py']='0'*64 + elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64 + elif field=='world':c['apk_world_sha256']='0'*64 + elif field=='network':c['network_accessed']=True + else:c['provider_or_customer_data_used']=True + try:cmp.compare(a,c) + except ValueError:pass + else:raise AssertionError(field) +# Read local image archives, source verifier operations are limited to these public local artifacts. +code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text") +exec(compile(code,'product-local-artifact-readback','exec'),{}) +proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']: + assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key] +# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline. +for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']: + with tarfile.open(S/'deploy/zlib-overlay'/n) as t: + signs=[x.name for x in t if x.name.startswith('.SIGN.')] + assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs + assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256'] +base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text()) +assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44 +assert base_scan['Metadata']['OS']==scan['Metadata']['OS'] +assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])] +container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container +result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False} +(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json new file mode 100644 index 0000000..2db5495 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json @@ -0,0 +1,69 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json new file mode 100644 index 0000000..d09a3fc --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json @@ -0,0 +1,21 @@ +{ + "manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "all27_staged_hashes_verified": true, + "evidence_hashes_verified": true, + "existing_source_tests": 4, + "existing_source_negative_mutations": 8, + "additional_product_negative_mutations": [ + "appfile", + "keys", + "world", + "network", + "provider" + ], + "saved_image_fs_and_layer_runtime_readback": true, + "sbom_only_zlib_delta": true, + "scan44_packages_zero_at_retained_db": true, + "signed_archive_named_key_matches_unchanged_baseline_truststore": true, + "signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.", + "native_actions": false, + "candidate_published": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md new file mode 100644 index 0000000..461d4d1 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md @@ -0,0 +1,74 @@ +# Bounded zlib candidate Product owner review + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact local zlib-only source candidate technical preparation +manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66 +comment: >- + Informed-decision intent requires human binding and preserved evidence; this + candidate changes only a native compression dependency while preserving + application authorization/presentation behavior. T08 review work record was + completed first. This is technical source agreement, not native go, publication + receipt, founder acceptance or T05 completion. +``` + +All27 staged hashes and retained evidence-file hashes independently verify. +Independent saved-image archive readback confirms all nine exact763 base diff_ids +as prefix, equal effective runtime configuration with only explicitly normalized +empty/false/null defaults, and final filesystem changes exactly +`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent. +Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL +and UID/GID10001 remain equal. Root build identity returns to10001:10001. +No service values, namespace, DB, customer data, config, PVC, schema, audience, +policy pins, protected helper or existing release journal is changed. + +Package/index bytes match pinned official HTTPS download hashes. Both signed +archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present +in unchanged baseline trust metadata. Retained actual maker apk verify success +against exact763 installed keys is the execution evidence; this review separately +checks archive signatures' metadata, bytes and trust identity, without claiming +a new signature-verification execution. Containerfile requires digest checks and +`apk verify` success before offline named-package upgrade; no allow-untrusted or +keys-dir override. Existing trusted keys are not replaced. +[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd) +defines integrity/signature checking and nonzero failure. +Upgrade selects only zlib from retained local signed index, disables network, +preupgrade and logging, and removes temporary public artifacts. + +Both full CycloneDX/Trivy artifacts independently show44 packages and only +zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM +CVE-2026-85091; candidate has zero findings at the retained same database +03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917. +No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning +and actual38 OS/6 Python detector coverage remain disclosed. This is bounded +scan improvement at that snapshot, not estate risk grading or future safety. +Local daemon image78bfdcc and saved OCI config625d are distinct disclosed +representations; neither is a published registry digest or native image proof. + +Four existing source tests pass, covering eight mutations; five additional Product +mutations of app source, trust keys, APK world, network and provider/data flags +refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt. +Retained four compression vectors/three malformed refusals/crypto/JWT/waitress +and ten installed purpose variants are local synthetic checks, not live PDP +or customer/native-data testing. No new container or native execution by reviewer. + +Workflow publishes only a source-bound candidate through existing admitted owner +registry capability after root source review/commit: exact40hex source revision, +fixed owner archive, four input hashes/contextc554, exact763 base, no-network +bounded build, unchanged runtime comparison and purpose checks before push. +It has no kubectl, Argo, DB/admin, namespace or runtime deployment action. +The workflow is unexecuted; source review does not attest CI credentials, actual +publication or published artifact equivalence. Root must retain actual CI/source +revision and registry descriptor/layer/config/package/signature/context readback, +then full published scan/SBOM and scoped candidate release preparation. Only +distinct exact informed-decision founder native approval followed by installedr1, +runtime/purpose and full-rescan proof can close T05. Future image-only rollback +to763 preserves latest DB; no historical snapshot restore. + +T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic +controller is implied. T04/c96 accepted outcome and original uncertain journals +remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted. +No new native authority, owner checkout write, credential/login, deployment or +customer-data access occurred in this review. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md new file mode 100644 index 0000000..b39c57f --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/owner-snapshot/workplans/ADHOC-2026-10-11.md @@ -0,0 +1,259 @@ +--- +id: INFD-WP-ADHOC-2026-10-11 +type: workplan +title: "Application-owner catalogue facts review" +domain: infotech +repo: informed-decision +status: finished +owner: codex +topic_slug: netkingdom +created: "2026-10-11" +updated: "2026-10-11" +flavor: planning +state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be" +--- + +## Review exact one-application catalogue facts + +```task +id: INFD-WP-ADHOC-2026-10-11-T01 +status: done +priority: medium +state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305" +``` + +Completed informed-decision application-owner source review under INTENT.md +Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10, +and Layer Placement. Read actual owner OIDC, requester and policy-request +code, governing Staff/PEP-shaped declaration, User Engine model, and existing +value-free native registration/Ingress/preflight receipts. Exact canonical +facts agree. Browser client is distinct from create-only requester. + +Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md. +Canonical facts SHA-256: +`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`. +Reviewed refined nine-file executor manifest SHA-256: +`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`. + +This task completes the application-facts source review only. It grants no +maintenance exception, native dry-run/apply/recovery, IAM permission, image +release or human disposition. Existing User Engine native acceptance work +remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is +created by this bounded review. No tests were needed for this evidence-only +review; no native, credential or login action occurred. + +## Independently review purpose overlay release preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T02 +status: done +priority: medium +``` + +Completed same-role informed-decision-owner technical review of frozen36-path +purpose release manifest SHA-256 +`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`. +All36 staged file hashes and exact source PolicyClient9d7 hash were verified. +Source candidates and captured candidate Deployment differ only in the image. +Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding; +T05 keeps its2026-10-18 follow-through. Actual published-image receipts and +sealed native read-only preflight support preparation, not native deployment. + +Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed +binding forms across register, replay, publish, annotate and revise. Each +refusal preserves every domain table, records a truthful invalid-decision +observation and leaves the same idempotency key reusable after restoring a +canonical enforcement response. These are synthetic source tests only. +Test: tests/test_purpose_owner_mutation_negatives.py. +Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json. +Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md. + +This bounded review grants no native backup/export/restore, image rollout, +credentials, login, human disposition or vulnerability acceptance. Existing +INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual +is created or claimed completed. Catalogue ACK/T01 remains unchanged. + +## Confirm amended purpose release custody and preflight gates + +```task +id: INFD-WP-ADHOC-2026-10-11-T03 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed amended78-path release manifest SHA-256 +`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`. +All78 file hashes verified, original36 archive retained, source PolicyClient9d7 +and both image-only source candidates unchanged. Prior50 source lifecycle +mutation/idempotency negatives remain applicable and were not repeated. + +Confirmed stdlib read-only schema5/integrity/count gate before ANY native or +restored Store/admin open, explicit local/remote optimized-interpreter refusal, +sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count +equality distinguished from legitimate concurrent live commits. Revised20-doc +184912-byte packet and01:39 read-only dry-run receipts remain preparation. +Native schema gate, backup/export/restore/release and founder disposition remain +unperformed; T04/T05 obligations and temporary vulnerability review persist. + +Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md. +Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/ +receipt remain unchanged. No new residual or authority is created by this review. + +## Reconcile Staff evidence source declaration and current guarantees + +```task +id: INFD-WP-ADHOC-2026-10-11-T04 +status: done +priority: medium +``` + +Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source +class definitions, transactional recording, heartbeat/reconciliation scheduling, +existing component-test assertions and native count/receipt evidence. Reconciled +stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening +finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending +NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual +source intake for remaining class-specific declaration/verification gaps, +origin INFD-WP-0007. No residual implementation or native action occurred. + +Source evidence reconciliation: +docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md. +Formal source review: +docs/reviews/2026-10-11-staff-evidence-source-owner-review.md. +Existing Staff/PEP-shaped classification, three load-bearing class classifications, +compromised-source and commitment/content availability limits remain unchanged. + +## Independently review supervised purpose actuator product boundaries + +```task +id: INFD-WP-ADHOC-2026-10-11-T05 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed exact23-path helper manifest +`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`, +all staged hashes and embedded source bundle/plan. Product evidence/schema5, +private snapshot custody, confined offline UID0 initialization followed by +UID10001 pre/post-admin verification, independent failed-candidate rollback +and all-phase start deadline are technically agreed as source preparation. + +No purpose-policy or candidate image change. Retained helper16 synthetic tests +and platform5 independent recovery negatives are mechanism proof; prior50 +product policy negatives remain applicable. No new test run was needed for this +unchanged-source review. Native-provider acceptance remains distinct from the +installed10 synthetic purpose forms; T04 is not complete. Before first human +post, amend exact20-document packet to hash-bind helper/plan, four render inputs, +initializer/recovery/deadline refinements and preserved full scan provenance. +Exact combined packet acknowledgement remains a separate review gate. + +Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md. +No native reads/backups/export/restore/release, credentials, human disposition, +founder approval or phase authority was exercised by this review. + +## Prepare separately gated provider-derived denial mechanism probe + +```task +id: INFD-WP-ADHOC-2026-10-11-T06 +status: done +priority: medium +``` + +Prepared source-only readonly lifecycle.search provider-derived mechanism probe +with truthful informed-decision/review SERVICE and no human/StateHub attributes. +Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a +canonical real DENY is required; no claims are invented to obtain ALLOW. +One actual provider response will remain in Pod memory; ten transformed +noncanonical purpose copies test installed consumer refusal without further +provider calls, DB/admin or act effects. This is a denial/binding mechanism +proof candidate, not actual authorized lifecycle or full T04 acceptance. + +Source: docs/evidence/2026-10-11-purpose-provider-probe/. +Ten synthetic source tests pass; no actual provider, credential, runtime config, +DB, native data or live action was accessed. Posted frozen112 packet/helper +remain unchanged. Exact separate founder go for this newly prepared probe and +its target must precede any execution; current memo has no acceptance and this +new helper is not hash-bound in that submitted packet. T04 remains progress. + +## Review exact existing-snapshot rescue version2 preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T07 +status: done +priority: medium +``` + +Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7 +under the same informed-decision-owner role. Actual original backupCOMPLETE/copy +UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1 +require fresh founder acceptance. Immutable reads are bounded to proven frozen +closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose. +Independent existing26 mocked tests plus41 subtests pass, and10 new product scope +guards pass (including eight refusal mutations and a frozen initial packet check). +No native command, DB open, credentials or rescue operation occurred. + +Initial review decision changes_requested: proposal.json misleadingly names old +f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed; +label it original/historical and refreeze all dependent packet hashes. Correct +current bundle/plan digests already exist. The normalized test fixture is not an +owner edit or approval. Initial review/failure must remain after correction; +exact amended confirmation is still required before newhuman submission/execution. + +Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md. +Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/. +T04 remains progress; original version1 approval is not newversion2 authority. + +**Amended source confirmation, same T07 trial:** exact134-path manifest +`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d` +corrects only the historical helper provenance label and dependent packet hashes; +original66 source and initial changes-requested review remain retained. Current +helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1 +and20documents validate:173469packetbytes/240451revisionbytes. Eight scope +mutations and three packet mutations independently refuse. Final technical +source acknowledgement approved; no new human acceptance or native rescue. +Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md. + + +**Actual-outcome assessment preparation, same completed T07 trial:** independently +verified original receipt-byte hashes and source consumer path after approved +source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover +backup/private copy matches live post-release counts16/56/0, delivered336, +confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001 +checks pass. Actual post-rollout authenticated provider-backed outcomes readback +is separate from installed ten synthetic purpose forms (2allow/8refuse). +Completed source-only assessment supports T04 done, T05 todo and WP0009 active. +Original failed copy and verifier UNCERTAIN remain preserved, with no replay or +helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission +handling correction; no implementation, native action or authority grant. +This work-record preparation precedes the formal actual-outcome review entry. +Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md. +Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/. + + +## Independently review bounded zlib-only T05 source candidate + +```task +id: INFD-WP-ADHOC-2026-10-11-T08 +status: done +priority: medium +``` + +Completed informed-decision Product source review of exact27-path candidate +manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66. +All staged/evidence hashes verify. Independently reread local saved base/candidate +image archives, effective runtime config, nine base layer prefix, two final file +changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs; +44 packages/base1MED to candidate0 at retained same scanner database. +Signed APK/index named key matches unchanged base trust metadata; enforced +apk verify against existing keys retained, no allow-untrusted or truststore override. +Four existing source tests pass (eight refusal mutations), plus five independent +appfile/trustkeys/world/network/provider metadata mutations refuse. +Purpose/backend checks remain local and synthetic, not actual PDP or data proof. +Technical source preparation agreement only: local image78bfdcc is unpublished, +T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and +new native founder approval/installed proof are still required. Current763/native +DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010 +is unpromoted/unimplemented. No native actions, credentials or owner source writes. +This completed work record is prepared before the formal review entry. +Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md. +Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json new file mode 100644 index 0000000..5548150 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-final-review/validation.json @@ -0,0 +1,20 @@ +{ + "exact_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8", + "all58_hashes_verified": true, + "all27_initial_archived_hashes_verified": true, + "changed_initial_paths": [ + "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py" + ], + "image_context_source_workflow_runtime_scan_unchanged": true, + "new_source_tests_passed": 3, + "directory_negative_mutations": 3, + "optimized_tampered_before_read_refusal": true, + "existing_actual_archives_directory_reaudit": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "native_actions": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py new file mode 100644 index 0000000..36291cd --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/check_product.py @@ -0,0 +1,39 @@ +import pathlib,json,hashlib,copy,importlib.util,tarfile +S=pathlib.Path('/tmp/infd-zlib-candidate-stage/informed-decision');O=pathlib.Path('/tmp/infd-zlib-product-review-stage');M=pathlib.Path('/tmp/infd-zlib-candidate-stage/manifest.json') +H=lambda b:hashlib.sha256(b).hexdigest() +assert H(M.read_bytes())=='8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66' +for f in json.loads(M.read_text()):assert H(pathlib.Path(f['staged_path']).read_bytes())==f['staged_sha256'] +E=S/'docs/evidence/2026-10-11-zlib-remediation-candidate';receipt=json.loads((E/'local-candidate-verification.json').read_text()) +for n,h in receipt['evidence_file_sha256'].items():assert H((E/n).read_bytes())==h +spec=importlib.util.spec_from_file_location('cmp',S/'tools/zlib_overlay/compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp) +a=json.loads((E/'base-runtime.json').read_text());b=json.loads((E/'candidate-runtime.json').read_text());assert cmp.compare(a,b)['app_files_identical']==36 +mutations=['appfile','keys','world','network','provider'] +for field in mutations: + c=copy.deepcopy(b) + if field=='appfile':c['app_file_sha256']['policy.py']='0'*64 + elif field=='keys':c['apk_keys_sha256']['extra.pub']='0'*64 + elif field=='world':c['apk_world_sha256']='0'*64 + elif field=='network':c['network_accessed']=True + else:c['provider_or_customer_data_used']=True + try:cmp.compare(a,c) + except ValueError:pass + else:raise AssertionError(field) +# Read local image archives, source verifier operations are limited to these public local artifacts. +code=(E/'verify_local_artifacts.py').read_text().replace("(root/'artifact-comparison.json').write_text", "(Path('/tmp/infd-zlib-product-review-stage')/'independent-artifact-comparison.json').write_text") +exec(compile(code,'product-local-artifact-readback','exec'),{}) +proof=json.loads((O/'independent-artifact-comparison.json').read_text());assert set(proof['final_changed_files'])=={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +for key in ['final_changed_files','sbom_only_delta','base_layers_preserved','new_layers']: + assert proof[key]==json.loads((E/'artifact-comparison.json').read_text())[key] +# Inspect signed archive metadata and match named trusted key already installed in unchanged baseline. +for n in ['zlib-1.3.2-r1.apk','APKINDEX.tar.gz']: + with tarfile.open(S/'deploy/zlib-overlay'/n) as t: + signs=[x.name for x in t if x.name.startswith('.SIGN.')] + assert signs==['.SIGN.RSA.alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub'],signs + assert 'alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub' in a['apk_keys_sha256'] +base_scan=json.loads((E/'base-trivy-full.json').read_text());scan=json.loads((E/'trivy-full.json').read_text()) +assert sum(len(x.get('Packages',[])) for x in scan['Results'])==44 +assert base_scan['Metadata']['OS']==scan['Metadata']['OS'] +assert not [v for x in scan['Results'] for v in x.get('Vulnerabilities',[])] +container=(S/'deploy/zlib-overlay/Containerfile').read_text();assert '--allow-untrusted' not in container and '--keys-dir' not in container and 'apk verify ' in container +result={'manifest_sha256':H(M.read_bytes()),'all27_staged_hashes_verified':True,'evidence_hashes_verified':True,'existing_source_tests':4,'existing_source_negative_mutations':8,'additional_product_negative_mutations':mutations,'saved_image_fs_and_layer_runtime_readback':True,'sbom_only_zlib_delta':True,'scan44_packages_zero_at_retained_db':True,'signed_archive_named_key_matches_unchanged_baseline_truststore':True,'signature_execution_basis':'Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.','native_actions':False,'candidate_published':False} +(O/'validation.json').write_text(json.dumps(result,indent=2)+'\n');print('Product source checks passed, 5 additional scope mutations refused.') diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json new file mode 100644 index 0000000..2db5495 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/independent-artifact-comparison.json @@ -0,0 +1,69 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json new file mode 100644 index 0000000..d09a3fc --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/evidence/2026-10-11-zlib-candidate-product-review/validation.json @@ -0,0 +1,21 @@ +{ + "manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "all27_staged_hashes_verified": true, + "evidence_hashes_verified": true, + "existing_source_tests": 4, + "existing_source_negative_mutations": 8, + "additional_product_negative_mutations": [ + "appfile", + "keys", + "world", + "network", + "provider" + ], + "saved_image_fs_and_layer_runtime_readback": true, + "sbom_only_zlib_delta": true, + "scan44_packages_zero_at_retained_db": true, + "signed_archive_named_key_matches_unchanged_baseline_truststore": true, + "signature_execution_basis": "Retained actual maker apk verify success against exact763 trusted keys; recipe enforces same check. Product independently checked signed archive metadata/hash/truststore identity, not a fresh apk execution.", + "native_actions": false, + "candidate_published": false +} diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md new file mode 100644 index 0000000..c100415 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md @@ -0,0 +1,55 @@ +# Exact amended zlib candidate Product confirmation + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact amended local T05 source candidate preparation only +manifest_sha256: 64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8 +comment: >- + Same completed T08 preparation trial: work-record refinement was prepared + before this formal exact acknowledgment. Initial Product agreement/manifest + 5f334 remains historical, including its bounded audit validation. This final + confirmation covers the guard refinement, not publication/native approval, + a second scored success or T05 completion. +``` + +All58 final staged hashes verify; all27 initial candidate snapshots match +immutable manifest8d345bb2. Actual initial-to-current diff changes only four +existing paths: artifact checker, its comparison and local-validation receipts, +and README. New audit tests/refinement record and original source archive are +additions. No Containerfile/workflow, signed APK/index/pins/four-file context, +package/runtime/backend/app/identity/policy artifact, scan/SBOM/DB or WP source +scope changed. Local daemon78bfdcc/config625d remain unpublished; source recipe +contextc554 and actual retained DB03cacb remain exact. Original four-source-test +and Product five negative-probe findings remain applicable, not needlessly rerun. + +The artifact checker now refuses optimized Python before any archive/JSON read, +so assertions cannot silently disappear. Directory mode/UID/GID metadata is +included in final layer reconstruction and diff enforcement. Three new source +tests pass: malformed archive under -O refuses explicitly before reads; identical +directory metadata passes; each mode/UID/GID mutation refuses without a report. +These fixtures are isolated synthetic source tests. Independent reread of actual +existing local saved-image archives confirms equal directory counts and no +directory metadata delta; the same two final changed files are libz and APK DB, +nine base layers remain prefix and effective runtime config/SBOM/scan match. +No new image build, container launch, scan, customer/native data or provider call +was performed by this review. + +Initial Product review and validation retain their exact bytes under +`docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/`; +original current review file remains the initial agreement, with this separate +final acknowledgment carrying the refinement. Signature trust conclusions stay +bounded to pinned signed artifacts/unchanged trust metadata, actual retained +maker apk verify and enforced recipe; this acknowledgment does not claim fresh +cryptographic execution. Zero findings remains specific to retained sameDB scan, +not an estate risk grade or future safety assurance. + +T05 remains progress, WP0009 active and manual follow-up due2026-10-18. Root +source review/commit and admitted owner CI candidate publication, exact actual +published registry provenance/package/full scan/SBOM, separate fresh native +founder release acceptance and installedr1/runtime/full-rescan proof remain +required. Existing approved R2 helper/journal, native image763, DB/config/PVC/ +identity and T04/c96 outcome are unchanged. INFD-IN-0010 remains unpromoted and +unimplemented. This technical acknowledgment grants no native action, human +acceptance, credential capability or publication execution. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md new file mode 100644 index 0000000..461d4d1 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md @@ -0,0 +1,74 @@ +# Bounded zlib candidate Product owner review + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact local zlib-only source candidate technical preparation +manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66 +comment: >- + Informed-decision intent requires human binding and preserved evidence; this + candidate changes only a native compression dependency while preserving + application authorization/presentation behavior. T08 review work record was + completed first. This is technical source agreement, not native go, publication + receipt, founder acceptance or T05 completion. +``` + +All27 staged hashes and retained evidence-file hashes independently verify. +Independent saved-image archive readback confirms all nine exact763 base diff_ids +as prefix, equal effective runtime configuration with only explicitly normalized +empty/false/null defaults, and final filesystem changes exactly +`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent. +Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL +and UID/GID10001 remain equal. Root build identity returns to10001:10001. +No service values, namespace, DB, customer data, config, PVC, schema, audience, +policy pins, protected helper or existing release journal is changed. + +Package/index bytes match pinned official HTTPS download hashes. Both signed +archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present +in unchanged baseline trust metadata. Retained actual maker apk verify success +against exact763 installed keys is the execution evidence; this review separately +checks archive signatures' metadata, bytes and trust identity, without claiming +a new signature-verification execution. Containerfile requires digest checks and +`apk verify` success before offline named-package upgrade; no allow-untrusted or +keys-dir override. Existing trusted keys are not replaced. +[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd) +defines integrity/signature checking and nonzero failure. +Upgrade selects only zlib from retained local signed index, disables network, +preupgrade and logging, and removes temporary public artifacts. + +Both full CycloneDX/Trivy artifacts independently show44 packages and only +zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM +CVE-2026-85091; candidate has zero findings at the retained same database +03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917. +No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning +and actual38 OS/6 Python detector coverage remain disclosed. This is bounded +scan improvement at that snapshot, not estate risk grading or future safety. +Local daemon image78bfdcc and saved OCI config625d are distinct disclosed +representations; neither is a published registry digest or native image proof. + +Four existing source tests pass, covering eight mutations; five additional Product +mutations of app source, trust keys, APK world, network and provider/data flags +refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt. +Retained four compression vectors/three malformed refusals/crypto/JWT/waitress +and ten installed purpose variants are local synthetic checks, not live PDP +or customer/native-data testing. No new container or native execution by reviewer. + +Workflow publishes only a source-bound candidate through existing admitted owner +registry capability after root source review/commit: exact40hex source revision, +fixed owner archive, four input hashes/contextc554, exact763 base, no-network +bounded build, unchanged runtime comparison and purpose checks before push. +It has no kubectl, Argo, DB/admin, namespace or runtime deployment action. +The workflow is unexecuted; source review does not attest CI credentials, actual +publication or published artifact equivalence. Root must retain actual CI/source +revision and registry descriptor/layer/config/package/signature/context readback, +then full published scan/SBOM and scoped candidate release preparation. Only +distinct exact informed-decision founder native approval followed by installedr1, +runtime/purpose and full-rescan proof can close T05. Future image-only rollback +to763 preserves latest DB; no historical snapshot restore. + +T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic +controller is implied. T04/c96 accepted outcome and original uncertain journals +remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted. +No new native authority, owner checkout write, credential/login, deployment or +customer-data access occurred in this review. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md new file mode 100644 index 0000000..c139962 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/intermediate-8bc6da55/owner-snapshot/workplans/ADHOC-2026-10-11.md @@ -0,0 +1,273 @@ +--- +id: INFD-WP-ADHOC-2026-10-11 +type: workplan +title: "Application-owner catalogue facts review" +domain: infotech +repo: informed-decision +status: finished +owner: codex +topic_slug: netkingdom +created: "2026-10-11" +updated: "2026-10-11" +flavor: planning +state_hub_workstream_id: "4594d714-a6ec-5ab6-ad44-4227a27fc7be" +--- + +## Review exact one-application catalogue facts + +```task +id: INFD-WP-ADHOC-2026-10-11-T01 +status: done +priority: medium +state_hub_task_id: "cfe1ec8c-c635-5f23-847c-bf8296965305" +``` + +Completed informed-decision application-owner source review under INTENT.md +Purpose, What informed-decision Owns/Does Not Own, Design Principles 9-10, +and Layer Placement. Read actual owner OIDC, requester and policy-request +code, governing Staff/PEP-shaped declaration, User Engine model, and existing +value-free native registration/Ingress/preflight receipts. Exact canonical +facts agree. Browser client is distinct from create-only requester. + +Review entry: docs/reviews/2026-10-11-one-app-catalogue-facts-review.md. +Canonical facts SHA-256: +`ae6fde5f2c879e75fabb53e132261899dae0f4d864e18dd425bc272be713426b`. +Reviewed refined nine-file executor manifest SHA-256: +`0ff545d26a0fd72f06040fe377de3efdcc3bd62cdcb6f653247c8ba72f3f34a7`. + +This task completes the application-facts source review only. It grants no +maintenance exception, native dry-run/apply/recovery, IAM permission, image +release or human disposition. Existing User Engine native acceptance work +remains with USER-WP-0026-T03 and USER-WP-0028-T02; no new residual work is +created by this bounded review. No tests were needed for this evidence-only +review; no native, credential or login action occurred. + +## Independently review purpose overlay release preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T02 +status: done +priority: medium +``` + +Completed same-role informed-decision-owner technical review of frozen36-path +purpose release manifest SHA-256 +`7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300`. +All36 staged file hashes and exact source PolicyClient9d7 hash were verified. +Source candidates and captured candidate Deployment differ only in the image. +Actual raw base/candidate scans contain the same one fixable MEDIUM zlib finding; +T05 keeps its2026-10-18 follow-through. Actual published-image receipts and +sealed native read-only preflight support preparation, not native deployment. + +Independent owner negatives:50 passed in4.21s, covering10 advisory/malformed +binding forms across register, replay, publish, annotate and revise. Each +refusal preserves every domain table, records a truthful invalid-decision +observation and leaves the same idempotency key reusable after restoring a +canonical enforcement response. These are synthetic source tests only. +Test: tests/test_purpose_owner_mutation_negatives.py. +Receipt: docs/evidence/2026-10-11-purpose-image-release/product-owner-review-validation.json. +Review: docs/reviews/2026-10-11-purpose-release-product-owner-review.md. + +This bounded review grants no native backup/export/restore, image rollout, +credentials, login, human disposition or vulnerability acceptance. Existing +INFD-WP-0009-T04/T05 retain release/remediation obligations; no separate residual +is created or claimed completed. Catalogue ACK/T01 remains unchanged. + +## Confirm amended purpose release custody and preflight gates + +```task +id: INFD-WP-ADHOC-2026-10-11-T03 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed amended78-path release manifest SHA-256 +`b1e3e66bc4023dc80c6ea59564c3557c7653fb3c307f46a049997b76198a9033`. +All78 file hashes verified, original36 archive retained, source PolicyClient9d7 +and both image-only source candidates unchanged. Prior50 source lifecycle +mutation/idempotency negatives remain applicable and were not repeated. + +Confirmed stdlib read-only schema5/integrity/count gate before ANY native or +restored Store/admin open, explicit local/remote optimized-interpreter refusal, +sealed actual ConfigMap/PVC identity/data/custody and frozen offline clone count +equality distinguished from legitimate concurrent live commits. Revised20-doc +184912-byte packet and01:39 read-only dry-run receipts remain preparation. +Native schema gate, backup/export/restore/release and founder disposition remain +unperformed; T04/T05 obligations and temporary vulnerability review persist. + +Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md. +Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/ +receipt remain unchanged. No new residual or authority is created by this review. + +## Reconcile Staff evidence source declaration and current guarantees + +```task +id: INFD-WP-ADHOC-2026-10-11-T04 +status: done +priority: medium +``` + +Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source +class definitions, transactional recording, heartbeat/reconciliation scheduling, +existing component-test assertions and native count/receipt evidence. Reconciled +stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening +finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending +NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual +source intake for remaining class-specific declaration/verification gaps, +origin INFD-WP-0007. No residual implementation or native action occurred. + +Source evidence reconciliation: +docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md. +Formal source review: +docs/reviews/2026-10-11-staff-evidence-source-owner-review.md. +Existing Staff/PEP-shaped classification, three load-bearing class classifications, +compromised-source and commitment/content availability limits remain unchanged. + +## Independently review supervised purpose actuator product boundaries + +```task +id: INFD-WP-ADHOC-2026-10-11-T05 +status: done +priority: medium +``` + +Same informed-decision-owner reviewed exact23-path helper manifest +`f2fad6c251fbb4420e07c1329802f521b513bbf66e51f64c5d673ef04f16284c`, +all staged hashes and embedded source bundle/plan. Product evidence/schema5, +private snapshot custody, confined offline UID0 initialization followed by +UID10001 pre/post-admin verification, independent failed-candidate rollback +and all-phase start deadline are technically agreed as source preparation. + +No purpose-policy or candidate image change. Retained helper16 synthetic tests +and platform5 independent recovery negatives are mechanism proof; prior50 +product policy negatives remain applicable. No new test run was needed for this +unchanged-source review. Native-provider acceptance remains distinct from the +installed10 synthetic purpose forms; T04 is not complete. Before first human +post, amend exact20-document packet to hash-bind helper/plan, four render inputs, +initializer/recovery/deadline refinements and preserved full scan provenance. +Exact combined packet acknowledgement remains a separate review gate. + +Review: docs/reviews/2026-10-11-purpose-actuator-product-owner-review.md. +No native reads/backups/export/restore/release, credentials, human disposition, +founder approval or phase authority was exercised by this review. + +## Prepare separately gated provider-derived denial mechanism probe + +```task +id: INFD-WP-ADHOC-2026-10-11-T06 +status: done +priority: medium +``` + +Prepared source-only readonly lifecycle.search provider-derived mechanism probe +with truthful informed-decision/review SERVICE and no human/StateHub attributes. +Actual lifecyclev2 permits only StateHub workload or admitted AAL2 humans, so a +canonical real DENY is required; no claims are invented to obtain ALLOW. +One actual provider response will remain in Pod memory; ten transformed +noncanonical purpose copies test installed consumer refusal without further +provider calls, DB/admin or act effects. This is a denial/binding mechanism +proof candidate, not actual authorized lifecycle or full T04 acceptance. + +Source: docs/evidence/2026-10-11-purpose-provider-probe/. +Ten synthetic source tests pass; no actual provider, credential, runtime config, +DB, native data or live action was accessed. Posted frozen112 packet/helper +remain unchanged. Exact separate founder go for this newly prepared probe and +its target must precede any execution; current memo has no acceptance and this +new helper is not hash-bound in that submitted packet. T04 remains progress. + +## Review exact existing-snapshot rescue version2 preparation + +```task +id: INFD-WP-ADHOC-2026-10-11-T07 +status: done +priority: medium +``` + +Reviewed exact66-path rescue manifest0867e27a6754dddff3eedbb333ab4ca4faa98ee31d383ebe940b8e054c6cabf7 +under the same informed-decision-owner role. Actual original backupCOMPLETE/copy +UNCERTAIN are retained; new rescue journal/phase and sourceversion2/newreviewown1 +require fresh founder acceptance. Immutable reads are bounded to proven frozen +closed snapshots; live/offline writable-clone reads remain WAL-aware/explicitclose. +Independent existing26 mocked tests plus41 subtests pass, and10 new product scope +guards pass (including eight refusal mutations and a frozen initial packet check). +No native command, DB open, credentials or rescue operation occurred. + +Initial review decision changes_requested: proposal.json misleadingly names old +f2fad helper manifest as execution_helper_manifest_sha256 after helper bytes changed; +label it original/historical and refreeze all dependent packet hashes. Correct +current bundle/plan digests already exist. The normalized test fixture is not an +owner edit or approval. Initial review/failure must remain after correction; +exact amended confirmation is still required before newhuman submission/execution. + +Review: docs/reviews/2026-10-11-purpose-rescue-product-owner-review.md. +Evidence/checks: docs/evidence/2026-10-11-purpose-rescue-product-review/. +T04 remains progress; original version1 approval is not newversion2 authority. + +**Amended source confirmation, same T07 trial:** exact134-path manifest +`d05d6e3b15df9acf1d7aef0ba2ec82a5a00d979ab1f324e981025cffe2cc753d` +corrects only the historical helper provenance label and dependent packet hashes; +original66 source and initial changes-requested review remain retained. Current +helper code/bundle49c9/plan9ce5 are unchanged. Strict typed sourceversion2/CAS1 +and20documents validate:173469packetbytes/240451revisionbytes. Eight scope +mutations and three packet mutations independently refuse. Final technical +source acknowledgement approved; no new human acceptance or native rescue. +Confirmation: docs/reviews/2026-10-11-purpose-rescue-product-owner-final-ack.md. + + +**Actual-outcome assessment preparation, same completed T07 trial:** independently +verified original receipt-byte hashes and source consumer path after approved +source c96b0c6 release. Offline schema5/admin/post counts match; fresh cutover +backup/private copy matches live post-release counts16/56/0, delivered336, +confirmed43. Independent image/module/config/PVC/controlled Pod and UID/GID10001 +checks pass. Actual post-rollout authenticated provider-backed outcomes readback +is separate from installed ten synthetic purpose forms (2allow/8refuse). +Completed source-only assessment supports T04 done, T05 todo and WP0009 active. +Original failed copy and verifier UNCERTAIN remain preserved, with no replay or +helper amendment. Created unpromoted INFD-IN-0010 for future verifier omission +handling correction; no implementation, native action or authority grant. +This work-record preparation precedes the formal actual-outcome review entry. +Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md. +Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/. + + +## Independently review bounded zlib-only T05 source candidate + +```task +id: INFD-WP-ADHOC-2026-10-11-T08 +status: done +priority: medium +``` + +Completed informed-decision Product source review of exact27-path candidate +manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66. +All staged/evidence hashes verify. Independently reread local saved base/candidate +image archives, effective runtime config, nine base layer prefix, two final file +changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs; +44 packages/base1MED to candidate0 at retained same scanner database. +Signed APK/index named key matches unchanged base trust metadata; enforced +apk verify against existing keys retained, no allow-untrusted or truststore override. +Four existing source tests pass (eight refusal mutations), plus five independent +appfile/trustkeys/world/network/provider metadata mutations refuse. +Purpose/backend checks remain local and synthetic, not actual PDP or data proof. +Technical source preparation agreement only: local image78bfdcc is unpublished, +T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and +new native founder approval/installed proof are still required. Current763/native +DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010 +is unpromoted/unimplemented. No native actions, credentials or owner source writes. +This completed work record is prepared before the formal review entry. +Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md. +Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/. + + +**Exact amended confirmation, same completed T08 preparation trial:** verified +final58-path candidate manifest64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8 +and immutable archived initial27 hashes. Only artifact-audit source/receipts/docs +change; recipe/workflow/four build inputs/image78bfdcc/config625d/runtime/scan/DB +remain identical. New3 artifact tests pass (optimized malformed input refused +before reads; matching directories pass; directory mode/UID/GID drift refuse). +Independent actual saved-image reread proves all directory metadata unchanged, +with the same two final file changes. Initial Product manifest5f334/ack/validation +are retained as historical source agreement, not new scored native success. +This work-record refinement precedes final formal acknowledgment. No publication, +native operation, credentials or owner edits. T05progress/WP0009active remains. +Confirmation: docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md. diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json new file mode 100644 index 0000000..dd4bb80 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/negative-probe-receipt.json @@ -0,0 +1,24 @@ +[ + { + "marker": "usr/.wh..wh..opq", + "same_layer_new": "usr/new", + "actual_names": [ + "usr" + ], + "same_layer_new_preserved": false + }, + { + "marker": ".wh..wh..opq", + "same_layer_new": "new", + "actual_names": [], + "same_layer_new_preserved": false + }, + { + "marker": "usr/.wh.child", + "same_layer_new": "usr/child/new", + "actual_names": [ + "usr" + ], + "same_layer_new_preserved": false + } +] diff --git a/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py new file mode 100644 index 0000000..80d2197 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/probe_same_layer_whiteout.py @@ -0,0 +1,23 @@ +import ast,tarfile,io,json,hashlib,tempfile +from pathlib import Path +P=Path(__file__).parent +ns={'Path':Path,'tarfile':tarfile,'json':json,'hashlib':hashlib};tree=ast.parse((P/'frozen66-verify_local_artifacts.py').read_text());fn=next(x for x in tree.body if isinstance(x,ast.FunctionDef) and x.name=='image');exec(compile(ast.Module(body=[fn],type_ignores=[]),'reader','exec'),ns) +def add(t,name,data): + m=tarfile.TarInfo(name);m.mode=0o755 + if data is None:m.type=tarfile.DIRTYPE;t.addfile(m) + else:m.size=len(data);t.addfile(m,io.BytesIO(data)) +def layer(entries): + b=io.BytesIO() + with tarfile.open(fileobj=b,mode='w') as t: + for name,data in entries:add(t,name,data) + return b.getvalue() +results=[] +for marker,new in [('usr/.wh..wh..opq','usr/new'),('.wh..wh..opq','new'),('usr/.wh.child','usr/child/new')]: + base=layer([('usr',None),('usr/child',None),('usr/child/old',b'old')]);over=layer([(new,b'new'),(marker,b'')]) + with tempfile.TemporaryDirectory() as tmp: + path=Path(tmp)/'image.tar' + with tarfile.open(path,'w') as t: + add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':['base.tar','over.tar']}]).encode());add(t,'config.json',json.dumps({'config':{},'rootfs':{'diff_ids':['base','over']}}).encode());add(t,'base.tar',base);add(t,'over.tar',over) + _,_,files=ns['image'](path);results.append(dict(marker=marker,same_layer_new=new,actual_names=sorted(files),same_layer_new_preserved=new in files)) +print(json.dumps(results,indent=2)) +assert all(not r['same_layer_new_preserved'] for r in results),'finding no longer reproduced' diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md b/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md new file mode 100644 index 0000000..b0795d0 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md @@ -0,0 +1,15 @@ +# Separate T05 zlib-only candidate — local verified, unpublished/unapproved + +Exact current purpose image763c is the base. Signed official Alpine3.24/main/x86_64 zlib1.3.2-r1 and APKINDEX are preserved as exact public source artifacts in deploy/zlib-overlay with their HTTPS origin/SHA/packagecommit/signature metadata. Both actually verified against base trusted keys. The offline named-package upgrade uses only that repository, disables preupgrade/network/logging, restoresUID10001 and removes temporarypublic artifacts. Only final libz binary and APK installeddatabase differ; world/repository/keys/app36files/Python/OpenSSL/policy9d remain unchanged. Raw Docker legacy/OCI default serialization differs; effective runtime config is proved equal, not byte-identical. + +Local daemonimageID78bfdcc... differs from Docker-save OCIconfig625d... after serialization; both are explicitly identified in receipt. Neither is a registry/release digest. Localfull sameDB scan covers44packages: baseactual1MEDCVE85091, candidatezeroallseverity; fullbaseline/candidateJSON+CycloneDX and filesystemaudit retained. Alpine3.24 EOLlistwarning/detection coverage is disclosed. No filters/ignoreunfixed or estateRiskgrade. Four source tests include eight unrelatedpackage/source/identity/backend/database/Python/artifactmutation refusals; actualcompression/crypto/JWT/waitress andteninstalledpurpose variants pass. Purpose providertransport remains synthetic, no database/provider/customerdata accessed. + +Four-file sourcecontext hashc554e62a... is actualbuiltinput; localOCIrevision is honestly uncommitted preparation. New sourceworkflow uses exact GITHUB_SHA/archive/four inputhashes and existing admitted ownerregistry capability; no newPAT/login/grant. It publishes only a candidate with installedpackage/appidentity/purpose guards. CIpublication has NOT run. Root must commit/source-sync thenverifyactualregistry/nativeCI provenance and fullscan/SBOM before any new release question. Do notpin a localimageID in owneradmission/servicevalues. + +T05 staysprogress/planactive, manualfollowupdueOct18 withoutautotimer. T04/nativec96/protectedjournals/snapshotcustody/helpers/current763deployment remain untouched. Only after actualpublishedproof, exact scopedfounderapproval andnativeinstalledr1/runtime/fullrescan canT05 close. Futureimage-onlyrollbackkeepslatestDB and prior763, neverrestoresoldrecords. See proposal.json/local-candidate-verification.json for exactproofs/refinementlimits. + +Platform audit refinement (same T05 proposal): the checker now refuses optimized Python before artifact reads and compares directory mode, UID and GID. The actual existing image passed the expanded audit with no directory changes and the same two changed files. Three synthetic tests cover optimization and three directory drift cases. Original 27-file source/manifest and actual scan receipts are retained in `initial-8d345bb2/`; this was a source guard correction, not an original candidate failure. Recipe, four-file build context, image78 and full scan bytes are unchanged. + +Whiteout refinement: preserve the leading dot in OCI whiteout names and model root/nested removal and opaque directories. Four semantic fixtures pass. Actual image re-audit still reports 313 unchanged directories and only the same two changed files. Intermediate 64509029 manifest and changed evidence bytes are retained separately; the existing candidate did not fail. + +Whiteout refinement: preserve the leading dot in OCI whiteout names and model root/nested removal and opaque directories. Twelve semantic fixtures pass, including reversed tar-order same-layer additions/replacements. Actual image re-audit still reports 313 unchanged directories and only the same two changed files. Intermediate 64509029 and 3e41ab39 manifests and changed evidence bytes are retained separately; the existing candidate did not fail. diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json new file mode 100644 index 0000000..c99f1fb --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json @@ -0,0 +1,75 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "directory_metadata_compared": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false, + "candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "candidate_local_image_config_id_kind": "Docker-save OCI export config SHA; distinct from legacy daemon imageID; closed default serialization differs." +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json new file mode 100644 index 0000000..099601f --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json @@ -0,0 +1,26 @@ +{ + "proposal_id": "INFD-WP-0009-T05/zlib-85091-r1", + "same_trial": true, + "original_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "original_local_verification_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1", + "reason": "Platform source-review guard gaps; original actual candidate/build/scan did not fail", + "changes": [ + "Explicit optimized Python refusal before any archive/JSON read", + "Filesystem audit includes final directory mode/UID/GID metadata", + "Three synthetic tests: optimized malformed artifact refuses before read; unchanged directory passes; mode/UID/GID mutation refuses", + "Preserve OCI whiteout leading dots and clear root/nested descendants correctly; four semantic fixtures cover removal and opacity", + "Whiteouts mask lower layers only; merge same-layer additions after masking. Eight root/nested opacity, sibling and replacement tar-order fixtures added" + ], + "actual_existing_artifact_reaudit": "Passed; no directory metadata differences, same two changed files", + "candidate_image_unchanged": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "four_file_build_context_unchanged": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "registry_publication": false, + "native_changes": false, + "checker_sha256": "d727f60edd004184c79903c20619643033fac68afbecfb1990cce855cdb924e3", + "tests_sha256": "12ba4ce8c082450241118d73139c59e06b3a337b152e3364918a5b2850f2dc47", + "comparison_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89", + "verification_sha256": "efbb173dcb9358b58bd703a18e63c6c25805167d5a14856ed095d05be4309709", + "intermediate_source_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8", + "whiteout_refinement_note": "Conservative incorrect effective-rootfs modeling in the intermediate checker, not failure of the actual candidate", + "layer_order_review_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0" +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json new file mode 100644 index 0000000..b45c853 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json @@ -0,0 +1 @@ +{"uid": 10001, "gid": 10001, "policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", "policy_mode": "0o644", "policy_uid": 0, "app_file_sha256": {"__init__.py": "0ffebe048ba583e7b623f60e8f449950dc5fd49afce2398381fa143eee834e19", "__main__.py": "3ba1467fa2d47fcf0bd032e8694904450775adf763a6e6f9e4888cc3ce3ed92b", "approval_client.py": "56c201dda358cb4bef11a15da141bb68562cdde9e37b4a880bf1e9257ae82cb6", "approval_http.py": "dfaac1faed80a068aa78a8c87b80db99b8887a8fc3767eebc9d6261a98f1e334", "audit.py": "06da36a8f3451b4abc7a46da2df66d5939524c170658b879499b2a47a1b10cd3", "canonicalize.py": "517bbc6b81cc839636b97863ebdefd38aa375d10f4915feb9bf21867f992f765", "container.py": "5f40d2321ee3f52673238011116e741e7b2ac17e28119f100fbcc490db208fbc", "disposition.py": "5ddd19c2444f8e6c9bb090d04045cf1227a34554e000f07b3f677325bf8089f8", "evidence.py": "169ed59ac53ef534a6db835ba371a92177c0ffb000b04203507242e2159ebc21", "http_transport.py": "eda90098f8bf2e5a47d819bf6ae0b0d1dcaf9a87aad3cb61503d060be666339a", "hub_writeback.py": "98b9caa8096c2c3eb8ecfe33900a0ace98453e7608f504fd08a64f50156519a3", "intake.py": "a733b4b608b9ea90b2c8293901aa14388a0bf0d3719f121038bfdcc1faca2038", "intake_approval.py": "52f8b3643e4c5c6f56f2ef1fd9c7747da2165f8f88122e93b3f3ee3ecae48c73", "intake_delivery.py": "4771520cc96325d93bc3f8e08005c3d714a5597582cb1adccc0b0fa73dac0b0d", "intake_hub.py": "c3daddce31791a6e82f7b07406ef4d75bccba5a278fab01dab378a06abceabc8", "intake_service.py": "99ea285a725c58b7571e2a69ceb558f16bbcca4ec391607a0cc2d0459de3b318", "lifecycle.py": "e25f865828e541b2889cd6c9afe0ce7ca4441bf35155304cc7de7c86c44b28e8", "lifecycle_commands.py": "783ec451dd7ef33dc0cfd72c1633ea5208dfd463afeaa0b68d279f156a9b0828", "lifecycle_http.py": "d4b95421d54663f041a10b4f42ac9c013493fa7a770223ab45877b451a7a7c7d", "lifecycle_review.py": "b6d69be6c56f3e2f411501083e199195190df6c740a01b07e82a476268ca3629", "lifecycle_service.py": "2dde9280214e68e5e7a7b48d703886947c2a46139ada86e8ff2283a9d4b55a70", "lifecycle_ui.py": "448e9169607c487e362d4d0d1730aec33987b6dcf12c49dfff7de3aaaab7ae03", "memo.py": "697058863a4e6de2c143a2433eaaf5e15e5e7375dc5459af6911b146567e8b5d", "oidc.py": "6b24dac9537a12141a361c4577feaf42f6c197d8d87da16ca47a08daf6916915", "policy.py": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", "presentation.py": "54375ccd8358fac41de220bccadbee09f8b7c8ebbeeafaafd381a7456331da50", "provenance.py": "de02c6bf162865ba9619d74cfd68dd0a5d7f81e6c9e427f67f848cb2c2214f83", "records.py": "82f696151895c51b168144a3078d05764da3499b96917c465629ce0836fa8e33", "requester.py": "66de1af80a5fb2442c1e4407148b581de24b671b5f76c9d2a0458d38e27833a8", "review.py": "d4a085b0ee3e65a9976b9b656ec87a8c735be8d74cfdc9bb55feeb90917c688e", "runtime.py": "535940eed76c5f21ec4c379796fbfddfd85fc309aad0de4d64afda06cdc2d3c5", "stance.py": "62b96b76eba4ec277344172f10f6233e979dda4d079f972d9a55c4e5aed96c3c", "store.py": "9c14b10becb99da19349073e9aa691c25a205df4a2c4d932f37d64f13e8d3b41", "ui.py": "ff0671dc7be4d08ab8f0d38504f70afd355ad3a8a6293620c75864ca56a53ec9", "web.py": "bd08a6b0ea0e418ea1e31e46edab6b7478de9779b823af4f5d72fd1346197e42", "workload.py": "b86cebf5e7a8182b24bb7f9fdbd6f0e17b578d690d9f06c541e713d7d995c5e8"}, "apk_packages": {".python-rundeps": "20260901.001029", "alpine-baselayout": "3.7.2-r1", "alpine-baselayout-data": "3.7.2-r1", "alpine-keys": "2.6-r0", "alpine-release": "3.24.1-r0", "apk-tools": "3.0.6-r0", "busybox": "1.37.0-r31", "busybox-binsh": "1.37.0-r31", "ca-certificates": "20260611-r0", "ca-certificates-bundle": "20260611-r0", "gdbm": "1.26-r0", "keyutils-libs": "1.6.3-r4", "krb5-conf": "1.0-r2", "krb5-libs": "1.22.2-r1", "libapk": "3.0.6-r0", "libbz2": "1.0.8-r6", "libcom_err": "1.47.4-r0", "libcrypto3": "3.5.8-r0", "libffi": "3.5.2-r1", "libintl": "1.0-r0", "libncursesw": "6.6_p20260516-r0", "libnsl": "2.0.1-r2", "libpanelw": "6.6_p20260516-r0", "libssl3": "3.5.8-r0", "libtirpc": "1.3.5-r1", "libtirpc-conf": "1.3.5-r1", "libuuid": "2.42.3-r1", "libverto": "0.3.2-r2", "musl": "1.2.6-r2", "musl-utils": "1.2.6-r2", "ncurses-terminfo-base": "6.6_p20260516-r0", "readline": "8.3.3-r1", "scanelf": "1.3.9-r1", "sqlite-libs": "3.53.4-r0", "ssl_client": "1.37.0-r31", "tzdata": "2026c-r0", "xz-libs": "5.8.3-r0", "zlib": "1.3.2-r0"}, "apk_world_sha256": "61a659443a49627ba7114faa13a4870a2ede26b314064829ced169412be7002e", "apk_keys_sha256": {"alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub": "9c102bcc376af1498d549b77bdbfa815ae86faa1d2d82f040e616b18ef2df2d4", "alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub": "12f899e55a7691225603d6fb3324940fc51cd7f133e7ead788663c2b7eecb00c", "alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub": "207e4696d3c05f7cb05966aee557307151f1f00217af4143c1bcaf33b8df733f"}, "python_dependencies": {"informed-decision": "0.2.0", "PyJWT": "2.15.1", "cryptography": "50.0.1", "cffi": "2.1.1", "pycparser": "3.0", "waitress": "3.0.2"}, "zlib_runtime_version": "1.3.2", "zlib_compile_version": "1.3.2", "libz_sha256": "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57", "compression_vectors_pass": 4, "malformed_zlib_refusals": 3, "crypto_jwt_waitress_smoke": true, "openssl": "OpenSSL 3.5.8 25 Aug 2026", "network_accessed": false, "database_opened": false, "provider_or_customer_data_used": false} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json new file mode 100644 index 0000000..389d805 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json @@ -0,0 +1,2551 @@ +{ + "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json", + "bomFormat": "CycloneDX", + "specVersion": "1.7", + "serialNumber": "urn:uuid:87d25a8f-5c4e-45a5-ba01-10fe9ffc3512", + "version": 1, + "metadata": { + "timestamp": "2026-10-11T07:27:24+00:00", + "tools": { + "components": [ + { + "type": "application", + "manufacturer": { + "name": "Aqua Security Software Ltd." + }, + "group": "aquasecurity", + "name": "trivy", + "version": "0.74.0" + } + ] + }, + "component": { + "bom-ref": "72113269-9efb-4c6a-a07f-752a12125747", + "type": "container", + "name": "/artifact/base-image.tar", + "properties": [ + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "name": "aquasecurity:trivy:ImageID", + "value": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779" + }, + { + "name": "aquasecurity:trivy:Labels:org.opencontainers.image.base.digest", + "value": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173" + }, + { + "name": "aquasecurity:trivy:Labels:org.opencontainers.image.revision", + "value": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168" + }, + { + "name": "aquasecurity:trivy:Labels:social.coulomb.release.scope", + "value": "INFD-WP-0009-T04/purpose-overlay-v1" + }, + { + "name": "aquasecurity:trivy:Labels:social.coulomb.source.policy.sha256", + "value": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + { + "name": "aquasecurity:trivy:SchemaVersion", + "value": "2" + }, + { + "name": "aquasecurity:trivy:Size", + "value": "88258048" + } + ] + } + }, + "components": [ + { + "bom-ref": "65b030f2-ac92-4cbc-a6e6-f92890b5a5f5", + "type": "operating-system", + "name": "alpine", + "version": "3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:Class", + "value": "os-pkgs" + }, + { + "name": "aquasecurity:trivy:Type", + "value": "alpine" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "type": "library", + "name": ".python-rundeps", + "version": "20260901.001029", + "hashes": [ + { + "alg": "SHA-1", + "content": "51d0c1e7d88a414345799f0309185c625013ef32" + } + ], + "purl": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": ".python-rundeps@20260901.001029" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-baselayout-data", + "version": "3.7.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "c6f9bded17d844b6f1b0bb5766d2c35c0d5c8508" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-baselayout-data@3.7.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-baselayout" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.7.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-baselayout", + "version": "3.7.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "f0fcfdc2f4da058af6473bc45c4eab62916225b2" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-baselayout@3.7.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-baselayout" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.7.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-keys", + "version": "2.6-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "d8d6b80e53c059a77e4915da78ba964f3ffea240" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-keys@2.6-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-keys" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2.6-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-release", + "version": "3.24.1-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "bc6912a25cdc7733e0035ed509eceaa4026946e3" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-release@3.24.1-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-base" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.24.1-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "apk-tools", + "version": "3.0.6-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "043333589798a1f52e09ae63f026c6c8fa676d34" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "apk-tools@3.0.6-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "apk-tools" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.0.6-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Sören Tempel " + }, + "name": "busybox-binsh", + "version": "1.37.0-r31", + "hashes": [ + { + "alg": "SHA-1", + "content": "5cbd14acc6f1804c5bac6c77dc2c492f010b0fc7" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "busybox-binsh@1.37.0-r31" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "busybox" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.37.0-r31" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Sören Tempel " + }, + "name": "busybox", + "version": "1.37.0-r31", + "hashes": [ + { + "alg": "SHA-1", + "content": "b5405ebc02f7dd8be95b6265c54b243d5456ab8f" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "busybox@1.37.0-r31" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "busybox" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.37.0-r31" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "ca-certificates-bundle", + "version": "20260611-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "c9534a03750bdfae341f10969016090fc11febbd" + } + ], + "licenses": [ + { + "license": { + "id": "MPL-2.0" + } + }, + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ca-certificates-bundle@20260611-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ca-certificates" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "20260611-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "ca-certificates", + "version": "20260611-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "8f2a04abeb54b331e2970a0a0dffb7bd6bdde567" + } + ], + "licenses": [ + { + "license": { + "id": "MPL-2.0" + } + }, + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ca-certificates@20260611-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ca-certificates" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "20260611-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "gdbm", + "version": "1.26-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "619493d8124fe49a8ee1d8f7a1372cf7e3977337" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-3.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "gdbm@1.26-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "gdbm" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.26-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "keyutils-libs", + "version": "1.6.3-r4", + "hashes": [ + { + "alg": "SHA-1", + "content": "b7331c96f077fc3522ee4361a441d1097204cd90" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-or-later" + } + }, + { + "license": { + "id": "LGPL-2.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "keyutils-libs@1.6.3-r4" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "keyutils" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.6.3-r4" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "krb5-conf", + "version": "1.0-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "40a11e0690a59e110367b62a80661024e9942a2d" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "krb5-conf@1.0-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "krb5-conf" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.0-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "krb5-libs", + "version": "1.22.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "ef02346e21b817ff379e4601e5b1fc9760e5e31a" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "krb5-libs@1.22.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "krb5" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.22.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libapk", + "version": "3.0.6-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "523a8f58104589f74f743d501c81bf6517155378" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libapk@3.0.6-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "apk-tools" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.0.6-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libbz2", + "version": "1.0.8-r6", + "hashes": [ + { + "alg": "SHA-1", + "content": "08566ba5c7af97c25474be8b24e8b48f0116b67d" + } + ], + "licenses": [ + { + "license": { + "name": "bzip-2-1.0.6" + } + } + ], + "purl": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libbz2@1.0.8-r6" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "bzip2" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.0.8-r6" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libcom_err", + "version": "1.47.4-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "4b9fb5899ea0b1c0cfbb2a2c5952704437d4ecef" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-or-later" + } + }, + { + "license": { + "id": "LGPL-2.0-or-later" + } + }, + { + "license": { + "id": "BSD-3-Clause" + } + }, + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libcom_err@1.47.4-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "e2fsprogs" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.47.4-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libcrypto3", + "version": "3.5.8-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "1b3b9fc0c136f4936932bcb2ec21499f0ae5dfd3" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "purl": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libcrypto3@3.5.8-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "openssl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.5.8-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libffi", + "version": "3.5.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "2f7b261f7fcecc4eebd8b330e7f6fb80713bfe3a" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libffi@3.5.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libffi" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.5.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Carlo Landmeter " + }, + "name": "libintl", + "version": "1.0-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "282d6642ccac87237e43a864159d73cf5abe7550" + } + ], + "licenses": [ + { + "license": { + "id": "LGPL-2.1-or-later" + } + } + ], + "purl": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libintl@1.0-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "gettext" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.0-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Milan P. Stanić " + }, + "name": "libncursesw", + "version": "6.6_p20260516-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "9f318e6e324d6827274829194cf6ac6afbaded12" + } + ], + "licenses": [ + { + "license": { + "name": "X-11" + } + } + ], + "purl": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libncursesw@6.6_p20260516-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ncurses" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "6.6_p20260516-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "name": "libnsl", + "version": "2.0.1-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "5194adbf26560b52be318481a7af294ab05fd795" + } + ], + "licenses": [ + { + "license": { + "id": "LGPL-2.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libnsl@2.0.1-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libnsl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2.0.1-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Milan P. Stanić " + }, + "name": "libpanelw", + "version": "6.6_p20260516-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "149bdc434232ed11fc5bb975ba519a07154a6f56" + } + ], + "licenses": [ + { + "license": { + "name": "X-11" + } + } + ], + "purl": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libpanelw@6.6_p20260516-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ncurses" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "6.6_p20260516-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libssl3", + "version": "3.5.8-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "5f9b1e55d821953d2e2b1db322dad70a3b5041ea" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "purl": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libssl3@3.5.8-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "openssl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.5.8-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libtirpc-conf", + "version": "1.3.5-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "0c17d9988dc986c90e22f79778df047eca9973ff" + } + ], + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libtirpc-conf@1.3.5-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libtirpc" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.5-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libtirpc", + "version": "1.3.5-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "c32865bd86a8b8829d152279cabbc5ac6d430eb2" + } + ], + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libtirpc@1.3.5-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libtirpc" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.5-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libuuid", + "version": "2.42.3-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "8f041ef637ad75f381cc0c034f2afbbb0303264e" + } + ], + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libuuid@2.42.3-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "util-linux" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2.42.3-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Francesco Colista " + }, + "name": "libverto", + "version": "0.3.2-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "73233059338142e4ac6d8fb8bb0074e93da75dc1" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libverto@0.3.2-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libverto" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "0.3.2-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "musl-utils", + "version": "1.2.6-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "75ada3c48d63ec5d87c42fdf934a3fdd11298dc5" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + }, + { + "license": { + "id": "BSD-2-Clause" + } + }, + { + "license": { + "id": "GPL-2.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "musl-utils@1.2.6-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "musl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.2.6-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "musl", + "version": "1.2.6-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "0f7e5827e4e1a73631beda27b78431a8ba240e05" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "musl@1.2.6-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "musl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.2.6-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Milan P. Stanić " + }, + "name": "ncurses-terminfo-base", + "version": "6.6_p20260516-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "9d551d828e9c8ee52c5801c1d6046828ebf15752" + } + ], + "licenses": [ + { + "license": { + "name": "X-11" + } + } + ], + "purl": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ncurses-terminfo-base@6.6_p20260516-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ncurses" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "6.6_p20260516-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "qaqland " + }, + "name": "readline", + "version": "8.3.3-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "945b16e378bc00e44d89d4de8124bba7647fdf4d" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-3.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "readline@8.3.3-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "readline" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "8.3.3-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "scanelf", + "version": "1.3.9-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "013f903d0ba219673aebbdd04f74bb5ed82b01f0" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "scanelf@1.3.9-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "pax-utils" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.9-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Jingyun Hua " + }, + "name": "sqlite-libs", + "version": "3.53.4-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "f7630ceb37c232b6609861aeab6cdb9cd120e6fa" + } + ], + "licenses": [ + { + "license": { + "id": "blessing" + } + } + ], + "purl": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "sqlite-libs@3.53.4-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "sqlite" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.53.4-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Sören Tempel " + }, + "name": "ssl_client", + "version": "1.37.0-r31", + "hashes": [ + { + "alg": "SHA-1", + "content": "c220f4a5125a313af733e98def94132bb1e9d40d" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ssl_client@1.37.0-r31" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "busybox" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.37.0-r31" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "tzdata", + "version": "2026c-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "61f7544ecd8dd63eac23fe3e645702fda92ef02a" + } + ], + "licenses": [ + { + "license": { + "name": "Public-Domain" + } + } + ], + "purl": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "tzdata@2026c-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "tzdata" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2026c-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "xz-libs", + "version": "5.8.3-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "4c92c5be0c5bef404e93c880eba9037a9b147347" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-or-later" + } + }, + { + "license": { + "id": "0BSD" + } + }, + { + "license": { + "name": "Public-Domain" + } + }, + { + "license": { + "id": "LGPL-2.1-or-later" + } + } + ], + "purl": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "xz-libs@5.8.3-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "xz" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "5.8.3-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "zlib", + "version": "1.3.2-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "dd4c3d102acaef2a71a1495951d55fabc8680613" + } + ], + "licenses": [ + { + "license": { + "id": "Zlib" + } + } + ], + "purl": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "zlib@1.3.2-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "zlib" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.2-r0" + } + ] + }, + { + "bom-ref": "pkg:pypi/cffi@2.1.1", + "type": "library", + "name": "cffi", + "version": "2.1.1", + "licenses": [ + { + "license": { + "id": "MIT-0" + } + } + ], + "purl": "pkg:pypi/cffi@2.1.1", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/cryptography@50.0.1", + "type": "library", + "name": "cryptography", + "version": "50.0.1", + "licenses": [ + { + "expression": "Apache-2.0 OR BSD-3-Clause" + } + ], + "purl": "pkg:pypi/cryptography@50.0.1", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/cryptography-50.0.1.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/informed-decision@0.2.0", + "type": "library", + "name": "informed-decision", + "version": "0.2.0", + "purl": "pkg:pypi/informed-decision@0.2.0", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/informed_decision-0.2.0.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/pycparser@3.0", + "type": "library", + "name": "pycparser", + "version": "3.0", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:pypi/pycparser@3.0", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/pycparser-3.0.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/pyjwt@2.15.1", + "type": "library", + "name": "PyJWT", + "version": "2.15.1", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:pypi/pyjwt@2.15.1", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/pyjwt-2.15.1.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/waitress@3.0.2", + "type": "library", + "name": "waitress", + "version": "3.0.2", + "licenses": [ + { + "license": { + "id": "ZPL-2.1" + } + } + ], + "purl": "pkg:pypi/waitress@3.0.2", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/waitress-3.0.2.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + } + ], + "dependencies": [ + { + "ref": "65b030f2-ac92-4cbc-a6e6-f92890b5a5f5", + "dependsOn": [ + "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "72113269-9efb-4c6a-a07f-752a12125747", + "dependsOn": [ + "65b030f2-ac92-4cbc-a6e6-f92890b5a5f5", + "pkg:pypi/cffi@2.1.1", + "pkg:pypi/cryptography@50.0.1", + "pkg:pypi/informed-decision@0.2.0", + "pkg:pypi/pycparser@3.0", + "pkg:pypi/pyjwt@2.15.1", + "pkg:pypi/waitress@3.0.2" + ] + }, + { + "ref": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:pypi/cffi@2.1.1", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/cryptography@50.0.1", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/informed-decision@0.2.0", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/pycparser@3.0", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/pyjwt@2.15.1", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/waitress@3.0.2", + "dependsOn": [] + } + ], + "vulnerabilities": [ + { + "id": "CVE-2026-85091", + "source": { + "name": "alpine", + "url": "https://secdb.alpinelinux.org/" + }, + "ratings": [ + { + "source": { + "name": "ubuntu" + }, + "severity": "medium" + } + ], + "cwes": [ + 787 + ], + "description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", + "recommendation": "Upgrade zlib to version 1.3.2-r1", + "advisories": [ + { + "url": "https://avd.aquasec.com/nvd/cve-2026-85091" + }, + { + "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" + }, + { + "url": "https://github.com/madler/zlib" + }, + { + "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393" + }, + { + "url": "https://www.cve.org/CVERecord?id=CVE-2026-85091" + }, + { + "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" + } + ], + "published": "2026-09-03T13:06:20+00:00", + "updated": "2026-09-09T20:41:07+00:00", + "affects": [ + { + "ref": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1", + "versions": [ + { + "version": "1.3.2-r0", + "status": "affected" + } + ] + } + ] + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json new file mode 100644 index 0000000..3c4ff89 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json @@ -0,0 +1,2387 @@ +{ + "SchemaVersion": 2, + "Trivy": { + "Version": "0.74.0" + }, + "ReportID": "01a129db-cdaf-7437-981b-0d63c6d47346", + "CreatedAt": "2026-10-11T07:27:13.327278878Z", + "ArtifactID": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "ArtifactName": "/artifact/base-image.tar", + "ArtifactType": "container_image", + "Metadata": { + "Size": 88258048, + "OS": { + "Family": "alpine", + "Name": "3.24.1" + }, + "ImageID": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "DiffIDs": [ + "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c", + "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd", + "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366", + "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe", + "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1", + "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c", + "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59", + "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02", + "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + ], + "ImageConfig": { + "architecture": "amd64", + "created": "2026-10-11T01:21:04.787527697Z", + "docker_version": "27.5.1", + "history": [ + { + "created": "2026-06-16T00:01:29.967161902Z", + "created_by": "ADD alpine-minirootfs-3.24.1-x86_64.tar.gz / # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-06-16T00:01:29.967161902Z", + "created_by": "CMD [\"/bin/sh\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV LANG=C.UTF-8", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "RUN /bin/sh -c set -eux; \tapk add --no-cache \t\tca-certificates \t\ttzdata \t; # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PYTHON_VERSION=3.12.14", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:10:30.672225972Z", + "created_by": "RUN /bin/sh -c set -eux; \t\tapk add --no-cache --virtual .build-deps \t\tbluez-dev \t\tbzip2-dev \t\tdpkg-dev dpkg \t\tfindutils \t\tg++ \t\tgcc \t\tgdbm-dev \t\tgnupg \t\tlibc-dev \t\tlibffi-dev \t\tlibnsl-dev \t\tlibtirpc-dev \t\tlinux-headers \t\tmake \t\tncurses-dev \t\topenssl-dev \t\tpax-utils \t\treadline-dev \t\tsqlite-dev \t\ttar \t\ttcl-dev \t\ttk \t\ttk-dev \t\tutil-linux-dev \t\txz \t\txz-dev \t\tzlib-dev \t; \t\twget -O python.tar.xz \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz\"; \techo \"$PYTHON_SHA256 *python.tar.xz\" | sha256sum -c -; \twget -O python.tar.xz.asc \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc\"; \tGNUPGHOME=\"$(mktemp -d)\"; export GNUPGHOME; \tgpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$GPG_KEY\"; \tgpg --batch --verify python.tar.xz.asc python.tar.xz; \tgpgconf --kill all; \trm -rf \"$GNUPGHOME\" python.tar.xz.asc; \tmkdir -p /usr/src/python; \ttar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; \trm python.tar.xz; \t\tcd /usr/src/python; \tgnuArch=\"$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)\"; \t./configure \t\t--build=\"$gnuArch\" \t\t--enable-loadable-sqlite-extensions \t\t--enable-option-checking=fatal \t\t--enable-shared \t\t$(test \"${gnuArch%%-*}\" != 'riscv64' \u0026\u0026 echo '--with-lto') \t\t--with-ensurepip \t; \tnproc=\"$(nproc)\"; \tEXTRA_CFLAGS=\"-DTHREAD_STACK_SIZE=0x100000\"; \tLDFLAGS=\"${LDFLAGS:-} -Wl,--strip-all\"; \tarch=\"$(apk --print-arch)\"; \tcase \"$arch\" in \t\tx86_64|aarch64) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer\"; \t\t\t;; \t\tx86) \t\t\t;; \t\t*) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer\"; \t\t\t;; \tesac; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-}\" \t; \trm python; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\\$\\$ORIGIN/../lib'\" \t\tpython \t; \tmake install; \t\tcd /; \trm -rf /usr/src/python; \t\tfind /usr/local -depth \t\t\\( \t\t\t\\( -type d -a \\( -name test -o -name tests -o -name idle_test \\) \\) \t\t\t-o \\( -type f -a \\( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \\) \\) \t\t\\) -exec rm -rf '{}' + \t; \t\tfind /usr/local -type f -executable -not \\( -name '*tkinter*' \\) -exec scanelf --needed --nobanner --format '%n#p' '{}' ';' \t\t| tr ',' '\\n' \t\t| sort -u \t\t| awk 'system(\"[ -e /usr/local/lib/\" $1 \" ]\") == 0 { next } { print \"so:\" $1 }' \t\t| xargs -rt apk add --no-network --virtual .python-rundeps \t; \tapk del --no-network .build-deps; \t\texport PYTHONDONTWRITEBYTECODE=1; \tpython3 --version; \tpip3 --version # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:10:30.782726003Z", + "created_by": "RUN /bin/sh -c set -eux; \tfor src in idle3 pip3 pydoc3 python3 python3-config; do \t\tdst=\"$(echo \"$src\" | tr -d 3)\"; \t\t[ -s \"/usr/local/bin/$src\" ]; \t\t[ ! -e \"/usr/local/bin/$dst\" ]; \t\tln -svT \"$src\" \"/usr/local/bin/$dst\"; \tdone # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:10:30.782726003Z", + "created_by": "CMD [\"python3\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-11T00:49:47.962156876+02:00", + "created_by": "ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-11T00:49:47.962156876+02:00", + "created_by": "RUN /bin/sh -c apk add --no-cache 'libuuid\u003e=2.42.3-r1' \u0026\u0026 addgroup -S -g 10001 informed \u0026\u0026 adduser -S -u 10001 -G informed -H informed # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:55.351944978+02:00", + "created_by": "COPY /opt/venv /opt/venv # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.462092072+02:00", + "created_by": "RUN /bin/sh -c rm -rf /usr/local/bin/pip* /usr/local/lib/python3.12/site-packages/pip* /usr/local/lib/python3.12/site-packages/setuptools* /usr/local/lib/python3.12/site-packages/pkg_resources /opt/venv/bin/pip* /opt/venv/lib/python3.12/site-packages/pip* /opt/venv/lib/python3.12/site-packages/setuptools* /opt/venv/lib/python3.12/site-packages/pkg_resources # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "WORKDIR /app", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "USER 10001:10001", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "EXPOSE [8080/tcp 8081/tcp]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "ENTRYPOINT [\"informed-decision-container\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-11T01:15:11.991443676Z", + "created_by": "/bin/sh -c #(nop) ARG SOURCE_REVISION", + "empty_layer": true + }, + { + "created": "2026-10-11T01:21:04.716126392Z", + "created_by": "/bin/sh -c #(nop) LABEL org.opencontainers.image.revision=3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168 org.opencontainers.image.base.digest=sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173 social.coulomb.source.policy.sha256=9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62 social.coulomb.release.scope=INFD-WP-0009-T04/purpose-overlay-v1", + "empty_layer": true + }, + { + "created": "2026-10-11T01:21:04.787527697Z", + "created_by": "/bin/sh -c #(nop) COPY file:2be9cb36e7253e15733673359cda8caa22986b6888822a008c1b360d909994e0 in /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py " + } + ], + "os": "linux", + "rootfs": { + "type": "layers", + "diff_ids": [ + "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c", + "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd", + "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366", + "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe", + "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1", + "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c", + "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59", + "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02", + "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + ] + }, + "config": { + "Entrypoint": [ + "informed-decision-container" + ], + "Env": [ + "PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "LANG=C.UTF-8", + "GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", + "PYTHON_VERSION=3.12.14", + "PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a", + "PYTHONDONTWRITEBYTECODE=1", + "PYTHONUNBUFFERED=1" + ], + "Image": "sha256:90f1574f9eda35fa6cb972961beb27a7cb904c36560e381930b0e14065c23883", + "Labels": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "User": "10001:10001", + "WorkingDir": "/app", + "ExposedPorts": { + "8080/tcp": {}, + "8081/tcp": {} + } + } + }, + "Layers": [ + { + "Size": 8697856, + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "Size": 1538048, + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "Size": 47150592, + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "Size": 5120, + "Digest": "sha256:ed62c91ccd94e36a928e96d704cfcf20861302590245cc12aa89a15a5d6be29b", + "DiffID": "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe" + }, + { + "Size": 131584, + "Digest": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86", + "DiffID": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "Size": 30705664, + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "Size": 12288, + "Digest": "sha256:16a3dba6b720d3059eab918cd3596f94145ac9cf4d456f925a21f0f72522863f", + "DiffID": "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59" + }, + { + "Size": 1536, + "Digest": "sha256:e73dd464fbff5607cc62a1b2b66b0eefe737dfad4db8e7b58a48cda7c12d94d3", + "DiffID": "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02" + }, + { + "Size": 15360, + "Digest": "sha256:cfee29c2f8119d2a39714ecbe5095a2dc1c986054f2e1fe0a6565163242417e3", + "DiffID": "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + } + ] + }, + "Results": [ + { + "Target": "/artifact/base-image.tar (alpine 3.24.1)", + "Class": "os-pkgs", + "Type": "alpine", + "Packages": [ + { + "ID": ".python-rundeps@20260901.001029", + "Name": ".python-rundeps", + "Identifier": { + "PURL": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch\u0026distro=3.24.1", + "UID": "4e26c99fecac1e97" + }, + "Version": "20260901.001029", + "Arch": "noarch", + "DependsOn": [ + "gdbm@1.26-r0", + "libbz2@1.0.8-r6", + "libcrypto3@3.5.8-r0", + "libffi@3.5.2-r1", + "libncursesw@6.6_p20260516-r0", + "libnsl@2.0.1-r2", + "libpanelw@6.6_p20260516-r0", + "libssl3@3.5.8-r0", + "libtirpc@1.3.5-r1", + "libuuid@2.42.3-r1", + "musl@1.2.6-r2", + "readline@8.3.3-r1", + "sqlite-libs@3.53.4-r0", + "xz-libs@5.8.3-r0", + "zlib@1.3.2-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:51d0c1e7d88a414345799f0309185c625013ef32", + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-baselayout@3.7.2-r1", + "Name": "alpine-baselayout", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "1b9c543300f8073e" + }, + "Version": "3.7.2-r1", + "Arch": "x86_64", + "SrcName": "alpine-baselayout", + "SrcVersion": "3.7.2-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "alpine-baselayout-data@3.7.2-r1", + "busybox-binsh@1.37.0-r31" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:f0fcfdc2f4da058af6473bc45c4eab62916225b2", + "InstalledFiles": [ + "etc/motd", + "etc/crontabs/root", + "etc/modprobe.d/aliases.conf", + "etc/modprobe.d/blacklist.conf", + "etc/modprobe.d/i386.conf", + "etc/profile.d/20locale.sh", + "etc/profile.d/README", + "etc/profile.d/color_prompt.sh.disabled", + "usr/lib/sysctl.d/00-alpine.conf", + "var/lock", + "var/run", + "var/spool/mail", + "var/spool/cron/crontabs" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-baselayout-data@3.7.2-r1", + "Name": "alpine-baselayout-data", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "fcc3cd90122d8aa7" + }, + "Version": "3.7.2-r1", + "Arch": "x86_64", + "SrcName": "alpine-baselayout", + "SrcVersion": "3.7.2-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c6f9bded17d844b6f1b0bb5766d2c35c0d5c8508", + "InstalledFiles": [ + "etc/fstab", + "etc/group", + "etc/hostname", + "etc/hosts", + "etc/inittab", + "etc/modules", + "etc/mtab", + "etc/nsswitch.conf", + "etc/passwd", + "etc/profile", + "etc/protocols", + "etc/services", + "etc/shadow", + "etc/shells", + "etc/sysctl.conf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-keys@2.6-r0", + "Name": "alpine-keys", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "cb1f6c8fa74713e0" + }, + "Version": "2.6-r0", + "Arch": "x86_64", + "SrcName": "alpine-keys", + "SrcVersion": "2.6-r0", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:d8d6b80e53c059a77e4915da78ba964f3ffea240", + "InstalledFiles": [ + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", + "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", + "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", + "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", + "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", + "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", + "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", + "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", + "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", + "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", + "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", + "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", + "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-release@3.24.1-r0", + "Name": "alpine-release", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "6cfad6f36e1f31aa" + }, + "Version": "3.24.1-r0", + "Arch": "x86_64", + "SrcName": "alpine-base", + "SrcVersion": "3.24.1-r0", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "alpine-keys@2.6-r0" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:bc6912a25cdc7733e0035ed509eceaa4026946e3", + "InstalledFiles": [ + "etc/alpine-release", + "etc/issue", + "etc/os-release", + "etc/secfixes.d/alpine", + "usr/lib/os-release" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "apk-tools@3.0.6-r0", + "Name": "apk-tools", + "Identifier": { + "PURL": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "cb2633c883b17a04" + }, + "Version": "3.0.6-r0", + "Arch": "x86_64", + "SrcName": "apk-tools", + "SrcVersion": "3.0.6-r0", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "ca-certificates-bundle@20260611-r0", + "libapk@3.0.6-r0", + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2", + "zlib@1.3.2-r0" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:043333589798a1f52e09ae63f026c6c8fa676d34", + "InstalledFiles": [ + "sbin/apk" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "busybox@1.37.0-r31", + "Name": "busybox", + "Identifier": { + "PURL": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "771020c43c8440bf" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:b5405ebc02f7dd8be95b6265c54b243d5456ab8f", + "InstalledFiles": [ + "bin/busybox", + "etc/securetty", + "etc/busybox-paths.d/busybox", + "etc/logrotate.d/acpid", + "etc/network/if-up.d/dad", + "etc/udhcpc/udhcpc.conf", + "usr/share/udhcpc/default.script" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "busybox-binsh@1.37.0-r31", + "Name": "busybox-binsh", + "Identifier": { + "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "1ec8a3d5d2b63297" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "busybox@1.37.0-r31" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:5cbd14acc6f1804c5bac6c77dc2c492f010b0fc7", + "InstalledFiles": [ + "bin/sh" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ca-certificates@20260611-r0", + "Name": "ca-certificates", + "Identifier": { + "PURL": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "2a3c316ee83c6198" + }, + "Version": "20260611-r0", + "Arch": "x86_64", + "SrcName": "ca-certificates", + "SrcVersion": "20260611-r0", + "Licenses": [ + "MPL-2.0", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "busybox-binsh@1.37.0-r31", + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + "Digest": "sha1:8f2a04abeb54b331e2970a0a0dffb7bd6bdde567", + "InstalledFiles": [ + "etc/ca-certificates.conf", + "etc/apk/protected_paths.d/ca-certificates.list", + "etc/ca-certificates/update.d/certhash", + "usr/bin/c_rehash", + "usr/sbin/update-ca-certificates", + "usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", + "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", + "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", + "usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", + "usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", + "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", + "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", + "usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", + "usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", + "usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", + "usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", + "usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", + "usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", + "usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", + "usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", + "usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", + "usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", + "usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", + "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", + "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", + "usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", + "usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", + "usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", + "usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", + "usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/Izenpe.com.crt", + "usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", + "usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", + "usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", + "usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", + "usr/share/ca-certificates/mozilla/OISTE_Server_Root_ECC_G1.crt", + "usr/share/ca-certificates/mozilla/OISTE_Server_Root_RSA_G1.crt", + "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", + "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", + "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", + "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", + "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", + "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", + "usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", + "usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", + "usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", + "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", + "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", + "usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", + "usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", + "usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", + "usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", + "usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt", + "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", + "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", + "usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", + "usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", + "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", + "usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", + "usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", + "usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", + "usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", + "usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", + "usr/share/ca-certificates/mozilla/e-Szigno_TLS_Root_CA_2023.crt", + "usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", + "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", + "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", + "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", + "usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", + "usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ca-certificates-bundle@20260611-r0", + "Name": "ca-certificates-bundle", + "Identifier": { + "PURL": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "20337c2ea28bef28" + }, + "Version": "20260611-r0", + "Arch": "x86_64", + "SrcName": "ca-certificates", + "SrcVersion": "20260611-r0", + "Licenses": [ + "MPL-2.0", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c9534a03750bdfae341f10969016090fc11febbd", + "InstalledFiles": [ + "etc/ssl/cert.pem", + "etc/ssl/certs/ca-certificates.crt", + "etc/ssl1.1/cert.pem", + "etc/ssl1.1/certs" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "gdbm@1.26-r0", + "Name": "gdbm", + "Identifier": { + "PURL": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "5eb1a3f86262ca77" + }, + "Version": "1.26-r0", + "Arch": "x86_64", + "SrcName": "gdbm", + "SrcVersion": "1.26-r0", + "Licenses": [ + "GPL-3.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:619493d8124fe49a8ee1d8f7a1372cf7e3977337", + "InstalledFiles": [ + "usr/lib/libgdbm.so.6", + "usr/lib/libgdbm.so.6.0.0", + "usr/lib/libgdbm_compat.so.4", + "usr/lib/libgdbm_compat.so.4.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "keyutils-libs@1.6.3-r4", + "Name": "keyutils-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64\u0026distro=3.24.1", + "UID": "a1a29120eb342032" + }, + "Version": "1.6.3-r4", + "Arch": "x86_64", + "SrcName": "keyutils", + "SrcVersion": "1.6.3-r4", + "Licenses": [ + "GPL-2.0-or-later", + "LGPL-2.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:b7331c96f077fc3522ee4361a441d1097204cd90", + "InstalledFiles": [ + "usr/lib/libkeyutils.so.1", + "usr/lib/libkeyutils.so.1.10" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "krb5-conf@1.0-r2", + "Name": "krb5-conf", + "Identifier": { + "PURL": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "e7cf94ba8b6dbc33" + }, + "Version": "1.0-r2", + "Arch": "x86_64", + "SrcName": "krb5-conf", + "SrcVersion": "1.0-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:40a11e0690a59e110367b62a80661024e9942a2d", + "InstalledFiles": [ + "etc/krb5.conf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "krb5-libs@1.22.2-r1", + "Name": "krb5-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "958f8b4a4f087dac" + }, + "Version": "1.22.2-r1", + "Arch": "x86_64", + "SrcName": "krb5", + "SrcVersion": "1.22.2-r1", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "keyutils-libs@1.6.3-r4", + "krb5-conf@1.0-r2", + "libcom_err@1.47.4-r0", + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "libverto@0.3.2-r2", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:ef02346e21b817ff379e4601e5b1fc9760e5e31a", + "InstalledFiles": [ + "usr/lib/libgssapi_krb5.so.2", + "usr/lib/libgssapi_krb5.so.2.2", + "usr/lib/libgssrpc.so.4", + "usr/lib/libgssrpc.so.4.2", + "usr/lib/libk5crypto.so.3", + "usr/lib/libk5crypto.so.3.1", + "usr/lib/libkadm5clnt_mit.so.12", + "usr/lib/libkadm5clnt_mit.so.12.0", + "usr/lib/libkadm5srv_mit.so.12", + "usr/lib/libkadm5srv_mit.so.12.0", + "usr/lib/libkdb5.so.10", + "usr/lib/libkdb5.so.10.0", + "usr/lib/libkrad.so.0", + "usr/lib/libkrad.so.0.0", + "usr/lib/libkrb5.so.3", + "usr/lib/libkrb5.so.3.3", + "usr/lib/libkrb5support.so.0", + "usr/lib/libkrb5support.so.0.1", + "usr/lib/krb5/plugins/kdb/db2.so", + "usr/lib/krb5/plugins/preauth/otp.so", + "usr/lib/krb5/plugins/preauth/spake.so", + "usr/lib/krb5/plugins/preauth/test.so", + "usr/lib/krb5/plugins/tls/k5tls.so" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libapk@3.0.6-r0", + "Name": "libapk", + "Identifier": { + "PURL": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "a35b8b9b3219513a" + }, + "Version": "3.0.6-r0", + "Arch": "x86_64", + "SrcName": "apk-tools", + "SrcVersion": "3.0.6-r0", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "musl@1.2.6-r2", + "zlib@1.3.2-r0" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:523a8f58104589f74f743d501c81bf6517155378", + "InstalledFiles": [ + "usr/lib/libapk.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libbz2@1.0.8-r6", + "Name": "libbz2", + "Identifier": { + "PURL": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64\u0026distro=3.24.1", + "UID": "48e17539404e2d56" + }, + "Version": "1.0.8-r6", + "Arch": "x86_64", + "SrcName": "bzip2", + "SrcVersion": "1.0.8-r6", + "Licenses": [ + "bzip-2-1.0.6" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:08566ba5c7af97c25474be8b24e8b48f0116b67d", + "InstalledFiles": [ + "usr/lib/libbz2.so.1", + "usr/lib/libbz2.so.1.0.8" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libcom_err@1.47.4-r0", + "Name": "libcom_err", + "Identifier": { + "PURL": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "3fc35a3f66d192af" + }, + "Version": "1.47.4-r0", + "Arch": "x86_64", + "SrcName": "e2fsprogs", + "SrcVersion": "1.47.4-r0", + "Licenses": [ + "GPL-2.0-or-later", + "LGPL-2.0-or-later", + "BSD-3-Clause", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:4b9fb5899ea0b1c0cfbb2a2c5952704437d4ecef", + "InstalledFiles": [ + "usr/lib/libcom_err.so.2", + "usr/lib/libcom_err.so.2.1" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libcrypto3@3.5.8-r0", + "Name": "libcrypto3", + "Identifier": { + "PURL": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "4299bba2ba9c96aa" + }, + "Version": "3.5.8-r0", + "Arch": "x86_64", + "SrcName": "openssl", + "SrcVersion": "3.5.8-r0", + "Licenses": [ + "Apache-2.0" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:1b3b9fc0c136f4936932bcb2ec21499f0ae5dfd3", + "InstalledFiles": [ + "etc/ssl/ct_log_list.cnf", + "etc/ssl/ct_log_list.cnf.dist", + "etc/ssl/openssl.cnf", + "etc/ssl/openssl.cnf.dist", + "usr/lib/libcrypto.so.3", + "usr/lib/engines-3/afalg.so", + "usr/lib/engines-3/capi.so", + "usr/lib/engines-3/loader_attic.so", + "usr/lib/engines-3/padlock.so", + "usr/lib/ossl-modules/legacy.so" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libffi@3.5.2-r1", + "Name": "libffi", + "Identifier": { + "PURL": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "d3eaa921287b1ccd" + }, + "Version": "3.5.2-r1", + "Arch": "x86_64", + "SrcName": "libffi", + "SrcVersion": "3.5.2-r1", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:2f7b261f7fcecc4eebd8b330e7f6fb80713bfe3a", + "InstalledFiles": [ + "usr/lib/libffi.so.8", + "usr/lib/libffi.so.8.2.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libintl@1.0-r0", + "Name": "libintl", + "Identifier": { + "PURL": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "25c18808d8fc87e0" + }, + "Version": "1.0-r0", + "Arch": "x86_64", + "SrcName": "gettext", + "SrcVersion": "1.0-r0", + "Licenses": [ + "LGPL-2.1-or-later" + ], + "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:282d6642ccac87237e43a864159d73cf5abe7550", + "InstalledFiles": [ + "usr/lib/libintl.so.8", + "usr/lib/libintl.so.8.4.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libncursesw@6.6_p20260516-r0", + "Name": "libncursesw", + "Identifier": { + "PURL": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e8939f45e2191bcc" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "DependsOn": [ + "musl@1.2.6-r2", + "ncurses-terminfo-base@6.6_p20260516-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:9f318e6e324d6827274829194cf6ac6afbaded12", + "InstalledFiles": [ + "usr/lib/libncursesw.so.6", + "usr/lib/libncursesw.so.6.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libnsl@2.0.1-r2", + "Name": "libnsl", + "Identifier": { + "PURL": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "3d893c60d41da67b" + }, + "Version": "2.0.1-r2", + "Arch": "x86_64", + "SrcName": "libnsl", + "SrcVersion": "2.0.1-r2", + "Licenses": [ + "LGPL-2.0-or-later" + ], + "DependsOn": [ + "libintl@1.0-r0", + "libtirpc@1.3.5-r1", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:5194adbf26560b52be318481a7af294ab05fd795", + "InstalledFiles": [ + "usr/lib/libnsl.so.3", + "usr/lib/libnsl.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libpanelw@6.6_p20260516-r0", + "Name": "libpanelw", + "Identifier": { + "PURL": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "ef1ad9bb256b373" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "DependsOn": [ + "libncursesw@6.6_p20260516-r0", + "musl@1.2.6-r2", + "ncurses-terminfo-base@6.6_p20260516-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:149bdc434232ed11fc5bb975ba519a07154a6f56", + "InstalledFiles": [ + "usr/lib/libpanelw.so.6", + "usr/lib/libpanelw.so.6.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libssl3@3.5.8-r0", + "Name": "libssl3", + "Identifier": { + "PURL": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "f290ab59b88b1c4a" + }, + "Version": "3.5.8-r0", + "Arch": "x86_64", + "SrcName": "openssl", + "SrcVersion": "3.5.8-r0", + "Licenses": [ + "Apache-2.0" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:5f9b1e55d821953d2e2b1db322dad70a3b5041ea", + "InstalledFiles": [ + "usr/lib/libssl.so.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libtirpc@1.3.5-r1", + "Name": "libtirpc", + "Identifier": { + "PURL": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "471c8d955ca03be5" + }, + "Version": "1.3.5-r1", + "Arch": "x86_64", + "SrcName": "libtirpc", + "SrcVersion": "1.3.5-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "krb5-libs@1.22.2-r1", + "libtirpc-conf@1.3.5-r1", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:c32865bd86a8b8829d152279cabbc5ac6d430eb2", + "InstalledFiles": [ + "usr/lib/libtirpc.so.3", + "usr/lib/libtirpc.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libtirpc-conf@1.3.5-r1", + "Name": "libtirpc-conf", + "Identifier": { + "PURL": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "3437392c14aad33f" + }, + "Version": "1.3.5-r1", + "Arch": "x86_64", + "SrcName": "libtirpc", + "SrcVersion": "1.3.5-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:0c17d9988dc986c90e22f79778df047eca9973ff", + "InstalledFiles": [ + "etc/bindresvport.blacklist", + "etc/netconfig" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libuuid@2.42.3-r1", + "Name": "libuuid", + "Identifier": { + "PURL": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "c444e9cdd1bdda40" + }, + "Version": "2.42.3-r1", + "Arch": "x86_64", + "SrcName": "util-linux", + "SrcVersion": "2.42.3-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86", + "DiffID": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + "Digest": "sha1:8f041ef637ad75f381cc0c034f2afbbb0303264e", + "InstalledFiles": [ + "usr/lib/libuuid.so.1", + "usr/lib/libuuid.so.1.3.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libverto@0.3.2-r2", + "Name": "libverto", + "Identifier": { + "PURL": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "9df4321a283a6cf6" + }, + "Version": "0.3.2-r2", + "Arch": "x86_64", + "SrcName": "libverto", + "SrcVersion": "0.3.2-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:73233059338142e4ac6d8fb8bb0074e93da75dc1", + "InstalledFiles": [ + "usr/lib/libverto.so.1", + "usr/lib/libverto.so.1.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "musl@1.2.6-r2", + "Name": "musl", + "Identifier": { + "PURL": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "1f8cb44befe503d4" + }, + "Version": "1.2.6-r2", + "Arch": "x86_64", + "SrcName": "musl", + "SrcVersion": "1.2.6-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:0f7e5827e4e1a73631beda27b78431a8ba240e05", + "InstalledFiles": [ + "lib/ld-musl-x86_64.so.1", + "lib/libc.musl-x86_64.so.1" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "musl-utils@1.2.6-r2", + "Name": "musl-utils", + "Identifier": { + "PURL": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "4497482ec1d943e1" + }, + "Version": "1.2.6-r2", + "Arch": "x86_64", + "SrcName": "musl", + "SrcVersion": "1.2.6-r2", + "Licenses": [ + "MIT", + "BSD-2-Clause", + "GPL-2.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2", + "scanelf@1.3.9-r1" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:75ada3c48d63ec5d87c42fdf934a3fdd11298dc5", + "InstalledFiles": [ + "sbin/ldconfig", + "usr/bin/getconf", + "usr/bin/getent", + "usr/bin/iconv", + "usr/bin/ldd" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ncurses-terminfo-base@6.6_p20260516-r0", + "Name": "ncurses-terminfo-base", + "Identifier": { + "PURL": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e7fac5c6a6e9ae8" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:9d551d828e9c8ee52c5801c1d6046828ebf15752", + "InstalledFiles": [ + "etc/terminfo/a/alacritty", + "etc/terminfo/a/ansi", + "etc/terminfo/d/dumb", + "etc/terminfo/g/gnome", + "etc/terminfo/g/gnome-256color", + "etc/terminfo/k/konsole", + "etc/terminfo/k/konsole-256color", + "etc/terminfo/k/konsole-linux", + "etc/terminfo/l/linux", + "etc/terminfo/p/putty", + "etc/terminfo/p/putty-256color", + "etc/terminfo/r/rxvt", + "etc/terminfo/r/rxvt-256color", + "etc/terminfo/s/screen", + "etc/terminfo/s/screen-256color", + "etc/terminfo/s/st-0.6", + "etc/terminfo/s/st-0.7", + "etc/terminfo/s/st-0.8", + "etc/terminfo/s/st-0.8.5", + "etc/terminfo/s/st-16color", + "etc/terminfo/s/st-256color", + "etc/terminfo/s/st-direct", + "etc/terminfo/s/sun", + "etc/terminfo/t/terminator", + "etc/terminfo/t/terminology", + "etc/terminfo/t/terminology-0.6.1", + "etc/terminfo/t/terminology-1.0.0", + "etc/terminfo/t/terminology-1.8.1", + "etc/terminfo/t/tmux", + "etc/terminfo/t/tmux-256color", + "etc/terminfo/v/vt100", + "etc/terminfo/v/vt102", + "etc/terminfo/v/vt200", + "etc/terminfo/v/vt220", + "etc/terminfo/v/vt52", + "etc/terminfo/v/vte", + "etc/terminfo/v/vte-256color", + "etc/terminfo/x/xterm", + "etc/terminfo/x/xterm-256color", + "etc/terminfo/x/xterm-color", + "etc/terminfo/x/xterm-xfree86" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "readline@8.3.3-r1", + "Name": "readline", + "Identifier": { + "PURL": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "f50058781c93e1f2" + }, + "Version": "8.3.3-r1", + "Arch": "x86_64", + "SrcName": "readline", + "SrcVersion": "8.3.3-r1", + "Licenses": [ + "GPL-3.0-or-later" + ], + "Maintainer": "qaqland \u003cqaq@qaq.land\u003e", + "DependsOn": [ + "libncursesw@6.6_p20260516-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:945b16e378bc00e44d89d4de8124bba7647fdf4d", + "InstalledFiles": [ + "etc/inputrc", + "usr/lib/libreadline.so.8", + "usr/lib/libreadline.so.8.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "scanelf@1.3.9-r1", + "Name": "scanelf", + "Identifier": { + "PURL": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "936394657a1626fb" + }, + "Version": "1.3.9-r1", + "Arch": "x86_64", + "SrcName": "pax-utils", + "SrcVersion": "1.3.9-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:013f903d0ba219673aebbdd04f74bb5ed82b01f0", + "InstalledFiles": [ + "usr/bin/scanelf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "sqlite-libs@3.53.4-r0", + "Name": "sqlite-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "8b10aee2ccc192de" + }, + "Version": "3.53.4-r0", + "Arch": "x86_64", + "SrcName": "sqlite", + "SrcVersion": "3.53.4-r0", + "Licenses": [ + "blessing" + ], + "Maintainer": "Jingyun Hua \u003chuajingyun@loongson.cn\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:f7630ceb37c232b6609861aeab6cdb9cd120e6fa", + "InstalledFiles": [ + "usr/lib/libsqlite3.so.0", + "usr/lib/libsqlite3.so.3.53.4" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ssl_client@1.37.0-r31", + "Name": "ssl_client", + "Identifier": { + "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "d42e31f15a4ce47a" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c220f4a5125a313af733e98def94132bb1e9d40d", + "InstalledFiles": [ + "usr/bin/ssl_client" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "tzdata@2026c-r0", + "Name": "tzdata", + "Identifier": { + "PURL": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "52c6b50eff629f9d" + }, + "Version": "2026c-r0", + "Arch": "x86_64", + "SrcName": "tzdata", + "SrcVersion": "2026c-r0", + "Licenses": [ + "Public-Domain" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + "Digest": "sha1:61f7544ecd8dd63eac23fe3e645702fda92ef02a", + "InstalledFiles": [ + "usr/share/zoneinfo/CET", + "usr/share/zoneinfo/CST6CDT", + "usr/share/zoneinfo/Cuba", + "usr/share/zoneinfo/EET", + "usr/share/zoneinfo/EST", + "usr/share/zoneinfo/EST5EDT", + "usr/share/zoneinfo/Egypt", + "usr/share/zoneinfo/Eire", + "usr/share/zoneinfo/Factory", + "usr/share/zoneinfo/GB", + "usr/share/zoneinfo/GB-Eire", + "usr/share/zoneinfo/GMT", + "usr/share/zoneinfo/GMT+0", + "usr/share/zoneinfo/GMT-0", + "usr/share/zoneinfo/GMT0", + "usr/share/zoneinfo/Greenwich", + "usr/share/zoneinfo/HST", + "usr/share/zoneinfo/Hongkong", + "usr/share/zoneinfo/Iceland", + "usr/share/zoneinfo/Iran", + "usr/share/zoneinfo/Israel", + "usr/share/zoneinfo/Jamaica", + "usr/share/zoneinfo/Japan", + "usr/share/zoneinfo/Kwajalein", + "usr/share/zoneinfo/Libya", + "usr/share/zoneinfo/MET", + "usr/share/zoneinfo/MST", + "usr/share/zoneinfo/MST7MDT", + "usr/share/zoneinfo/NZ", + "usr/share/zoneinfo/NZ-CHAT", + "usr/share/zoneinfo/Navajo", + "usr/share/zoneinfo/PRC", + "usr/share/zoneinfo/PST8PDT", + "usr/share/zoneinfo/Poland", + "usr/share/zoneinfo/Portugal", + "usr/share/zoneinfo/ROC", + "usr/share/zoneinfo/ROK", + "usr/share/zoneinfo/Singapore", + "usr/share/zoneinfo/Turkey", + "usr/share/zoneinfo/UCT", + "usr/share/zoneinfo/UTC", + "usr/share/zoneinfo/Universal", + "usr/share/zoneinfo/W-SU", + "usr/share/zoneinfo/WET", + "usr/share/zoneinfo/Zulu", + "usr/share/zoneinfo/iso3166.tab", + "usr/share/zoneinfo/leap-seconds.list", + "usr/share/zoneinfo/posixrules", + "usr/share/zoneinfo/zone.tab", + "usr/share/zoneinfo/zone1970.tab", + "usr/share/zoneinfo/Africa/Abidjan", + "usr/share/zoneinfo/Africa/Accra", + "usr/share/zoneinfo/Africa/Addis_Ababa", + "usr/share/zoneinfo/Africa/Algiers", + "usr/share/zoneinfo/Africa/Asmara", + "usr/share/zoneinfo/Africa/Asmera", + "usr/share/zoneinfo/Africa/Bamako", + "usr/share/zoneinfo/Africa/Bangui", + "usr/share/zoneinfo/Africa/Banjul", + "usr/share/zoneinfo/Africa/Bissau", + "usr/share/zoneinfo/Africa/Blantyre", + "usr/share/zoneinfo/Africa/Brazzaville", + "usr/share/zoneinfo/Africa/Bujumbura", + "usr/share/zoneinfo/Africa/Cairo", + "usr/share/zoneinfo/Africa/Casablanca", + "usr/share/zoneinfo/Africa/Ceuta", + "usr/share/zoneinfo/Africa/Conakry", + "usr/share/zoneinfo/Africa/Dakar", + "usr/share/zoneinfo/Africa/Dar_es_Salaam", + "usr/share/zoneinfo/Africa/Djibouti", + "usr/share/zoneinfo/Africa/Douala", + "usr/share/zoneinfo/Africa/El_Aaiun", + "usr/share/zoneinfo/Africa/Freetown", + "usr/share/zoneinfo/Africa/Gaborone", + "usr/share/zoneinfo/Africa/Harare", + "usr/share/zoneinfo/Africa/Johannesburg", + "usr/share/zoneinfo/Africa/Juba", + "usr/share/zoneinfo/Africa/Kampala", + "usr/share/zoneinfo/Africa/Khartoum", + "usr/share/zoneinfo/Africa/Kigali", + "usr/share/zoneinfo/Africa/Kinshasa", + "usr/share/zoneinfo/Africa/Lagos", + "usr/share/zoneinfo/Africa/Libreville", + "usr/share/zoneinfo/Africa/Lome", + "usr/share/zoneinfo/Africa/Luanda", + "usr/share/zoneinfo/Africa/Lubumbashi", + "usr/share/zoneinfo/Africa/Lusaka", + "usr/share/zoneinfo/Africa/Malabo", + "usr/share/zoneinfo/Africa/Maputo", + "usr/share/zoneinfo/Africa/Maseru", + "usr/share/zoneinfo/Africa/Mbabane", + "usr/share/zoneinfo/Africa/Mogadishu", + "usr/share/zoneinfo/Africa/Monrovia", + "usr/share/zoneinfo/Africa/Nairobi", + "usr/share/zoneinfo/Africa/Ndjamena", + "usr/share/zoneinfo/Africa/Niamey", + "usr/share/zoneinfo/Africa/Nouakchott", + "usr/share/zoneinfo/Africa/Ouagadougou", + "usr/share/zoneinfo/Africa/Porto-Novo", + "usr/share/zoneinfo/Africa/Sao_Tome", + "usr/share/zoneinfo/Africa/Timbuktu", + "usr/share/zoneinfo/Africa/Tripoli", + "usr/share/zoneinfo/Africa/Tunis", + "usr/share/zoneinfo/Africa/Windhoek", + "usr/share/zoneinfo/America/Adak", + "usr/share/zoneinfo/America/Anchorage", + "usr/share/zoneinfo/America/Anguilla", + "usr/share/zoneinfo/America/Antigua", + "usr/share/zoneinfo/America/Araguaina", + "usr/share/zoneinfo/America/Aruba", + "usr/share/zoneinfo/America/Asuncion", + "usr/share/zoneinfo/America/Atikokan", + "usr/share/zoneinfo/America/Atka", + "usr/share/zoneinfo/America/Bahia", + "usr/share/zoneinfo/America/Bahia_Banderas", + "usr/share/zoneinfo/America/Barbados", + "usr/share/zoneinfo/America/Belem", + "usr/share/zoneinfo/America/Belize", + "usr/share/zoneinfo/America/Blanc-Sablon", + "usr/share/zoneinfo/America/Boa_Vista", + "usr/share/zoneinfo/America/Bogota", + "usr/share/zoneinfo/America/Boise", + "usr/share/zoneinfo/America/Buenos_Aires", + "usr/share/zoneinfo/America/Cambridge_Bay", + "usr/share/zoneinfo/America/Campo_Grande", + "usr/share/zoneinfo/America/Cancun", + "usr/share/zoneinfo/America/Caracas", + "usr/share/zoneinfo/America/Catamarca", + "usr/share/zoneinfo/America/Cayenne", + "usr/share/zoneinfo/America/Cayman", + "usr/share/zoneinfo/America/Chicago", + "usr/share/zoneinfo/America/Chihuahua", + "usr/share/zoneinfo/America/Ciudad_Juarez", + "usr/share/zoneinfo/America/Coral_Harbour", + "usr/share/zoneinfo/America/Cordoba", + "usr/share/zoneinfo/America/Costa_Rica", + "usr/share/zoneinfo/America/Coyhaique", + "usr/share/zoneinfo/America/Creston", + "usr/share/zoneinfo/America/Cuiaba", + "usr/share/zoneinfo/America/Curacao", + "usr/share/zoneinfo/America/Danmarkshavn", + "usr/share/zoneinfo/America/Dawson", + "usr/share/zoneinfo/America/Dawson_Creek", + "usr/share/zoneinfo/America/Denver", + "usr/share/zoneinfo/America/Detroit", + "usr/share/zoneinfo/America/Dominica", + "usr/share/zoneinfo/America/Edmonton", + "usr/share/zoneinfo/America/Eirunepe", + "usr/share/zoneinfo/America/El_Salvador", + "usr/share/zoneinfo/America/Ensenada", + "usr/share/zoneinfo/America/Fort_Nelson", + "usr/share/zoneinfo/America/Fort_Wayne", + "usr/share/zoneinfo/America/Fortaleza", + "usr/share/zoneinfo/America/Glace_Bay", + "usr/share/zoneinfo/America/Godthab", + "usr/share/zoneinfo/America/Goose_Bay", + "usr/share/zoneinfo/America/Grand_Turk", + "usr/share/zoneinfo/America/Grenada", + "usr/share/zoneinfo/America/Guadeloupe", + "usr/share/zoneinfo/America/Guatemala", + "usr/share/zoneinfo/America/Guayaquil", + "usr/share/zoneinfo/America/Guyana", + "usr/share/zoneinfo/America/Halifax", + "usr/share/zoneinfo/America/Havana", + "usr/share/zoneinfo/America/Hermosillo", + "usr/share/zoneinfo/America/Indianapolis", + "usr/share/zoneinfo/America/Inuvik", + "usr/share/zoneinfo/America/Iqaluit", + "usr/share/zoneinfo/America/Jamaica", + "usr/share/zoneinfo/America/Jujuy", + "usr/share/zoneinfo/America/Juneau", + "usr/share/zoneinfo/America/Knox_IN", + "usr/share/zoneinfo/America/Kralendijk", + "usr/share/zoneinfo/America/La_Paz", + "usr/share/zoneinfo/America/Lima", + "usr/share/zoneinfo/America/Los_Angeles", + "usr/share/zoneinfo/America/Louisville", + "usr/share/zoneinfo/America/Lower_Princes", + "usr/share/zoneinfo/America/Maceio", + "usr/share/zoneinfo/America/Managua", + "usr/share/zoneinfo/America/Manaus", + "usr/share/zoneinfo/America/Marigot", + "usr/share/zoneinfo/America/Martinique", + "usr/share/zoneinfo/America/Matamoros", + "usr/share/zoneinfo/America/Mazatlan", + "usr/share/zoneinfo/America/Mendoza", + "usr/share/zoneinfo/America/Menominee", + "usr/share/zoneinfo/America/Merida", + "usr/share/zoneinfo/America/Metlakatla", + "usr/share/zoneinfo/America/Mexico_City", + "usr/share/zoneinfo/America/Miquelon", + "usr/share/zoneinfo/America/Moncton", + "usr/share/zoneinfo/America/Monterrey", + "usr/share/zoneinfo/America/Montevideo", + "usr/share/zoneinfo/America/Montreal", + "usr/share/zoneinfo/America/Montserrat", + "usr/share/zoneinfo/America/Nassau", + "usr/share/zoneinfo/America/New_York", + "usr/share/zoneinfo/America/Nipigon", + "usr/share/zoneinfo/America/Nome", + "usr/share/zoneinfo/America/Noronha", + "usr/share/zoneinfo/America/Nuuk", + "usr/share/zoneinfo/America/Ojinaga", + "usr/share/zoneinfo/America/Panama", + "usr/share/zoneinfo/America/Pangnirtung", + "usr/share/zoneinfo/America/Paramaribo", + "usr/share/zoneinfo/America/Phoenix", + "usr/share/zoneinfo/America/Port-au-Prince", + "usr/share/zoneinfo/America/Port_of_Spain", + "usr/share/zoneinfo/America/Porto_Acre", + "usr/share/zoneinfo/America/Porto_Velho", + "usr/share/zoneinfo/America/Puerto_Rico", + "usr/share/zoneinfo/America/Punta_Arenas", + "usr/share/zoneinfo/America/Rainy_River", + "usr/share/zoneinfo/America/Rankin_Inlet", + "usr/share/zoneinfo/America/Recife", + "usr/share/zoneinfo/America/Regina", + "usr/share/zoneinfo/America/Resolute", + "usr/share/zoneinfo/America/Rio_Branco", + "usr/share/zoneinfo/America/Rosario", + "usr/share/zoneinfo/America/Santa_Isabel", + "usr/share/zoneinfo/America/Santarem", + "usr/share/zoneinfo/America/Santiago", + "usr/share/zoneinfo/America/Santo_Domingo", + "usr/share/zoneinfo/America/Sao_Paulo", + "usr/share/zoneinfo/America/Scoresbysund", + "usr/share/zoneinfo/America/Shiprock", + "usr/share/zoneinfo/America/Sitka", + "usr/share/zoneinfo/America/St_Barthelemy", + "usr/share/zoneinfo/America/St_Johns", + "usr/share/zoneinfo/America/St_Kitts", + "usr/share/zoneinfo/America/St_Lucia", + "usr/share/zoneinfo/America/St_Thomas", + "usr/share/zoneinfo/America/St_Vincent", + "usr/share/zoneinfo/America/Swift_Current", + "usr/share/zoneinfo/America/Tegucigalpa", + "usr/share/zoneinfo/America/Thule", + "usr/share/zoneinfo/America/Thunder_Bay", + "usr/share/zoneinfo/America/Tijuana", + "usr/share/zoneinfo/America/Toronto", + "usr/share/zoneinfo/America/Tortola", + "usr/share/zoneinfo/America/Vancouver", + "usr/share/zoneinfo/America/Virgin", + "usr/share/zoneinfo/America/Whitehorse", + "usr/share/zoneinfo/America/Winnipeg", + "usr/share/zoneinfo/America/Yakutat", + "usr/share/zoneinfo/America/Yellowknife", + "usr/share/zoneinfo/America/Argentina/Buenos_Aires", + "usr/share/zoneinfo/America/Argentina/Catamarca", + "usr/share/zoneinfo/America/Argentina/ComodRivadavia", + "usr/share/zoneinfo/America/Argentina/Cordoba", + "usr/share/zoneinfo/America/Argentina/Jujuy", + "usr/share/zoneinfo/America/Argentina/La_Rioja", + "usr/share/zoneinfo/America/Argentina/Mendoza", + "usr/share/zoneinfo/America/Argentina/Rio_Gallegos", + "usr/share/zoneinfo/America/Argentina/Salta", + "usr/share/zoneinfo/America/Argentina/San_Juan", + "usr/share/zoneinfo/America/Argentina/San_Luis", + "usr/share/zoneinfo/America/Argentina/Tucuman", + "usr/share/zoneinfo/America/Argentina/Ushuaia", + "usr/share/zoneinfo/America/Indiana/Indianapolis", + "usr/share/zoneinfo/America/Indiana/Knox", + "usr/share/zoneinfo/America/Indiana/Marengo", + "usr/share/zoneinfo/America/Indiana/Petersburg", + "usr/share/zoneinfo/America/Indiana/Tell_City", + "usr/share/zoneinfo/America/Indiana/Vevay", + "usr/share/zoneinfo/America/Indiana/Vincennes", + "usr/share/zoneinfo/America/Indiana/Winamac", + "usr/share/zoneinfo/America/Kentucky/Louisville", + "usr/share/zoneinfo/America/Kentucky/Monticello", + "usr/share/zoneinfo/America/North_Dakota/Beulah", + "usr/share/zoneinfo/America/North_Dakota/Center", + "usr/share/zoneinfo/America/North_Dakota/New_Salem", + "usr/share/zoneinfo/Antarctica/Casey", + "usr/share/zoneinfo/Antarctica/Davis", + "usr/share/zoneinfo/Antarctica/DumontDUrville", + "usr/share/zoneinfo/Antarctica/Macquarie", + "usr/share/zoneinfo/Antarctica/Mawson", + "usr/share/zoneinfo/Antarctica/McMurdo", + "usr/share/zoneinfo/Antarctica/Palmer", + "usr/share/zoneinfo/Antarctica/Rothera", + "usr/share/zoneinfo/Antarctica/South_Pole", + "usr/share/zoneinfo/Antarctica/Syowa", + "usr/share/zoneinfo/Antarctica/Troll", + "usr/share/zoneinfo/Antarctica/Vostok", + "usr/share/zoneinfo/Arctic/Longyearbyen", + "usr/share/zoneinfo/Asia/Aden", + "usr/share/zoneinfo/Asia/Almaty", + "usr/share/zoneinfo/Asia/Amman", + "usr/share/zoneinfo/Asia/Anadyr", + "usr/share/zoneinfo/Asia/Aqtau", + "usr/share/zoneinfo/Asia/Aqtobe", + "usr/share/zoneinfo/Asia/Ashgabat", + "usr/share/zoneinfo/Asia/Ashkhabad", + "usr/share/zoneinfo/Asia/Atyrau", + "usr/share/zoneinfo/Asia/Baghdad", + "usr/share/zoneinfo/Asia/Bahrain", + "usr/share/zoneinfo/Asia/Baku", + "usr/share/zoneinfo/Asia/Bangkok", + "usr/share/zoneinfo/Asia/Barnaul", + "usr/share/zoneinfo/Asia/Beirut", + "usr/share/zoneinfo/Asia/Bishkek", + "usr/share/zoneinfo/Asia/Brunei", + "usr/share/zoneinfo/Asia/Calcutta", + "usr/share/zoneinfo/Asia/Chita", + "usr/share/zoneinfo/Asia/Choibalsan", + "usr/share/zoneinfo/Asia/Chongqing", + "usr/share/zoneinfo/Asia/Chungking", + "usr/share/zoneinfo/Asia/Colombo", + "usr/share/zoneinfo/Asia/Dacca", + "usr/share/zoneinfo/Asia/Damascus", + "usr/share/zoneinfo/Asia/Dhaka", + "usr/share/zoneinfo/Asia/Dili", + "usr/share/zoneinfo/Asia/Dubai", + "usr/share/zoneinfo/Asia/Dushanbe", + "usr/share/zoneinfo/Asia/Famagusta", + "usr/share/zoneinfo/Asia/Gaza", + "usr/share/zoneinfo/Asia/Harbin", + "usr/share/zoneinfo/Asia/Hebron", + "usr/share/zoneinfo/Asia/Ho_Chi_Minh", + "usr/share/zoneinfo/Asia/Hong_Kong", + "usr/share/zoneinfo/Asia/Hovd", + "usr/share/zoneinfo/Asia/Irkutsk", + "usr/share/zoneinfo/Asia/Istanbul", + "usr/share/zoneinfo/Asia/Jakarta", + "usr/share/zoneinfo/Asia/Jayapura", + "usr/share/zoneinfo/Asia/Jerusalem", + "usr/share/zoneinfo/Asia/Kabul", + "usr/share/zoneinfo/Asia/Kamchatka", + "usr/share/zoneinfo/Asia/Karachi", + "usr/share/zoneinfo/Asia/Kashgar", + "usr/share/zoneinfo/Asia/Kathmandu", + "usr/share/zoneinfo/Asia/Katmandu", + "usr/share/zoneinfo/Asia/Khandyga", + "usr/share/zoneinfo/Asia/Kolkata", + "usr/share/zoneinfo/Asia/Krasnoyarsk", + "usr/share/zoneinfo/Asia/Kuala_Lumpur", + "usr/share/zoneinfo/Asia/Kuching", + "usr/share/zoneinfo/Asia/Kuwait", + "usr/share/zoneinfo/Asia/Macao", + "usr/share/zoneinfo/Asia/Macau", + "usr/share/zoneinfo/Asia/Magadan", + "usr/share/zoneinfo/Asia/Makassar", + "usr/share/zoneinfo/Asia/Manila", + "usr/share/zoneinfo/Asia/Muscat", + "usr/share/zoneinfo/Asia/Nicosia", + "usr/share/zoneinfo/Asia/Novokuznetsk", + "usr/share/zoneinfo/Asia/Novosibirsk", + "usr/share/zoneinfo/Asia/Omsk", + "usr/share/zoneinfo/Asia/Oral", + "usr/share/zoneinfo/Asia/Phnom_Penh", + "usr/share/zoneinfo/Asia/Pontianak", + "usr/share/zoneinfo/Asia/Pyongyang", + "usr/share/zoneinfo/Asia/Qatar", + "usr/share/zoneinfo/Asia/Qostanay", + "usr/share/zoneinfo/Asia/Qyzylorda", + "usr/share/zoneinfo/Asia/Rangoon", + "usr/share/zoneinfo/Asia/Riyadh", + "usr/share/zoneinfo/Asia/Saigon", + "usr/share/zoneinfo/Asia/Sakhalin", + "usr/share/zoneinfo/Asia/Samarkand", + "usr/share/zoneinfo/Asia/Seoul", + "usr/share/zoneinfo/Asia/Shanghai", + "usr/share/zoneinfo/Asia/Singapore", + "usr/share/zoneinfo/Asia/Srednekolymsk", + "usr/share/zoneinfo/Asia/Taipei", + "usr/share/zoneinfo/Asia/Tashkent", + "usr/share/zoneinfo/Asia/Tbilisi", + "usr/share/zoneinfo/Asia/Tehran", + "usr/share/zoneinfo/Asia/Tel_Aviv", + "usr/share/zoneinfo/Asia/Thimbu", + "usr/share/zoneinfo/Asia/Thimphu", + "usr/share/zoneinfo/Asia/Tokyo", + "usr/share/zoneinfo/Asia/Tomsk", + "usr/share/zoneinfo/Asia/Ujung_Pandang", + "usr/share/zoneinfo/Asia/Ulaanbaatar", + "usr/share/zoneinfo/Asia/Ulan_Bator", + "usr/share/zoneinfo/Asia/Urumqi", + "usr/share/zoneinfo/Asia/Ust-Nera", + "usr/share/zoneinfo/Asia/Vientiane", + "usr/share/zoneinfo/Asia/Vladivostok", + "usr/share/zoneinfo/Asia/Yakutsk", + "usr/share/zoneinfo/Asia/Yangon", + "usr/share/zoneinfo/Asia/Yekaterinburg", + "usr/share/zoneinfo/Asia/Yerevan", + "usr/share/zoneinfo/Atlantic/Azores", + "usr/share/zoneinfo/Atlantic/Bermuda", + "usr/share/zoneinfo/Atlantic/Canary", + "usr/share/zoneinfo/Atlantic/Cape_Verde", + "usr/share/zoneinfo/Atlantic/Faeroe", + "usr/share/zoneinfo/Atlantic/Faroe", + "usr/share/zoneinfo/Atlantic/Jan_Mayen", + "usr/share/zoneinfo/Atlantic/Madeira", + "usr/share/zoneinfo/Atlantic/Reykjavik", + "usr/share/zoneinfo/Atlantic/South_Georgia", + "usr/share/zoneinfo/Atlantic/St_Helena", + "usr/share/zoneinfo/Atlantic/Stanley", + "usr/share/zoneinfo/Australia/ACT", + "usr/share/zoneinfo/Australia/Adelaide", + "usr/share/zoneinfo/Australia/Brisbane", + "usr/share/zoneinfo/Australia/Broken_Hill", + "usr/share/zoneinfo/Australia/Canberra", + "usr/share/zoneinfo/Australia/Currie", + "usr/share/zoneinfo/Australia/Darwin", + "usr/share/zoneinfo/Australia/Eucla", + "usr/share/zoneinfo/Australia/Hobart", + "usr/share/zoneinfo/Australia/LHI", + "usr/share/zoneinfo/Australia/Lindeman", + "usr/share/zoneinfo/Australia/Lord_Howe", + "usr/share/zoneinfo/Australia/Melbourne", + "usr/share/zoneinfo/Australia/NSW", + "usr/share/zoneinfo/Australia/North", + "usr/share/zoneinfo/Australia/Perth", + "usr/share/zoneinfo/Australia/Queensland", + "usr/share/zoneinfo/Australia/South", + "usr/share/zoneinfo/Australia/Sydney", + "usr/share/zoneinfo/Australia/Tasmania", + "usr/share/zoneinfo/Australia/Victoria", + "usr/share/zoneinfo/Australia/West", + "usr/share/zoneinfo/Australia/Yancowinna", + "usr/share/zoneinfo/Brazil/Acre", + "usr/share/zoneinfo/Brazil/DeNoronha", + "usr/share/zoneinfo/Brazil/East", + "usr/share/zoneinfo/Brazil/West", + "usr/share/zoneinfo/Canada/Atlantic", + "usr/share/zoneinfo/Canada/Central", + "usr/share/zoneinfo/Canada/Eastern", + "usr/share/zoneinfo/Canada/Mountain", + "usr/share/zoneinfo/Canada/Newfoundland", + "usr/share/zoneinfo/Canada/Pacific", + "usr/share/zoneinfo/Canada/Saskatchewan", + "usr/share/zoneinfo/Canada/Yukon", + "usr/share/zoneinfo/Chile/Continental", + "usr/share/zoneinfo/Chile/EasterIsland", + "usr/share/zoneinfo/Etc/GMT", + "usr/share/zoneinfo/Etc/GMT+0", + "usr/share/zoneinfo/Etc/GMT+1", + "usr/share/zoneinfo/Etc/GMT+10", + "usr/share/zoneinfo/Etc/GMT+11", + "usr/share/zoneinfo/Etc/GMT+12", + "usr/share/zoneinfo/Etc/GMT+2", + "usr/share/zoneinfo/Etc/GMT+3", + "usr/share/zoneinfo/Etc/GMT+4", + "usr/share/zoneinfo/Etc/GMT+5", + "usr/share/zoneinfo/Etc/GMT+6", + "usr/share/zoneinfo/Etc/GMT+7", + "usr/share/zoneinfo/Etc/GMT+8", + "usr/share/zoneinfo/Etc/GMT+9", + "usr/share/zoneinfo/Etc/GMT-0", + "usr/share/zoneinfo/Etc/GMT-1", + "usr/share/zoneinfo/Etc/GMT-10", + "usr/share/zoneinfo/Etc/GMT-11", + "usr/share/zoneinfo/Etc/GMT-12", + "usr/share/zoneinfo/Etc/GMT-13", + "usr/share/zoneinfo/Etc/GMT-14", + "usr/share/zoneinfo/Etc/GMT-2", + "usr/share/zoneinfo/Etc/GMT-3", + "usr/share/zoneinfo/Etc/GMT-4", + "usr/share/zoneinfo/Etc/GMT-5", + "usr/share/zoneinfo/Etc/GMT-6", + "usr/share/zoneinfo/Etc/GMT-7", + "usr/share/zoneinfo/Etc/GMT-8", + "usr/share/zoneinfo/Etc/GMT-9", + "usr/share/zoneinfo/Etc/GMT0", + "usr/share/zoneinfo/Etc/Greenwich", + "usr/share/zoneinfo/Etc/UCT", + "usr/share/zoneinfo/Etc/UTC", + "usr/share/zoneinfo/Etc/Universal", + "usr/share/zoneinfo/Etc/Zulu", + "usr/share/zoneinfo/Europe/Amsterdam", + "usr/share/zoneinfo/Europe/Andorra", + "usr/share/zoneinfo/Europe/Astrakhan", + "usr/share/zoneinfo/Europe/Athens", + "usr/share/zoneinfo/Europe/Belfast", + "usr/share/zoneinfo/Europe/Belgrade", + "usr/share/zoneinfo/Europe/Berlin", + "usr/share/zoneinfo/Europe/Bratislava", + "usr/share/zoneinfo/Europe/Brussels", + "usr/share/zoneinfo/Europe/Bucharest", + "usr/share/zoneinfo/Europe/Budapest", + "usr/share/zoneinfo/Europe/Busingen", + "usr/share/zoneinfo/Europe/Chisinau", + "usr/share/zoneinfo/Europe/Copenhagen", + "usr/share/zoneinfo/Europe/Dublin", + "usr/share/zoneinfo/Europe/Gibraltar", + "usr/share/zoneinfo/Europe/Guernsey", + "usr/share/zoneinfo/Europe/Helsinki", + "usr/share/zoneinfo/Europe/Isle_of_Man", + "usr/share/zoneinfo/Europe/Istanbul", + "usr/share/zoneinfo/Europe/Jersey", + "usr/share/zoneinfo/Europe/Kaliningrad", + "usr/share/zoneinfo/Europe/Kiev", + "usr/share/zoneinfo/Europe/Kirov", + "usr/share/zoneinfo/Europe/Kyiv", + "usr/share/zoneinfo/Europe/Lisbon", + "usr/share/zoneinfo/Europe/Ljubljana", + "usr/share/zoneinfo/Europe/London", + "usr/share/zoneinfo/Europe/Luxembourg", + "usr/share/zoneinfo/Europe/Madrid", + "usr/share/zoneinfo/Europe/Malta", + "usr/share/zoneinfo/Europe/Mariehamn", + "usr/share/zoneinfo/Europe/Minsk", + "usr/share/zoneinfo/Europe/Monaco", + "usr/share/zoneinfo/Europe/Moscow", + "usr/share/zoneinfo/Europe/Nicosia", + "usr/share/zoneinfo/Europe/Oslo", + "usr/share/zoneinfo/Europe/Paris", + "usr/share/zoneinfo/Europe/Podgorica", + "usr/share/zoneinfo/Europe/Prague", + "usr/share/zoneinfo/Europe/Riga", + "usr/share/zoneinfo/Europe/Rome", + "usr/share/zoneinfo/Europe/Samara", + "usr/share/zoneinfo/Europe/San_Marino", + "usr/share/zoneinfo/Europe/Sarajevo", + "usr/share/zoneinfo/Europe/Saratov", + "usr/share/zoneinfo/Europe/Simferopol", + "usr/share/zoneinfo/Europe/Skopje", + "usr/share/zoneinfo/Europe/Sofia", + "usr/share/zoneinfo/Europe/Stockholm", + "usr/share/zoneinfo/Europe/Tallinn", + "usr/share/zoneinfo/Europe/Tirane", + "usr/share/zoneinfo/Europe/Tiraspol", + "usr/share/zoneinfo/Europe/Ulyanovsk", + "usr/share/zoneinfo/Europe/Uzhgorod", + "usr/share/zoneinfo/Europe/Vaduz", + "usr/share/zoneinfo/Europe/Vatican", + "usr/share/zoneinfo/Europe/Vienna", + "usr/share/zoneinfo/Europe/Vilnius", + "usr/share/zoneinfo/Europe/Volgograd", + "usr/share/zoneinfo/Europe/Warsaw", + "usr/share/zoneinfo/Europe/Zagreb", + "usr/share/zoneinfo/Europe/Zaporozhye", + "usr/share/zoneinfo/Europe/Zurich", + "usr/share/zoneinfo/Indian/Antananarivo", + "usr/share/zoneinfo/Indian/Chagos", + "usr/share/zoneinfo/Indian/Christmas", + "usr/share/zoneinfo/Indian/Cocos", + "usr/share/zoneinfo/Indian/Comoro", + "usr/share/zoneinfo/Indian/Kerguelen", + "usr/share/zoneinfo/Indian/Mahe", + "usr/share/zoneinfo/Indian/Maldives", + "usr/share/zoneinfo/Indian/Mauritius", + "usr/share/zoneinfo/Indian/Mayotte", + "usr/share/zoneinfo/Indian/Reunion", + "usr/share/zoneinfo/Mexico/BajaNorte", + "usr/share/zoneinfo/Mexico/BajaSur", + "usr/share/zoneinfo/Mexico/General", + "usr/share/zoneinfo/Pacific/Apia", + "usr/share/zoneinfo/Pacific/Auckland", + "usr/share/zoneinfo/Pacific/Bougainville", + "usr/share/zoneinfo/Pacific/Chatham", + "usr/share/zoneinfo/Pacific/Chuuk", + "usr/share/zoneinfo/Pacific/Easter", + "usr/share/zoneinfo/Pacific/Efate", + "usr/share/zoneinfo/Pacific/Enderbury", + "usr/share/zoneinfo/Pacific/Fakaofo", + "usr/share/zoneinfo/Pacific/Fiji", + "usr/share/zoneinfo/Pacific/Funafuti", + "usr/share/zoneinfo/Pacific/Galapagos", + "usr/share/zoneinfo/Pacific/Gambier", + "usr/share/zoneinfo/Pacific/Guadalcanal", + "usr/share/zoneinfo/Pacific/Guam", + "usr/share/zoneinfo/Pacific/Honolulu", + "usr/share/zoneinfo/Pacific/Johnston", + "usr/share/zoneinfo/Pacific/Kanton", + "usr/share/zoneinfo/Pacific/Kiritimati", + "usr/share/zoneinfo/Pacific/Kosrae", + "usr/share/zoneinfo/Pacific/Kwajalein", + "usr/share/zoneinfo/Pacific/Majuro", + "usr/share/zoneinfo/Pacific/Marquesas", + "usr/share/zoneinfo/Pacific/Midway", + "usr/share/zoneinfo/Pacific/Nauru", + "usr/share/zoneinfo/Pacific/Niue", + "usr/share/zoneinfo/Pacific/Norfolk", + "usr/share/zoneinfo/Pacific/Noumea", + "usr/share/zoneinfo/Pacific/Pago_Pago", + "usr/share/zoneinfo/Pacific/Palau", + "usr/share/zoneinfo/Pacific/Pitcairn", + "usr/share/zoneinfo/Pacific/Pohnpei", + "usr/share/zoneinfo/Pacific/Ponape", + "usr/share/zoneinfo/Pacific/Port_Moresby", + "usr/share/zoneinfo/Pacific/Rarotonga", + "usr/share/zoneinfo/Pacific/Saipan", + "usr/share/zoneinfo/Pacific/Samoa", + "usr/share/zoneinfo/Pacific/Tahiti", + "usr/share/zoneinfo/Pacific/Tarawa", + "usr/share/zoneinfo/Pacific/Tongatapu", + "usr/share/zoneinfo/Pacific/Truk", + "usr/share/zoneinfo/Pacific/Wake", + "usr/share/zoneinfo/Pacific/Wallis", + "usr/share/zoneinfo/Pacific/Yap", + "usr/share/zoneinfo/US/Alaska", + "usr/share/zoneinfo/US/Aleutian", + "usr/share/zoneinfo/US/Arizona", + "usr/share/zoneinfo/US/Central", + "usr/share/zoneinfo/US/East-Indiana", + "usr/share/zoneinfo/US/Eastern", + "usr/share/zoneinfo/US/Hawaii", + "usr/share/zoneinfo/US/Indiana-Starke", + "usr/share/zoneinfo/US/Michigan", + "usr/share/zoneinfo/US/Mountain", + "usr/share/zoneinfo/US/Pacific", + "usr/share/zoneinfo/US/Samoa" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "xz-libs@5.8.3-r0", + "Name": "xz-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "1ae658a5f132a091" + }, + "Version": "5.8.3-r0", + "Arch": "x86_64", + "SrcName": "xz", + "SrcVersion": "5.8.3-r0", + "Licenses": [ + "GPL-2.0-or-later", + "0BSD", + "Public-Domain", + "LGPL-2.1-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:4c92c5be0c5bef404e93c880eba9037a9b147347", + "InstalledFiles": [ + "usr/lib/liblzma.so.5", + "usr/lib/liblzma.so.5.8.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "zlib@1.3.2-r0", + "Name": "zlib", + "Identifier": { + "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e37054a2982d6c16" + }, + "Version": "1.3.2-r0", + "Arch": "x86_64", + "SrcName": "zlib", + "SrcVersion": "1.3.2-r0", + "Licenses": [ + "Zlib" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:dd4c3d102acaef2a71a1495951d55fabc8680613", + "InstalledFiles": [ + "usr/lib/libz.so.1", + "usr/lib/libz.so.1.3.2" + ], + "AnalyzedBy": "apk" + } + ], + "Vulnerabilities": [ + { + "VulnerabilityID": "CVE-2026-85091", + "PkgID": "zlib@1.3.2-r0", + "PkgName": "zlib", + "PkgIdentifier": { + "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e37054a2982d6c16" + }, + "InstalledVersion": "1.3.2-r0", + "FixedVersion": "1.3.2-r1", + "Status": "fixed", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", + "DataSource": { + "ID": "alpine", + "Name": "Alpine Secdb", + "URL": "https://secdb.alpinelinux.org/" + }, + "Fingerprint": "sha256:ceeda859a20a0899c3ebfc8ed22f7f9935b25d2fac00d05c203ecc67a4118973", + "Title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", + "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", + "Severity": "MEDIUM", + "CweIDs": [ + "CWE-787" + ], + "VendorSeverity": { + "ubuntu": 2 + }, + "References": [ + "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", + "https://github.com/madler/zlib", + "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", + "https://www.cve.org/CVERecord?id=CVE-2026-85091", + "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" + ], + "PublishedDate": "2026-09-03T13:06:20.573Z", + "LastModifiedDate": "2026-09-09T20:41:07.123Z" + } + ] + }, + { + "Target": "Python", + "Class": "lang-pkgs", + "Type": "python-pkg", + "Packages": [ + { + "Name": "PyJWT", + "Identifier": { + "PURL": "pkg:pypi/pyjwt@2.15.1", + "UID": "d3f5f9a421b8abc9" + }, + "Version": "2.15.1", + "Licenses": [ + "MIT" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/pyjwt-2.15.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "cffi", + "Identifier": { + "PURL": "pkg:pypi/cffi@2.1.1", + "UID": "21042e2f37e33c05" + }, + "Version": "2.1.1", + "Licenses": [ + "MIT-0" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "cryptography", + "Identifier": { + "PURL": "pkg:pypi/cryptography@50.0.1", + "UID": "dcb3df6383fe2a60" + }, + "Version": "50.0.1", + "Licenses": [ + "Apache-2.0 OR BSD-3-Clause" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/cryptography-50.0.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "informed-decision", + "Identifier": { + "PURL": "pkg:pypi/informed-decision@0.2.0", + "UID": "7989f2afae8ff568" + }, + "Version": "0.2.0", + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/informed_decision-0.2.0.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "pycparser", + "Identifier": { + "PURL": "pkg:pypi/pycparser@3.0", + "UID": "e5a4d03f15a695ff" + }, + "Version": "3.0", + "Licenses": [ + "BSD-3-Clause" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/pycparser-3.0.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "waitress", + "Identifier": { + "PURL": "pkg:pypi/waitress@3.0.2", + "UID": "806e218e1c1e85f" + }, + "Version": "3.0.2", + "Licenses": [ + "ZPL-2.1" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/waitress-3.0.2.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + } + ] + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json new file mode 100644 index 0000000..eb0297e --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json @@ -0,0 +1 @@ +{"Id":"sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31","RepoTags":["informed-decision:zlib-r1-local-20261011"],"RepoDigests":["informed-decision@sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31"],"Created":"2026-10-11T09:29:32.511197114+02:00","Config":{"User":"10001:10001","ExposedPorts":{"8080/tcp":{},"8081/tcp":{}},"Env":["PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","LANG=C.UTF-8","GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305","PYTHON_VERSION=3.12.14","PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a","PYTHONDONTWRITEBYTECODE=1","PYTHONUNBUFFERED=1"],"Entrypoint":["informed-decision-container"],"WorkingDir":"/app","Labels":{"org.opencontainers.image.base.digest":"sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a","org.opencontainers.image.revision":"uncommitted-T05-local-preparation","social.coulomb.release.scope":"INFD-WP-0009-T05/zlib-85091-r1","social.coulomb.source.context.sha256":"c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d","social.coulomb.source.policy.sha256":"9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"}},"Architecture":"amd64","Os":"linux","Size":31557919,"RootFS":{"Type":"layers","Layers":["sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c","sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd","sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366","sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe","sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1","sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c","sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59","sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02","sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3","sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007","sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e"]},"Metadata":{"LastTagTime":"2026-10-11T07:29:32.766526483Z"},"Descriptor":{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31","size":2752}} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json new file mode 100644 index 0000000..f194470 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json @@ -0,0 +1 @@ +{"uid": 10001, "gid": 10001, "policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", "policy_mode": "0o644", "policy_uid": 0, "app_file_sha256": {"__init__.py": "0ffebe048ba583e7b623f60e8f449950dc5fd49afce2398381fa143eee834e19", "__main__.py": "3ba1467fa2d47fcf0bd032e8694904450775adf763a6e6f9e4888cc3ce3ed92b", "approval_client.py": "56c201dda358cb4bef11a15da141bb68562cdde9e37b4a880bf1e9257ae82cb6", "approval_http.py": "dfaac1faed80a068aa78a8c87b80db99b8887a8fc3767eebc9d6261a98f1e334", "audit.py": "06da36a8f3451b4abc7a46da2df66d5939524c170658b879499b2a47a1b10cd3", "canonicalize.py": "517bbc6b81cc839636b97863ebdefd38aa375d10f4915feb9bf21867f992f765", "container.py": "5f40d2321ee3f52673238011116e741e7b2ac17e28119f100fbcc490db208fbc", "disposition.py": "5ddd19c2444f8e6c9bb090d04045cf1227a34554e000f07b3f677325bf8089f8", "evidence.py": "169ed59ac53ef534a6db835ba371a92177c0ffb000b04203507242e2159ebc21", "http_transport.py": "eda90098f8bf2e5a47d819bf6ae0b0d1dcaf9a87aad3cb61503d060be666339a", "hub_writeback.py": "98b9caa8096c2c3eb8ecfe33900a0ace98453e7608f504fd08a64f50156519a3", "intake.py": "a733b4b608b9ea90b2c8293901aa14388a0bf0d3719f121038bfdcc1faca2038", "intake_approval.py": "52f8b3643e4c5c6f56f2ef1fd9c7747da2165f8f88122e93b3f3ee3ecae48c73", "intake_delivery.py": "4771520cc96325d93bc3f8e08005c3d714a5597582cb1adccc0b0fa73dac0b0d", "intake_hub.py": "c3daddce31791a6e82f7b07406ef4d75bccba5a278fab01dab378a06abceabc8", "intake_service.py": "99ea285a725c58b7571e2a69ceb558f16bbcca4ec391607a0cc2d0459de3b318", "lifecycle.py": "e25f865828e541b2889cd6c9afe0ce7ca4441bf35155304cc7de7c86c44b28e8", "lifecycle_commands.py": "783ec451dd7ef33dc0cfd72c1633ea5208dfd463afeaa0b68d279f156a9b0828", "lifecycle_http.py": "d4b95421d54663f041a10b4f42ac9c013493fa7a770223ab45877b451a7a7c7d", "lifecycle_review.py": "b6d69be6c56f3e2f411501083e199195190df6c740a01b07e82a476268ca3629", "lifecycle_service.py": "2dde9280214e68e5e7a7b48d703886947c2a46139ada86e8ff2283a9d4b55a70", "lifecycle_ui.py": "448e9169607c487e362d4d0d1730aec33987b6dcf12c49dfff7de3aaaab7ae03", "memo.py": "697058863a4e6de2c143a2433eaaf5e15e5e7375dc5459af6911b146567e8b5d", "oidc.py": "6b24dac9537a12141a361c4577feaf42f6c197d8d87da16ca47a08daf6916915", "policy.py": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", "presentation.py": "54375ccd8358fac41de220bccadbee09f8b7c8ebbeeafaafd381a7456331da50", "provenance.py": "de02c6bf162865ba9619d74cfd68dd0a5d7f81e6c9e427f67f848cb2c2214f83", "records.py": "82f696151895c51b168144a3078d05764da3499b96917c465629ce0836fa8e33", "requester.py": "66de1af80a5fb2442c1e4407148b581de24b671b5f76c9d2a0458d38e27833a8", "review.py": "d4a085b0ee3e65a9976b9b656ec87a8c735be8d74cfdc9bb55feeb90917c688e", "runtime.py": "535940eed76c5f21ec4c379796fbfddfd85fc309aad0de4d64afda06cdc2d3c5", "stance.py": "62b96b76eba4ec277344172f10f6233e979dda4d079f972d9a55c4e5aed96c3c", "store.py": "9c14b10becb99da19349073e9aa691c25a205df4a2c4d932f37d64f13e8d3b41", "ui.py": "ff0671dc7be4d08ab8f0d38504f70afd355ad3a8a6293620c75864ca56a53ec9", "web.py": "bd08a6b0ea0e418ea1e31e46edab6b7478de9779b823af4f5d72fd1346197e42", "workload.py": "b86cebf5e7a8182b24bb7f9fdbd6f0e17b578d690d9f06c541e713d7d995c5e8"}, "apk_packages": {".python-rundeps": "20260901.001029", "alpine-baselayout": "3.7.2-r1", "alpine-baselayout-data": "3.7.2-r1", "alpine-keys": "2.6-r0", "alpine-release": "3.24.1-r0", "apk-tools": "3.0.6-r0", "busybox": "1.37.0-r31", "busybox-binsh": "1.37.0-r31", "ca-certificates": "20260611-r0", "ca-certificates-bundle": "20260611-r0", "gdbm": "1.26-r0", "keyutils-libs": "1.6.3-r4", "krb5-conf": "1.0-r2", "krb5-libs": "1.22.2-r1", "libapk": "3.0.6-r0", "libbz2": "1.0.8-r6", "libcom_err": "1.47.4-r0", "libcrypto3": "3.5.8-r0", "libffi": "3.5.2-r1", "libintl": "1.0-r0", "libncursesw": "6.6_p20260516-r0", "libnsl": "2.0.1-r2", "libpanelw": "6.6_p20260516-r0", "libssl3": "3.5.8-r0", "libtirpc": "1.3.5-r1", "libtirpc-conf": "1.3.5-r1", "libuuid": "2.42.3-r1", "libverto": "0.3.2-r2", "musl": "1.2.6-r2", "musl-utils": "1.2.6-r2", "ncurses-terminfo-base": "6.6_p20260516-r0", "readline": "8.3.3-r1", "scanelf": "1.3.9-r1", "sqlite-libs": "3.53.4-r0", "ssl_client": "1.37.0-r31", "tzdata": "2026c-r0", "xz-libs": "5.8.3-r0", "zlib": "1.3.2-r1"}, "apk_world_sha256": "61a659443a49627ba7114faa13a4870a2ede26b314064829ced169412be7002e", "apk_keys_sha256": {"alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub": "9c102bcc376af1498d549b77bdbfa815ae86faa1d2d82f040e616b18ef2df2d4", "alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub": "12f899e55a7691225603d6fb3324940fc51cd7f133e7ead788663c2b7eecb00c", "alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub": "207e4696d3c05f7cb05966aee557307151f1f00217af4143c1bcaf33b8df733f"}, "python_dependencies": {"informed-decision": "0.2.0", "PyJWT": "2.15.1", "cryptography": "50.0.1", "cffi": "2.1.1", "pycparser": "3.0", "waitress": "3.0.2"}, "zlib_runtime_version": "1.3.2", "zlib_compile_version": "1.3.2", "libz_sha256": "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2", "compression_vectors_pass": 4, "malformed_zlib_refusals": 3, "crypto_jwt_waitress_smoke": true, "openssl": "OpenSSL 3.5.8 25 Aug 2026", "network_accessed": false, "database_opened": false, "provider_or_customer_data_used": false} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json new file mode 100644 index 0000000..14db792 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json @@ -0,0 +1,9 @@ +{ + "files": { + ".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a", + "Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15", + "zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + "context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json new file mode 100644 index 0000000..a3da11e --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json @@ -0,0 +1,12 @@ +{ + "zlib-1.3.2-r1.apk": { + "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk", + "sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "bytes": 56210 + }, + "APKINDEX.tar.gz": { + "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz", + "sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5", + "bytes": 528370 + } +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json new file mode 100644 index 0000000..c24ce21 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json @@ -0,0 +1,140 @@ +{ + "original_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "files": [ + { + "original_path": ".forgejo/workflows/zlib-overlay-image.yaml", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml", + "sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72" + }, + { + "original_path": "deploy/zlib-overlay/.dockerignore", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore", + "sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a" + }, + { + "original_path": "deploy/zlib-overlay/APKINDEX.tar.gz", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz", + "sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + { + "original_path": "deploy/zlib-overlay/Containerfile", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile", + "sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15" + }, + { + "original_path": "deploy/zlib-overlay/pins.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json", + "sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5" + }, + { + "original_path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9" + }, + { + "original_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa" + }, + { + "original_path": "tools/zlib_overlay/check_build_inputs.py", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py", + "sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06" + }, + { + "original_path": "tools/zlib_overlay/check_runtime.py", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py", + "sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be" + }, + { + "original_path": "tools/zlib_overlay/compare_runtime.py", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py", + "sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d" + }, + { + "original_path": "tools/zlib_overlay/test_candidate.py", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py", + "sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9" + }, + { + "original_path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "archived_path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4" + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json new file mode 100644 index 0000000..6e826af --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json @@ -0,0 +1,191 @@ +[ + { + "repo": "informed-decision", + "path": ".forgejo/workflows/zlib-overlay-image.yaml", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml", + "original_sha256": null, + "staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/.dockerignore", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore", + "original_sha256": null, + "staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/APKINDEX.tar.gz", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz", + "original_sha256": null, + "staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/Containerfile", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile", + "original_sha256": null, + "staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/pins.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json", + "original_sha256": null, + "staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "original_sha256": null, + "staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "original_sha256": null, + "staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "original_sha256": null, + "staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "original_sha256": null, + "staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "original_sha256": null, + "staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "original_sha256": null, + "staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "original_sha256": null, + "staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "original_sha256": null, + "staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "original_sha256": null, + "staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "original_sha256": null, + "staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "original_sha256": null, + "staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "original_sha256": null, + "staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "original_sha256": null, + "staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/check_build_inputs.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py", + "original_sha256": null, + "staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/check_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py", + "original_sha256": null, + "staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/compare_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py", + "original_sha256": null, + "staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/test_candidate.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py", + "original_sha256": null, + "staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9" + }, + { + "repo": "informed-decision", + "path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223", + "staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4" + } +] diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml new file mode 100644 index 0000000..dc981ab --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml @@ -0,0 +1,71 @@ +name: Publish exact zlib-only remediation candidate +on: + push: + branches: [main] + paths: + - ".forgejo/workflows/zlib-overlay-image.yaml" + - "deploy/zlib-overlay/**" + - "tools/zlib_overlay/**" + workflow_dispatch: +concurrency: + group: informed-decision-zlib-overlay + cancel-in-progress: false +permissions: + contents: read +env: + REGISTRY: forgejo.coulomb.social + IMAGE_NAME: coulomb/informed-decision + DOCKER_HOST: tcp://127.0.0.1:2375 +jobs: + publish-candidate: + runs-on: container-build + steps: + - name: Verify and publish zlib-only candidate + env: + REGISTRY_USER: ${{ secrets.REGISTRY_USER }} + REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }} + run: | + set -eu + umask 077 + REF="${GITHUB_SHA:?exact source revision required}" + echo "${REF}" | grep -Eq '^[0-9a-f]{40}$' + test "${GITHUB_REPOSITORY}" = "coulomb/informed-decision" + if [ -z "${REGISTRY_USER:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then + echo "Admitted owner registry capability unavailable; no borrowed credential permitted." >&2 + exit 2 + fi + BUILD_ROOT="$(mktemp -d)" + export DOCKER_CONFIG="${BUILD_ROOT}/docker-config" + cleanup() { rm -rf "${BUILD_ROOT}"; } + trap cleanup EXIT + mkdir -p "${BUILD_ROOT}/source" "${BUILD_ROOT}/context" "${DOCKER_CONFIG}" "${HOME}/bin" + wget -qO "${BUILD_ROOT}/source.tar.gz" "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz" + tar xzf "${BUILD_ROOT}/source.tar.gz" -C "${BUILD_ROOT}/source" --strip-components=1 + CONTEXT="${BUILD_ROOT}/source/deploy/zlib-overlay" + for INPUT in .dockerignore Containerfile zlib-1.3.2-r1.apk APKINDEX.tar.gz; do + cp "${CONTEXT}/${INPUT}" "${BUILD_ROOT}/context/${INPUT}" + chmod 0644 "${BUILD_ROOT}/context/${INPUT}" + done + echo "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 ${BUILD_ROOT}/context/zlib-1.3.2-r1.apk" | sha256sum -c - + echo "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 ${BUILD_ROOT}/context/APKINDEX.tar.gz" | sha256sum -c - + echo "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a ${BUILD_ROOT}/context/.dockerignore" | sha256sum -c - + echo "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15 ${BUILD_ROOT}/context/Containerfile" | sha256sum -c - + wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker + export PATH="${HOME}/bin:${PATH}" + echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin + BASE="${REGISTRY}/${IMAGE_NAME}@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a" + docker pull "${BASE}" + IMAGE="${REGISTRY}/${IMAGE_NAME}:zlib-85091-${REF}" + docker build --network none --pull=false --memory 256m --cpu-period 100000 --cpu-quota 100000 --build-arg "SOURCE_REVISION=${REF}" --build-arg "SOURCE_CONTEXT_SHA256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" --file "${BUILD_ROOT}/context/Containerfile" --tag "${IMAGE}" "${BUILD_ROOT}/context" + docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/base-runtime.json" + docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/zlib_overlay/check_runtime.py" > "${BUILD_ROOT}/candidate-runtime.json" + docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${BASE}" - "$(cat "${BUILD_ROOT}/base-runtime.json")" "$(cat "${BUILD_ROOT}/candidate-runtime.json")" < "${BUILD_ROOT}/source/tools/zlib_overlay/compare_runtime.py" + docker run --rm -i --network none --read-only --cpus 1 --memory 128m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/purpose_overlay/check_installed.py" + OUTPUT="$(docker push "${IMAGE}")" + printf '%s\n' "${OUTPUT}" + DIGEST="$(printf '%s\n' "${OUTPUT}" | tr '\r' '\n' | awk '{for(i=1;i<=NF;i++)if($i~/^sha256:[a-f0-9]{64}$/)print $i}' | tail -1)" + printf '%s' "${DIGEST}" | grep -Eq '^sha256:[a-f0-9]{64}$' + echo "published=${REGISTRY}/${IMAGE_NAME}@${DIGEST}" + echo "source_revision=${REF}" + echo "context_sha256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" + echo "candidate_only=true; actual published digest/full scan/SBOM/provenance and distinct native founder release approval remain required" diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore new file mode 100644 index 0000000..b1cccb1 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore @@ -0,0 +1,5 @@ +* +!.dockerignore +!Containerfile +!zlib-1.3.2-r1.apk +!APKINDEX.tar.gz diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz new file mode 100644 index 0000000..f649237 Binary files /dev/null and b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz differ diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile new file mode 100644 index 0000000..6a0ad7f --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile @@ -0,0 +1,17 @@ +FROM forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a +ARG SOURCE_REVISION=uncommitted-T05-local-preparation +ARG SOURCE_CONTEXT_SHA256 +USER 0:0 +COPY zlib-1.3.2-r1.apk APKINDEX.tar.gz /tmp/infd-zlib/x86_64/ +RUN echo '63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk' | sha256sum -c - \ + && echo '24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 /tmp/infd-zlib/x86_64/APKINDEX.tar.gz' | sha256sum -c - \ + && apk verify /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk /tmp/infd-zlib/x86_64/APKINDEX.tar.gz \ + && apk upgrade --no-logfile --no-network --no-cache --no-preupgrade --repositories-file /dev/null --repository /tmp/infd-zlib zlib \ + && apk info --exists 'zlib=1.3.2-r1' \ + && rm -rf /tmp/infd-zlib +USER 10001:10001 +LABEL org.opencontainers.image.revision="$SOURCE_REVISION" \ + org.opencontainers.image.base.digest="sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a" \ + social.coulomb.source.context.sha256="$SOURCE_CONTEXT_SHA256" \ + social.coulomb.source.policy.sha256="9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" \ + social.coulomb.release.scope="INFD-WP-0009-T05/zlib-85091-r1" diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json new file mode 100644 index 0000000..bfdde38 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json @@ -0,0 +1,15 @@ +{ + "files": { + ".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a", + "Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15", + "zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + "context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "base_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "package_url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk", + "index_url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz", + "package_commit": "0afa2da0e8c8051c6f8f64a7a388e5a259904245", + "package_signature": "alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "status": "prepared-unpublished-unapproved" +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk new file mode 100644 index 0000000..8a12f3e Binary files /dev/null and b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk differ diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md new file mode 100644 index 0000000..0fb7d01 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md @@ -0,0 +1,9 @@ +# Separate T05 zlib-only candidate — local verified, unpublished/unapproved + +Exact current purpose image763c is the base. Signed official Alpine3.24/main/x86_64 zlib1.3.2-r1 and APKINDEX are preserved as exact public source artifacts in deploy/zlib-overlay with their HTTPS origin/SHA/packagecommit/signature metadata. Both actually verified against base trusted keys. The offline named-package upgrade uses only that repository, disables preupgrade/network/logging, restoresUID10001 and removes temporarypublic artifacts. Only final libz binary and APK installeddatabase differ; world/repository/keys/app36files/Python/OpenSSL/policy9d remain unchanged. Raw Docker legacy/OCI default serialization differs; effective runtime config is proved equal, not byte-identical. + +Local daemonimageID78bfdcc... differs from Docker-save OCIconfig625d... after serialization; both are explicitly identified in receipt. Neither is a registry/release digest. Localfull sameDB scan covers44packages: baseactual1MEDCVE85091, candidatezeroallseverity; fullbaseline/candidateJSON+CycloneDX and filesystemaudit retained. Alpine3.24 EOLlistwarning/detection coverage is disclosed. No filters/ignoreunfixed or estateRiskgrade. Four source tests include eight unrelatedpackage/source/identity/backend/database/Python/artifactmutation refusals; actualcompression/crypto/JWT/waitress andteninstalledpurpose variants pass. Purpose providertransport remains synthetic, no database/provider/customerdata accessed. + +Four-file sourcecontext hashc554e62a... is actualbuiltinput; localOCIrevision is honestly uncommitted preparation. New sourceworkflow uses exact GITHUB_SHA/archive/four inputhashes and existing admitted ownerregistry capability; no newPAT/login/grant. It publishes only a candidate with installedpackage/appidentity/purpose guards. CIpublication has NOT run. Root must commit/source-sync thenverifyactualregistry/nativeCI provenance and fullscan/SBOM before any new release question. Do notpin a localimageID in owneradmission/servicevalues. + +T05 staysprogress/planactive, manualfollowupdueOct18 withoutautotimer. T04/nativec96/protectedjournals/snapshotcustody/helpers/current763deployment remain untouched. Only after actualpublishedproof, exact scopedfounderapproval andnativeinstalledr1/runtime/fullrescan canT05 close. Futureimage-onlyrollbackkeepslatestDB and prior763, neverrestoresoldrecords. See proposal.json/local-candidate-verification.json for exactproofs/refinementlimits. diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json new file mode 100644 index 0000000..bf14b31 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json @@ -0,0 +1,71 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false, + "candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "candidate_local_image_config_id_kind": "Docker-save OCI export config SHA; distinct from legacy daemon imageID; closed default serialization differs." +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json new file mode 100644 index 0000000..b45c853 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json @@ -0,0 +1 @@ +{"uid": 10001, "gid": 10001, "policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", "policy_mode": "0o644", "policy_uid": 0, "app_file_sha256": {"__init__.py": "0ffebe048ba583e7b623f60e8f449950dc5fd49afce2398381fa143eee834e19", "__main__.py": "3ba1467fa2d47fcf0bd032e8694904450775adf763a6e6f9e4888cc3ce3ed92b", "approval_client.py": "56c201dda358cb4bef11a15da141bb68562cdde9e37b4a880bf1e9257ae82cb6", "approval_http.py": "dfaac1faed80a068aa78a8c87b80db99b8887a8fc3767eebc9d6261a98f1e334", "audit.py": "06da36a8f3451b4abc7a46da2df66d5939524c170658b879499b2a47a1b10cd3", "canonicalize.py": "517bbc6b81cc839636b97863ebdefd38aa375d10f4915feb9bf21867f992f765", "container.py": "5f40d2321ee3f52673238011116e741e7b2ac17e28119f100fbcc490db208fbc", "disposition.py": "5ddd19c2444f8e6c9bb090d04045cf1227a34554e000f07b3f677325bf8089f8", "evidence.py": "169ed59ac53ef534a6db835ba371a92177c0ffb000b04203507242e2159ebc21", "http_transport.py": "eda90098f8bf2e5a47d819bf6ae0b0d1dcaf9a87aad3cb61503d060be666339a", "hub_writeback.py": "98b9caa8096c2c3eb8ecfe33900a0ace98453e7608f504fd08a64f50156519a3", "intake.py": "a733b4b608b9ea90b2c8293901aa14388a0bf0d3719f121038bfdcc1faca2038", "intake_approval.py": "52f8b3643e4c5c6f56f2ef1fd9c7747da2165f8f88122e93b3f3ee3ecae48c73", "intake_delivery.py": "4771520cc96325d93bc3f8e08005c3d714a5597582cb1adccc0b0fa73dac0b0d", "intake_hub.py": "c3daddce31791a6e82f7b07406ef4d75bccba5a278fab01dab378a06abceabc8", "intake_service.py": "99ea285a725c58b7571e2a69ceb558f16bbcca4ec391607a0cc2d0459de3b318", "lifecycle.py": "e25f865828e541b2889cd6c9afe0ce7ca4441bf35155304cc7de7c86c44b28e8", "lifecycle_commands.py": "783ec451dd7ef33dc0cfd72c1633ea5208dfd463afeaa0b68d279f156a9b0828", "lifecycle_http.py": "d4b95421d54663f041a10b4f42ac9c013493fa7a770223ab45877b451a7a7c7d", "lifecycle_review.py": "b6d69be6c56f3e2f411501083e199195190df6c740a01b07e82a476268ca3629", "lifecycle_service.py": "2dde9280214e68e5e7a7b48d703886947c2a46139ada86e8ff2283a9d4b55a70", "lifecycle_ui.py": "448e9169607c487e362d4d0d1730aec33987b6dcf12c49dfff7de3aaaab7ae03", "memo.py": "697058863a4e6de2c143a2433eaaf5e15e5e7375dc5459af6911b146567e8b5d", "oidc.py": "6b24dac9537a12141a361c4577feaf42f6c197d8d87da16ca47a08daf6916915", "policy.py": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", "presentation.py": "54375ccd8358fac41de220bccadbee09f8b7c8ebbeeafaafd381a7456331da50", "provenance.py": "de02c6bf162865ba9619d74cfd68dd0a5d7f81e6c9e427f67f848cb2c2214f83", "records.py": "82f696151895c51b168144a3078d05764da3499b96917c465629ce0836fa8e33", "requester.py": "66de1af80a5fb2442c1e4407148b581de24b671b5f76c9d2a0458d38e27833a8", "review.py": "d4a085b0ee3e65a9976b9b656ec87a8c735be8d74cfdc9bb55feeb90917c688e", "runtime.py": "535940eed76c5f21ec4c379796fbfddfd85fc309aad0de4d64afda06cdc2d3c5", "stance.py": "62b96b76eba4ec277344172f10f6233e979dda4d079f972d9a55c4e5aed96c3c", "store.py": "9c14b10becb99da19349073e9aa691c25a205df4a2c4d932f37d64f13e8d3b41", "ui.py": "ff0671dc7be4d08ab8f0d38504f70afd355ad3a8a6293620c75864ca56a53ec9", "web.py": "bd08a6b0ea0e418ea1e31e46edab6b7478de9779b823af4f5d72fd1346197e42", "workload.py": "b86cebf5e7a8182b24bb7f9fdbd6f0e17b578d690d9f06c541e713d7d995c5e8"}, "apk_packages": {".python-rundeps": "20260901.001029", "alpine-baselayout": "3.7.2-r1", "alpine-baselayout-data": "3.7.2-r1", "alpine-keys": "2.6-r0", "alpine-release": "3.24.1-r0", "apk-tools": "3.0.6-r0", "busybox": "1.37.0-r31", "busybox-binsh": "1.37.0-r31", "ca-certificates": "20260611-r0", "ca-certificates-bundle": "20260611-r0", "gdbm": "1.26-r0", "keyutils-libs": "1.6.3-r4", "krb5-conf": "1.0-r2", "krb5-libs": "1.22.2-r1", "libapk": "3.0.6-r0", "libbz2": "1.0.8-r6", "libcom_err": "1.47.4-r0", "libcrypto3": "3.5.8-r0", "libffi": "3.5.2-r1", "libintl": "1.0-r0", "libncursesw": "6.6_p20260516-r0", "libnsl": "2.0.1-r2", "libpanelw": "6.6_p20260516-r0", "libssl3": "3.5.8-r0", "libtirpc": "1.3.5-r1", "libtirpc-conf": "1.3.5-r1", "libuuid": "2.42.3-r1", "libverto": "0.3.2-r2", "musl": "1.2.6-r2", "musl-utils": "1.2.6-r2", "ncurses-terminfo-base": "6.6_p20260516-r0", "readline": "8.3.3-r1", "scanelf": "1.3.9-r1", "sqlite-libs": "3.53.4-r0", "ssl_client": "1.37.0-r31", "tzdata": "2026c-r0", "xz-libs": "5.8.3-r0", "zlib": "1.3.2-r0"}, "apk_world_sha256": "61a659443a49627ba7114faa13a4870a2ede26b314064829ced169412be7002e", "apk_keys_sha256": {"alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub": "9c102bcc376af1498d549b77bdbfa815ae86faa1d2d82f040e616b18ef2df2d4", "alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub": "12f899e55a7691225603d6fb3324940fc51cd7f133e7ead788663c2b7eecb00c", "alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub": "207e4696d3c05f7cb05966aee557307151f1f00217af4143c1bcaf33b8df733f"}, "python_dependencies": {"informed-decision": "0.2.0", "PyJWT": "2.15.1", "cryptography": "50.0.1", "cffi": "2.1.1", "pycparser": "3.0", "waitress": "3.0.2"}, "zlib_runtime_version": "1.3.2", "zlib_compile_version": "1.3.2", "libz_sha256": "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57", "compression_vectors_pass": 4, "malformed_zlib_refusals": 3, "crypto_jwt_waitress_smoke": true, "openssl": "OpenSSL 3.5.8 25 Aug 2026", "network_accessed": false, "database_opened": false, "provider_or_customer_data_used": false} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json new file mode 100644 index 0000000..389d805 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json @@ -0,0 +1,2551 @@ +{ + "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json", + "bomFormat": "CycloneDX", + "specVersion": "1.7", + "serialNumber": "urn:uuid:87d25a8f-5c4e-45a5-ba01-10fe9ffc3512", + "version": 1, + "metadata": { + "timestamp": "2026-10-11T07:27:24+00:00", + "tools": { + "components": [ + { + "type": "application", + "manufacturer": { + "name": "Aqua Security Software Ltd." + }, + "group": "aquasecurity", + "name": "trivy", + "version": "0.74.0" + } + ] + }, + "component": { + "bom-ref": "72113269-9efb-4c6a-a07f-752a12125747", + "type": "container", + "name": "/artifact/base-image.tar", + "properties": [ + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "name": "aquasecurity:trivy:ImageID", + "value": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779" + }, + { + "name": "aquasecurity:trivy:Labels:org.opencontainers.image.base.digest", + "value": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173" + }, + { + "name": "aquasecurity:trivy:Labels:org.opencontainers.image.revision", + "value": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168" + }, + { + "name": "aquasecurity:trivy:Labels:social.coulomb.release.scope", + "value": "INFD-WP-0009-T04/purpose-overlay-v1" + }, + { + "name": "aquasecurity:trivy:Labels:social.coulomb.source.policy.sha256", + "value": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + { + "name": "aquasecurity:trivy:SchemaVersion", + "value": "2" + }, + { + "name": "aquasecurity:trivy:Size", + "value": "88258048" + } + ] + } + }, + "components": [ + { + "bom-ref": "65b030f2-ac92-4cbc-a6e6-f92890b5a5f5", + "type": "operating-system", + "name": "alpine", + "version": "3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:Class", + "value": "os-pkgs" + }, + { + "name": "aquasecurity:trivy:Type", + "value": "alpine" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "type": "library", + "name": ".python-rundeps", + "version": "20260901.001029", + "hashes": [ + { + "alg": "SHA-1", + "content": "51d0c1e7d88a414345799f0309185c625013ef32" + } + ], + "purl": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": ".python-rundeps@20260901.001029" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-baselayout-data", + "version": "3.7.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "c6f9bded17d844b6f1b0bb5766d2c35c0d5c8508" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-baselayout-data@3.7.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-baselayout" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.7.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-baselayout", + "version": "3.7.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "f0fcfdc2f4da058af6473bc45c4eab62916225b2" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-baselayout@3.7.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-baselayout" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.7.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-keys", + "version": "2.6-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "d8d6b80e53c059a77e4915da78ba964f3ffea240" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-keys@2.6-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-keys" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2.6-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-release", + "version": "3.24.1-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "bc6912a25cdc7733e0035ed509eceaa4026946e3" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-release@3.24.1-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-base" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.24.1-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "apk-tools", + "version": "3.0.6-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "043333589798a1f52e09ae63f026c6c8fa676d34" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "apk-tools@3.0.6-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "apk-tools" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.0.6-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Sören Tempel " + }, + "name": "busybox-binsh", + "version": "1.37.0-r31", + "hashes": [ + { + "alg": "SHA-1", + "content": "5cbd14acc6f1804c5bac6c77dc2c492f010b0fc7" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "busybox-binsh@1.37.0-r31" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "busybox" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.37.0-r31" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Sören Tempel " + }, + "name": "busybox", + "version": "1.37.0-r31", + "hashes": [ + { + "alg": "SHA-1", + "content": "b5405ebc02f7dd8be95b6265c54b243d5456ab8f" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "busybox@1.37.0-r31" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "busybox" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.37.0-r31" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "ca-certificates-bundle", + "version": "20260611-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "c9534a03750bdfae341f10969016090fc11febbd" + } + ], + "licenses": [ + { + "license": { + "id": "MPL-2.0" + } + }, + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ca-certificates-bundle@20260611-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ca-certificates" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "20260611-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "ca-certificates", + "version": "20260611-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "8f2a04abeb54b331e2970a0a0dffb7bd6bdde567" + } + ], + "licenses": [ + { + "license": { + "id": "MPL-2.0" + } + }, + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ca-certificates@20260611-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ca-certificates" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "20260611-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "gdbm", + "version": "1.26-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "619493d8124fe49a8ee1d8f7a1372cf7e3977337" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-3.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "gdbm@1.26-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "gdbm" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.26-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "keyutils-libs", + "version": "1.6.3-r4", + "hashes": [ + { + "alg": "SHA-1", + "content": "b7331c96f077fc3522ee4361a441d1097204cd90" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-or-later" + } + }, + { + "license": { + "id": "LGPL-2.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "keyutils-libs@1.6.3-r4" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "keyutils" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.6.3-r4" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "krb5-conf", + "version": "1.0-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "40a11e0690a59e110367b62a80661024e9942a2d" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "krb5-conf@1.0-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "krb5-conf" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.0-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "krb5-libs", + "version": "1.22.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "ef02346e21b817ff379e4601e5b1fc9760e5e31a" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "krb5-libs@1.22.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "krb5" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.22.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libapk", + "version": "3.0.6-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "523a8f58104589f74f743d501c81bf6517155378" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libapk@3.0.6-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "apk-tools" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.0.6-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libbz2", + "version": "1.0.8-r6", + "hashes": [ + { + "alg": "SHA-1", + "content": "08566ba5c7af97c25474be8b24e8b48f0116b67d" + } + ], + "licenses": [ + { + "license": { + "name": "bzip-2-1.0.6" + } + } + ], + "purl": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libbz2@1.0.8-r6" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "bzip2" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.0.8-r6" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libcom_err", + "version": "1.47.4-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "4b9fb5899ea0b1c0cfbb2a2c5952704437d4ecef" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-or-later" + } + }, + { + "license": { + "id": "LGPL-2.0-or-later" + } + }, + { + "license": { + "id": "BSD-3-Clause" + } + }, + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libcom_err@1.47.4-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "e2fsprogs" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.47.4-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libcrypto3", + "version": "3.5.8-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "1b3b9fc0c136f4936932bcb2ec21499f0ae5dfd3" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "purl": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libcrypto3@3.5.8-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "openssl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.5.8-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libffi", + "version": "3.5.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "2f7b261f7fcecc4eebd8b330e7f6fb80713bfe3a" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libffi@3.5.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libffi" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.5.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Carlo Landmeter " + }, + "name": "libintl", + "version": "1.0-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "282d6642ccac87237e43a864159d73cf5abe7550" + } + ], + "licenses": [ + { + "license": { + "id": "LGPL-2.1-or-later" + } + } + ], + "purl": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libintl@1.0-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "gettext" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.0-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Milan P. Stanić " + }, + "name": "libncursesw", + "version": "6.6_p20260516-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "9f318e6e324d6827274829194cf6ac6afbaded12" + } + ], + "licenses": [ + { + "license": { + "name": "X-11" + } + } + ], + "purl": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libncursesw@6.6_p20260516-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ncurses" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "6.6_p20260516-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "name": "libnsl", + "version": "2.0.1-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "5194adbf26560b52be318481a7af294ab05fd795" + } + ], + "licenses": [ + { + "license": { + "id": "LGPL-2.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libnsl@2.0.1-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libnsl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2.0.1-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Milan P. Stanić " + }, + "name": "libpanelw", + "version": "6.6_p20260516-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "149bdc434232ed11fc5bb975ba519a07154a6f56" + } + ], + "licenses": [ + { + "license": { + "name": "X-11" + } + } + ], + "purl": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libpanelw@6.6_p20260516-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ncurses" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "6.6_p20260516-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libssl3", + "version": "3.5.8-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "5f9b1e55d821953d2e2b1db322dad70a3b5041ea" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "purl": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libssl3@3.5.8-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "openssl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.5.8-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libtirpc-conf", + "version": "1.3.5-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "0c17d9988dc986c90e22f79778df047eca9973ff" + } + ], + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libtirpc-conf@1.3.5-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libtirpc" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.5-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libtirpc", + "version": "1.3.5-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "c32865bd86a8b8829d152279cabbc5ac6d430eb2" + } + ], + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libtirpc@1.3.5-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libtirpc" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.5-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libuuid", + "version": "2.42.3-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "8f041ef637ad75f381cc0c034f2afbbb0303264e" + } + ], + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libuuid@2.42.3-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "util-linux" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2.42.3-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Francesco Colista " + }, + "name": "libverto", + "version": "0.3.2-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "73233059338142e4ac6d8fb8bb0074e93da75dc1" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libverto@0.3.2-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libverto" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "0.3.2-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "musl-utils", + "version": "1.2.6-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "75ada3c48d63ec5d87c42fdf934a3fdd11298dc5" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + }, + { + "license": { + "id": "BSD-2-Clause" + } + }, + { + "license": { + "id": "GPL-2.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "musl-utils@1.2.6-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "musl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.2.6-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "musl", + "version": "1.2.6-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "0f7e5827e4e1a73631beda27b78431a8ba240e05" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "musl@1.2.6-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "musl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.2.6-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Milan P. Stanić " + }, + "name": "ncurses-terminfo-base", + "version": "6.6_p20260516-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "9d551d828e9c8ee52c5801c1d6046828ebf15752" + } + ], + "licenses": [ + { + "license": { + "name": "X-11" + } + } + ], + "purl": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ncurses-terminfo-base@6.6_p20260516-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ncurses" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "6.6_p20260516-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "qaqland " + }, + "name": "readline", + "version": "8.3.3-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "945b16e378bc00e44d89d4de8124bba7647fdf4d" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-3.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "readline@8.3.3-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "readline" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "8.3.3-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "scanelf", + "version": "1.3.9-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "013f903d0ba219673aebbdd04f74bb5ed82b01f0" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "scanelf@1.3.9-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "pax-utils" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.9-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Jingyun Hua " + }, + "name": "sqlite-libs", + "version": "3.53.4-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "f7630ceb37c232b6609861aeab6cdb9cd120e6fa" + } + ], + "licenses": [ + { + "license": { + "id": "blessing" + } + } + ], + "purl": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "sqlite-libs@3.53.4-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "sqlite" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.53.4-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Sören Tempel " + }, + "name": "ssl_client", + "version": "1.37.0-r31", + "hashes": [ + { + "alg": "SHA-1", + "content": "c220f4a5125a313af733e98def94132bb1e9d40d" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ssl_client@1.37.0-r31" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "busybox" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.37.0-r31" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "tzdata", + "version": "2026c-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "61f7544ecd8dd63eac23fe3e645702fda92ef02a" + } + ], + "licenses": [ + { + "license": { + "name": "Public-Domain" + } + } + ], + "purl": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "tzdata@2026c-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "tzdata" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2026c-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "xz-libs", + "version": "5.8.3-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "4c92c5be0c5bef404e93c880eba9037a9b147347" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-or-later" + } + }, + { + "license": { + "id": "0BSD" + } + }, + { + "license": { + "name": "Public-Domain" + } + }, + { + "license": { + "id": "LGPL-2.1-or-later" + } + } + ], + "purl": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "xz-libs@5.8.3-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "xz" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "5.8.3-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "zlib", + "version": "1.3.2-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "dd4c3d102acaef2a71a1495951d55fabc8680613" + } + ], + "licenses": [ + { + "license": { + "id": "Zlib" + } + } + ], + "purl": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "zlib@1.3.2-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "zlib" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.2-r0" + } + ] + }, + { + "bom-ref": "pkg:pypi/cffi@2.1.1", + "type": "library", + "name": "cffi", + "version": "2.1.1", + "licenses": [ + { + "license": { + "id": "MIT-0" + } + } + ], + "purl": "pkg:pypi/cffi@2.1.1", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/cryptography@50.0.1", + "type": "library", + "name": "cryptography", + "version": "50.0.1", + "licenses": [ + { + "expression": "Apache-2.0 OR BSD-3-Clause" + } + ], + "purl": "pkg:pypi/cryptography@50.0.1", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/cryptography-50.0.1.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/informed-decision@0.2.0", + "type": "library", + "name": "informed-decision", + "version": "0.2.0", + "purl": "pkg:pypi/informed-decision@0.2.0", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/informed_decision-0.2.0.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/pycparser@3.0", + "type": "library", + "name": "pycparser", + "version": "3.0", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:pypi/pycparser@3.0", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/pycparser-3.0.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/pyjwt@2.15.1", + "type": "library", + "name": "PyJWT", + "version": "2.15.1", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:pypi/pyjwt@2.15.1", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/pyjwt-2.15.1.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/waitress@3.0.2", + "type": "library", + "name": "waitress", + "version": "3.0.2", + "licenses": [ + { + "license": { + "id": "ZPL-2.1" + } + } + ], + "purl": "pkg:pypi/waitress@3.0.2", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/waitress-3.0.2.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + } + ], + "dependencies": [ + { + "ref": "65b030f2-ac92-4cbc-a6e6-f92890b5a5f5", + "dependsOn": [ + "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "72113269-9efb-4c6a-a07f-752a12125747", + "dependsOn": [ + "65b030f2-ac92-4cbc-a6e6-f92890b5a5f5", + "pkg:pypi/cffi@2.1.1", + "pkg:pypi/cryptography@50.0.1", + "pkg:pypi/informed-decision@0.2.0", + "pkg:pypi/pycparser@3.0", + "pkg:pypi/pyjwt@2.15.1", + "pkg:pypi/waitress@3.0.2" + ] + }, + { + "ref": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:pypi/cffi@2.1.1", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/cryptography@50.0.1", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/informed-decision@0.2.0", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/pycparser@3.0", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/pyjwt@2.15.1", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/waitress@3.0.2", + "dependsOn": [] + } + ], + "vulnerabilities": [ + { + "id": "CVE-2026-85091", + "source": { + "name": "alpine", + "url": "https://secdb.alpinelinux.org/" + }, + "ratings": [ + { + "source": { + "name": "ubuntu" + }, + "severity": "medium" + } + ], + "cwes": [ + 787 + ], + "description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", + "recommendation": "Upgrade zlib to version 1.3.2-r1", + "advisories": [ + { + "url": "https://avd.aquasec.com/nvd/cve-2026-85091" + }, + { + "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" + }, + { + "url": "https://github.com/madler/zlib" + }, + { + "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393" + }, + { + "url": "https://www.cve.org/CVERecord?id=CVE-2026-85091" + }, + { + "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" + } + ], + "published": "2026-09-03T13:06:20+00:00", + "updated": "2026-09-09T20:41:07+00:00", + "affects": [ + { + "ref": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=3.24.1", + "versions": [ + { + "version": "1.3.2-r0", + "status": "affected" + } + ] + } + ] + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json new file mode 100644 index 0000000..3c4ff89 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json @@ -0,0 +1,2387 @@ +{ + "SchemaVersion": 2, + "Trivy": { + "Version": "0.74.0" + }, + "ReportID": "01a129db-cdaf-7437-981b-0d63c6d47346", + "CreatedAt": "2026-10-11T07:27:13.327278878Z", + "ArtifactID": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "ArtifactName": "/artifact/base-image.tar", + "ArtifactType": "container_image", + "Metadata": { + "Size": 88258048, + "OS": { + "Family": "alpine", + "Name": "3.24.1" + }, + "ImageID": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "DiffIDs": [ + "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c", + "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd", + "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366", + "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe", + "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1", + "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c", + "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59", + "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02", + "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + ], + "ImageConfig": { + "architecture": "amd64", + "created": "2026-10-11T01:21:04.787527697Z", + "docker_version": "27.5.1", + "history": [ + { + "created": "2026-06-16T00:01:29.967161902Z", + "created_by": "ADD alpine-minirootfs-3.24.1-x86_64.tar.gz / # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-06-16T00:01:29.967161902Z", + "created_by": "CMD [\"/bin/sh\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV LANG=C.UTF-8", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "RUN /bin/sh -c set -eux; \tapk add --no-cache \t\tca-certificates \t\ttzdata \t; # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PYTHON_VERSION=3.12.14", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:10:30.672225972Z", + "created_by": "RUN /bin/sh -c set -eux; \t\tapk add --no-cache --virtual .build-deps \t\tbluez-dev \t\tbzip2-dev \t\tdpkg-dev dpkg \t\tfindutils \t\tg++ \t\tgcc \t\tgdbm-dev \t\tgnupg \t\tlibc-dev \t\tlibffi-dev \t\tlibnsl-dev \t\tlibtirpc-dev \t\tlinux-headers \t\tmake \t\tncurses-dev \t\topenssl-dev \t\tpax-utils \t\treadline-dev \t\tsqlite-dev \t\ttar \t\ttcl-dev \t\ttk \t\ttk-dev \t\tutil-linux-dev \t\txz \t\txz-dev \t\tzlib-dev \t; \t\twget -O python.tar.xz \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz\"; \techo \"$PYTHON_SHA256 *python.tar.xz\" | sha256sum -c -; \twget -O python.tar.xz.asc \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc\"; \tGNUPGHOME=\"$(mktemp -d)\"; export GNUPGHOME; \tgpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$GPG_KEY\"; \tgpg --batch --verify python.tar.xz.asc python.tar.xz; \tgpgconf --kill all; \trm -rf \"$GNUPGHOME\" python.tar.xz.asc; \tmkdir -p /usr/src/python; \ttar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; \trm python.tar.xz; \t\tcd /usr/src/python; \tgnuArch=\"$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)\"; \t./configure \t\t--build=\"$gnuArch\" \t\t--enable-loadable-sqlite-extensions \t\t--enable-option-checking=fatal \t\t--enable-shared \t\t$(test \"${gnuArch%%-*}\" != 'riscv64' \u0026\u0026 echo '--with-lto') \t\t--with-ensurepip \t; \tnproc=\"$(nproc)\"; \tEXTRA_CFLAGS=\"-DTHREAD_STACK_SIZE=0x100000\"; \tLDFLAGS=\"${LDFLAGS:-} -Wl,--strip-all\"; \tarch=\"$(apk --print-arch)\"; \tcase \"$arch\" in \t\tx86_64|aarch64) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer\"; \t\t\t;; \t\tx86) \t\t\t;; \t\t*) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer\"; \t\t\t;; \tesac; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-}\" \t; \trm python; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\\$\\$ORIGIN/../lib'\" \t\tpython \t; \tmake install; \t\tcd /; \trm -rf /usr/src/python; \t\tfind /usr/local -depth \t\t\\( \t\t\t\\( -type d -a \\( -name test -o -name tests -o -name idle_test \\) \\) \t\t\t-o \\( -type f -a \\( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \\) \\) \t\t\\) -exec rm -rf '{}' + \t; \t\tfind /usr/local -type f -executable -not \\( -name '*tkinter*' \\) -exec scanelf --needed --nobanner --format '%n#p' '{}' ';' \t\t| tr ',' '\\n' \t\t| sort -u \t\t| awk 'system(\"[ -e /usr/local/lib/\" $1 \" ]\") == 0 { next } { print \"so:\" $1 }' \t\t| xargs -rt apk add --no-network --virtual .python-rundeps \t; \tapk del --no-network .build-deps; \t\texport PYTHONDONTWRITEBYTECODE=1; \tpython3 --version; \tpip3 --version # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:10:30.782726003Z", + "created_by": "RUN /bin/sh -c set -eux; \tfor src in idle3 pip3 pydoc3 python3 python3-config; do \t\tdst=\"$(echo \"$src\" | tr -d 3)\"; \t\t[ -s \"/usr/local/bin/$src\" ]; \t\t[ ! -e \"/usr/local/bin/$dst\" ]; \t\tln -svT \"$src\" \"/usr/local/bin/$dst\"; \tdone # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:10:30.782726003Z", + "created_by": "CMD [\"python3\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-11T00:49:47.962156876+02:00", + "created_by": "ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-11T00:49:47.962156876+02:00", + "created_by": "RUN /bin/sh -c apk add --no-cache 'libuuid\u003e=2.42.3-r1' \u0026\u0026 addgroup -S -g 10001 informed \u0026\u0026 adduser -S -u 10001 -G informed -H informed # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:55.351944978+02:00", + "created_by": "COPY /opt/venv /opt/venv # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.462092072+02:00", + "created_by": "RUN /bin/sh -c rm -rf /usr/local/bin/pip* /usr/local/lib/python3.12/site-packages/pip* /usr/local/lib/python3.12/site-packages/setuptools* /usr/local/lib/python3.12/site-packages/pkg_resources /opt/venv/bin/pip* /opt/venv/lib/python3.12/site-packages/pip* /opt/venv/lib/python3.12/site-packages/setuptools* /opt/venv/lib/python3.12/site-packages/pkg_resources # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "WORKDIR /app", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "USER 10001:10001", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "EXPOSE [8080/tcp 8081/tcp]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "ENTRYPOINT [\"informed-decision-container\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-11T01:15:11.991443676Z", + "created_by": "/bin/sh -c #(nop) ARG SOURCE_REVISION", + "empty_layer": true + }, + { + "created": "2026-10-11T01:21:04.716126392Z", + "created_by": "/bin/sh -c #(nop) LABEL org.opencontainers.image.revision=3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168 org.opencontainers.image.base.digest=sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173 social.coulomb.source.policy.sha256=9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62 social.coulomb.release.scope=INFD-WP-0009-T04/purpose-overlay-v1", + "empty_layer": true + }, + { + "created": "2026-10-11T01:21:04.787527697Z", + "created_by": "/bin/sh -c #(nop) COPY file:2be9cb36e7253e15733673359cda8caa22986b6888822a008c1b360d909994e0 in /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py " + } + ], + "os": "linux", + "rootfs": { + "type": "layers", + "diff_ids": [ + "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c", + "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd", + "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366", + "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe", + "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1", + "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c", + "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59", + "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02", + "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + ] + }, + "config": { + "Entrypoint": [ + "informed-decision-container" + ], + "Env": [ + "PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "LANG=C.UTF-8", + "GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", + "PYTHON_VERSION=3.12.14", + "PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a", + "PYTHONDONTWRITEBYTECODE=1", + "PYTHONUNBUFFERED=1" + ], + "Image": "sha256:90f1574f9eda35fa6cb972961beb27a7cb904c36560e381930b0e14065c23883", + "Labels": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "User": "10001:10001", + "WorkingDir": "/app", + "ExposedPorts": { + "8080/tcp": {}, + "8081/tcp": {} + } + } + }, + "Layers": [ + { + "Size": 8697856, + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "Size": 1538048, + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "Size": 47150592, + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "Size": 5120, + "Digest": "sha256:ed62c91ccd94e36a928e96d704cfcf20861302590245cc12aa89a15a5d6be29b", + "DiffID": "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe" + }, + { + "Size": 131584, + "Digest": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86", + "DiffID": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "Size": 30705664, + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "Size": 12288, + "Digest": "sha256:16a3dba6b720d3059eab918cd3596f94145ac9cf4d456f925a21f0f72522863f", + "DiffID": "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59" + }, + { + "Size": 1536, + "Digest": "sha256:e73dd464fbff5607cc62a1b2b66b0eefe737dfad4db8e7b58a48cda7c12d94d3", + "DiffID": "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02" + }, + { + "Size": 15360, + "Digest": "sha256:cfee29c2f8119d2a39714ecbe5095a2dc1c986054f2e1fe0a6565163242417e3", + "DiffID": "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + } + ] + }, + "Results": [ + { + "Target": "/artifact/base-image.tar (alpine 3.24.1)", + "Class": "os-pkgs", + "Type": "alpine", + "Packages": [ + { + "ID": ".python-rundeps@20260901.001029", + "Name": ".python-rundeps", + "Identifier": { + "PURL": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch\u0026distro=3.24.1", + "UID": "4e26c99fecac1e97" + }, + "Version": "20260901.001029", + "Arch": "noarch", + "DependsOn": [ + "gdbm@1.26-r0", + "libbz2@1.0.8-r6", + "libcrypto3@3.5.8-r0", + "libffi@3.5.2-r1", + "libncursesw@6.6_p20260516-r0", + "libnsl@2.0.1-r2", + "libpanelw@6.6_p20260516-r0", + "libssl3@3.5.8-r0", + "libtirpc@1.3.5-r1", + "libuuid@2.42.3-r1", + "musl@1.2.6-r2", + "readline@8.3.3-r1", + "sqlite-libs@3.53.4-r0", + "xz-libs@5.8.3-r0", + "zlib@1.3.2-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:51d0c1e7d88a414345799f0309185c625013ef32", + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-baselayout@3.7.2-r1", + "Name": "alpine-baselayout", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "1b9c543300f8073e" + }, + "Version": "3.7.2-r1", + "Arch": "x86_64", + "SrcName": "alpine-baselayout", + "SrcVersion": "3.7.2-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "alpine-baselayout-data@3.7.2-r1", + "busybox-binsh@1.37.0-r31" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:f0fcfdc2f4da058af6473bc45c4eab62916225b2", + "InstalledFiles": [ + "etc/motd", + "etc/crontabs/root", + "etc/modprobe.d/aliases.conf", + "etc/modprobe.d/blacklist.conf", + "etc/modprobe.d/i386.conf", + "etc/profile.d/20locale.sh", + "etc/profile.d/README", + "etc/profile.d/color_prompt.sh.disabled", + "usr/lib/sysctl.d/00-alpine.conf", + "var/lock", + "var/run", + "var/spool/mail", + "var/spool/cron/crontabs" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-baselayout-data@3.7.2-r1", + "Name": "alpine-baselayout-data", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "fcc3cd90122d8aa7" + }, + "Version": "3.7.2-r1", + "Arch": "x86_64", + "SrcName": "alpine-baselayout", + "SrcVersion": "3.7.2-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c6f9bded17d844b6f1b0bb5766d2c35c0d5c8508", + "InstalledFiles": [ + "etc/fstab", + "etc/group", + "etc/hostname", + "etc/hosts", + "etc/inittab", + "etc/modules", + "etc/mtab", + "etc/nsswitch.conf", + "etc/passwd", + "etc/profile", + "etc/protocols", + "etc/services", + "etc/shadow", + "etc/shells", + "etc/sysctl.conf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-keys@2.6-r0", + "Name": "alpine-keys", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "cb1f6c8fa74713e0" + }, + "Version": "2.6-r0", + "Arch": "x86_64", + "SrcName": "alpine-keys", + "SrcVersion": "2.6-r0", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:d8d6b80e53c059a77e4915da78ba964f3ffea240", + "InstalledFiles": [ + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", + "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", + "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", + "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", + "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", + "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", + "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", + "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", + "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", + "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", + "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", + "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", + "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-release@3.24.1-r0", + "Name": "alpine-release", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "6cfad6f36e1f31aa" + }, + "Version": "3.24.1-r0", + "Arch": "x86_64", + "SrcName": "alpine-base", + "SrcVersion": "3.24.1-r0", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "alpine-keys@2.6-r0" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:bc6912a25cdc7733e0035ed509eceaa4026946e3", + "InstalledFiles": [ + "etc/alpine-release", + "etc/issue", + "etc/os-release", + "etc/secfixes.d/alpine", + "usr/lib/os-release" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "apk-tools@3.0.6-r0", + "Name": "apk-tools", + "Identifier": { + "PURL": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "cb2633c883b17a04" + }, + "Version": "3.0.6-r0", + "Arch": "x86_64", + "SrcName": "apk-tools", + "SrcVersion": "3.0.6-r0", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "ca-certificates-bundle@20260611-r0", + "libapk@3.0.6-r0", + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2", + "zlib@1.3.2-r0" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:043333589798a1f52e09ae63f026c6c8fa676d34", + "InstalledFiles": [ + "sbin/apk" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "busybox@1.37.0-r31", + "Name": "busybox", + "Identifier": { + "PURL": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "771020c43c8440bf" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:b5405ebc02f7dd8be95b6265c54b243d5456ab8f", + "InstalledFiles": [ + "bin/busybox", + "etc/securetty", + "etc/busybox-paths.d/busybox", + "etc/logrotate.d/acpid", + "etc/network/if-up.d/dad", + "etc/udhcpc/udhcpc.conf", + "usr/share/udhcpc/default.script" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "busybox-binsh@1.37.0-r31", + "Name": "busybox-binsh", + "Identifier": { + "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "1ec8a3d5d2b63297" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "busybox@1.37.0-r31" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:5cbd14acc6f1804c5bac6c77dc2c492f010b0fc7", + "InstalledFiles": [ + "bin/sh" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ca-certificates@20260611-r0", + "Name": "ca-certificates", + "Identifier": { + "PURL": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "2a3c316ee83c6198" + }, + "Version": "20260611-r0", + "Arch": "x86_64", + "SrcName": "ca-certificates", + "SrcVersion": "20260611-r0", + "Licenses": [ + "MPL-2.0", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "busybox-binsh@1.37.0-r31", + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + "Digest": "sha1:8f2a04abeb54b331e2970a0a0dffb7bd6bdde567", + "InstalledFiles": [ + "etc/ca-certificates.conf", + "etc/apk/protected_paths.d/ca-certificates.list", + "etc/ca-certificates/update.d/certhash", + "usr/bin/c_rehash", + "usr/sbin/update-ca-certificates", + "usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", + "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", + "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", + "usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", + "usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", + "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", + "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", + "usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", + "usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", + "usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", + "usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", + "usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", + "usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", + "usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", + "usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", + "usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", + "usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", + "usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", + "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", + "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", + "usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", + "usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", + "usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", + "usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", + "usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/Izenpe.com.crt", + "usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", + "usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", + "usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", + "usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", + "usr/share/ca-certificates/mozilla/OISTE_Server_Root_ECC_G1.crt", + "usr/share/ca-certificates/mozilla/OISTE_Server_Root_RSA_G1.crt", + "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", + "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", + "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", + "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", + "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", + "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", + "usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", + "usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", + "usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", + "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", + "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", + "usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", + "usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", + "usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", + "usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", + "usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt", + "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", + "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", + "usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", + "usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", + "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", + "usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", + "usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", + "usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", + "usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", + "usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", + "usr/share/ca-certificates/mozilla/e-Szigno_TLS_Root_CA_2023.crt", + "usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", + "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", + "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", + "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", + "usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", + "usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ca-certificates-bundle@20260611-r0", + "Name": "ca-certificates-bundle", + "Identifier": { + "PURL": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "20337c2ea28bef28" + }, + "Version": "20260611-r0", + "Arch": "x86_64", + "SrcName": "ca-certificates", + "SrcVersion": "20260611-r0", + "Licenses": [ + "MPL-2.0", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c9534a03750bdfae341f10969016090fc11febbd", + "InstalledFiles": [ + "etc/ssl/cert.pem", + "etc/ssl/certs/ca-certificates.crt", + "etc/ssl1.1/cert.pem", + "etc/ssl1.1/certs" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "gdbm@1.26-r0", + "Name": "gdbm", + "Identifier": { + "PURL": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "5eb1a3f86262ca77" + }, + "Version": "1.26-r0", + "Arch": "x86_64", + "SrcName": "gdbm", + "SrcVersion": "1.26-r0", + "Licenses": [ + "GPL-3.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:619493d8124fe49a8ee1d8f7a1372cf7e3977337", + "InstalledFiles": [ + "usr/lib/libgdbm.so.6", + "usr/lib/libgdbm.so.6.0.0", + "usr/lib/libgdbm_compat.so.4", + "usr/lib/libgdbm_compat.so.4.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "keyutils-libs@1.6.3-r4", + "Name": "keyutils-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64\u0026distro=3.24.1", + "UID": "a1a29120eb342032" + }, + "Version": "1.6.3-r4", + "Arch": "x86_64", + "SrcName": "keyutils", + "SrcVersion": "1.6.3-r4", + "Licenses": [ + "GPL-2.0-or-later", + "LGPL-2.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:b7331c96f077fc3522ee4361a441d1097204cd90", + "InstalledFiles": [ + "usr/lib/libkeyutils.so.1", + "usr/lib/libkeyutils.so.1.10" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "krb5-conf@1.0-r2", + "Name": "krb5-conf", + "Identifier": { + "PURL": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "e7cf94ba8b6dbc33" + }, + "Version": "1.0-r2", + "Arch": "x86_64", + "SrcName": "krb5-conf", + "SrcVersion": "1.0-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:40a11e0690a59e110367b62a80661024e9942a2d", + "InstalledFiles": [ + "etc/krb5.conf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "krb5-libs@1.22.2-r1", + "Name": "krb5-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "958f8b4a4f087dac" + }, + "Version": "1.22.2-r1", + "Arch": "x86_64", + "SrcName": "krb5", + "SrcVersion": "1.22.2-r1", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "keyutils-libs@1.6.3-r4", + "krb5-conf@1.0-r2", + "libcom_err@1.47.4-r0", + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "libverto@0.3.2-r2", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:ef02346e21b817ff379e4601e5b1fc9760e5e31a", + "InstalledFiles": [ + "usr/lib/libgssapi_krb5.so.2", + "usr/lib/libgssapi_krb5.so.2.2", + "usr/lib/libgssrpc.so.4", + "usr/lib/libgssrpc.so.4.2", + "usr/lib/libk5crypto.so.3", + "usr/lib/libk5crypto.so.3.1", + "usr/lib/libkadm5clnt_mit.so.12", + "usr/lib/libkadm5clnt_mit.so.12.0", + "usr/lib/libkadm5srv_mit.so.12", + "usr/lib/libkadm5srv_mit.so.12.0", + "usr/lib/libkdb5.so.10", + "usr/lib/libkdb5.so.10.0", + "usr/lib/libkrad.so.0", + "usr/lib/libkrad.so.0.0", + "usr/lib/libkrb5.so.3", + "usr/lib/libkrb5.so.3.3", + "usr/lib/libkrb5support.so.0", + "usr/lib/libkrb5support.so.0.1", + "usr/lib/krb5/plugins/kdb/db2.so", + "usr/lib/krb5/plugins/preauth/otp.so", + "usr/lib/krb5/plugins/preauth/spake.so", + "usr/lib/krb5/plugins/preauth/test.so", + "usr/lib/krb5/plugins/tls/k5tls.so" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libapk@3.0.6-r0", + "Name": "libapk", + "Identifier": { + "PURL": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "a35b8b9b3219513a" + }, + "Version": "3.0.6-r0", + "Arch": "x86_64", + "SrcName": "apk-tools", + "SrcVersion": "3.0.6-r0", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "musl@1.2.6-r2", + "zlib@1.3.2-r0" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:523a8f58104589f74f743d501c81bf6517155378", + "InstalledFiles": [ + "usr/lib/libapk.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libbz2@1.0.8-r6", + "Name": "libbz2", + "Identifier": { + "PURL": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64\u0026distro=3.24.1", + "UID": "48e17539404e2d56" + }, + "Version": "1.0.8-r6", + "Arch": "x86_64", + "SrcName": "bzip2", + "SrcVersion": "1.0.8-r6", + "Licenses": [ + "bzip-2-1.0.6" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:08566ba5c7af97c25474be8b24e8b48f0116b67d", + "InstalledFiles": [ + "usr/lib/libbz2.so.1", + "usr/lib/libbz2.so.1.0.8" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libcom_err@1.47.4-r0", + "Name": "libcom_err", + "Identifier": { + "PURL": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "3fc35a3f66d192af" + }, + "Version": "1.47.4-r0", + "Arch": "x86_64", + "SrcName": "e2fsprogs", + "SrcVersion": "1.47.4-r0", + "Licenses": [ + "GPL-2.0-or-later", + "LGPL-2.0-or-later", + "BSD-3-Clause", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:4b9fb5899ea0b1c0cfbb2a2c5952704437d4ecef", + "InstalledFiles": [ + "usr/lib/libcom_err.so.2", + "usr/lib/libcom_err.so.2.1" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libcrypto3@3.5.8-r0", + "Name": "libcrypto3", + "Identifier": { + "PURL": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "4299bba2ba9c96aa" + }, + "Version": "3.5.8-r0", + "Arch": "x86_64", + "SrcName": "openssl", + "SrcVersion": "3.5.8-r0", + "Licenses": [ + "Apache-2.0" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:1b3b9fc0c136f4936932bcb2ec21499f0ae5dfd3", + "InstalledFiles": [ + "etc/ssl/ct_log_list.cnf", + "etc/ssl/ct_log_list.cnf.dist", + "etc/ssl/openssl.cnf", + "etc/ssl/openssl.cnf.dist", + "usr/lib/libcrypto.so.3", + "usr/lib/engines-3/afalg.so", + "usr/lib/engines-3/capi.so", + "usr/lib/engines-3/loader_attic.so", + "usr/lib/engines-3/padlock.so", + "usr/lib/ossl-modules/legacy.so" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libffi@3.5.2-r1", + "Name": "libffi", + "Identifier": { + "PURL": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "d3eaa921287b1ccd" + }, + "Version": "3.5.2-r1", + "Arch": "x86_64", + "SrcName": "libffi", + "SrcVersion": "3.5.2-r1", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:2f7b261f7fcecc4eebd8b330e7f6fb80713bfe3a", + "InstalledFiles": [ + "usr/lib/libffi.so.8", + "usr/lib/libffi.so.8.2.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libintl@1.0-r0", + "Name": "libintl", + "Identifier": { + "PURL": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "25c18808d8fc87e0" + }, + "Version": "1.0-r0", + "Arch": "x86_64", + "SrcName": "gettext", + "SrcVersion": "1.0-r0", + "Licenses": [ + "LGPL-2.1-or-later" + ], + "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:282d6642ccac87237e43a864159d73cf5abe7550", + "InstalledFiles": [ + "usr/lib/libintl.so.8", + "usr/lib/libintl.so.8.4.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libncursesw@6.6_p20260516-r0", + "Name": "libncursesw", + "Identifier": { + "PURL": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e8939f45e2191bcc" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "DependsOn": [ + "musl@1.2.6-r2", + "ncurses-terminfo-base@6.6_p20260516-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:9f318e6e324d6827274829194cf6ac6afbaded12", + "InstalledFiles": [ + "usr/lib/libncursesw.so.6", + "usr/lib/libncursesw.so.6.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libnsl@2.0.1-r2", + "Name": "libnsl", + "Identifier": { + "PURL": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "3d893c60d41da67b" + }, + "Version": "2.0.1-r2", + "Arch": "x86_64", + "SrcName": "libnsl", + "SrcVersion": "2.0.1-r2", + "Licenses": [ + "LGPL-2.0-or-later" + ], + "DependsOn": [ + "libintl@1.0-r0", + "libtirpc@1.3.5-r1", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:5194adbf26560b52be318481a7af294ab05fd795", + "InstalledFiles": [ + "usr/lib/libnsl.so.3", + "usr/lib/libnsl.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libpanelw@6.6_p20260516-r0", + "Name": "libpanelw", + "Identifier": { + "PURL": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "ef1ad9bb256b373" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "DependsOn": [ + "libncursesw@6.6_p20260516-r0", + "musl@1.2.6-r2", + "ncurses-terminfo-base@6.6_p20260516-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:149bdc434232ed11fc5bb975ba519a07154a6f56", + "InstalledFiles": [ + "usr/lib/libpanelw.so.6", + "usr/lib/libpanelw.so.6.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libssl3@3.5.8-r0", + "Name": "libssl3", + "Identifier": { + "PURL": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "f290ab59b88b1c4a" + }, + "Version": "3.5.8-r0", + "Arch": "x86_64", + "SrcName": "openssl", + "SrcVersion": "3.5.8-r0", + "Licenses": [ + "Apache-2.0" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:5f9b1e55d821953d2e2b1db322dad70a3b5041ea", + "InstalledFiles": [ + "usr/lib/libssl.so.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libtirpc@1.3.5-r1", + "Name": "libtirpc", + "Identifier": { + "PURL": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "471c8d955ca03be5" + }, + "Version": "1.3.5-r1", + "Arch": "x86_64", + "SrcName": "libtirpc", + "SrcVersion": "1.3.5-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "krb5-libs@1.22.2-r1", + "libtirpc-conf@1.3.5-r1", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:c32865bd86a8b8829d152279cabbc5ac6d430eb2", + "InstalledFiles": [ + "usr/lib/libtirpc.so.3", + "usr/lib/libtirpc.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libtirpc-conf@1.3.5-r1", + "Name": "libtirpc-conf", + "Identifier": { + "PURL": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "3437392c14aad33f" + }, + "Version": "1.3.5-r1", + "Arch": "x86_64", + "SrcName": "libtirpc", + "SrcVersion": "1.3.5-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:0c17d9988dc986c90e22f79778df047eca9973ff", + "InstalledFiles": [ + "etc/bindresvport.blacklist", + "etc/netconfig" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libuuid@2.42.3-r1", + "Name": "libuuid", + "Identifier": { + "PURL": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "c444e9cdd1bdda40" + }, + "Version": "2.42.3-r1", + "Arch": "x86_64", + "SrcName": "util-linux", + "SrcVersion": "2.42.3-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86", + "DiffID": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + "Digest": "sha1:8f041ef637ad75f381cc0c034f2afbbb0303264e", + "InstalledFiles": [ + "usr/lib/libuuid.so.1", + "usr/lib/libuuid.so.1.3.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libverto@0.3.2-r2", + "Name": "libverto", + "Identifier": { + "PURL": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "9df4321a283a6cf6" + }, + "Version": "0.3.2-r2", + "Arch": "x86_64", + "SrcName": "libverto", + "SrcVersion": "0.3.2-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:73233059338142e4ac6d8fb8bb0074e93da75dc1", + "InstalledFiles": [ + "usr/lib/libverto.so.1", + "usr/lib/libverto.so.1.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "musl@1.2.6-r2", + "Name": "musl", + "Identifier": { + "PURL": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "1f8cb44befe503d4" + }, + "Version": "1.2.6-r2", + "Arch": "x86_64", + "SrcName": "musl", + "SrcVersion": "1.2.6-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:0f7e5827e4e1a73631beda27b78431a8ba240e05", + "InstalledFiles": [ + "lib/ld-musl-x86_64.so.1", + "lib/libc.musl-x86_64.so.1" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "musl-utils@1.2.6-r2", + "Name": "musl-utils", + "Identifier": { + "PURL": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "4497482ec1d943e1" + }, + "Version": "1.2.6-r2", + "Arch": "x86_64", + "SrcName": "musl", + "SrcVersion": "1.2.6-r2", + "Licenses": [ + "MIT", + "BSD-2-Clause", + "GPL-2.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2", + "scanelf@1.3.9-r1" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:75ada3c48d63ec5d87c42fdf934a3fdd11298dc5", + "InstalledFiles": [ + "sbin/ldconfig", + "usr/bin/getconf", + "usr/bin/getent", + "usr/bin/iconv", + "usr/bin/ldd" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ncurses-terminfo-base@6.6_p20260516-r0", + "Name": "ncurses-terminfo-base", + "Identifier": { + "PURL": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e7fac5c6a6e9ae8" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:9d551d828e9c8ee52c5801c1d6046828ebf15752", + "InstalledFiles": [ + "etc/terminfo/a/alacritty", + "etc/terminfo/a/ansi", + "etc/terminfo/d/dumb", + "etc/terminfo/g/gnome", + "etc/terminfo/g/gnome-256color", + "etc/terminfo/k/konsole", + "etc/terminfo/k/konsole-256color", + "etc/terminfo/k/konsole-linux", + "etc/terminfo/l/linux", + "etc/terminfo/p/putty", + "etc/terminfo/p/putty-256color", + "etc/terminfo/r/rxvt", + "etc/terminfo/r/rxvt-256color", + "etc/terminfo/s/screen", + "etc/terminfo/s/screen-256color", + "etc/terminfo/s/st-0.6", + "etc/terminfo/s/st-0.7", + "etc/terminfo/s/st-0.8", + "etc/terminfo/s/st-0.8.5", + "etc/terminfo/s/st-16color", + "etc/terminfo/s/st-256color", + "etc/terminfo/s/st-direct", + "etc/terminfo/s/sun", + "etc/terminfo/t/terminator", + "etc/terminfo/t/terminology", + "etc/terminfo/t/terminology-0.6.1", + "etc/terminfo/t/terminology-1.0.0", + "etc/terminfo/t/terminology-1.8.1", + "etc/terminfo/t/tmux", + "etc/terminfo/t/tmux-256color", + "etc/terminfo/v/vt100", + "etc/terminfo/v/vt102", + "etc/terminfo/v/vt200", + "etc/terminfo/v/vt220", + "etc/terminfo/v/vt52", + "etc/terminfo/v/vte", + "etc/terminfo/v/vte-256color", + "etc/terminfo/x/xterm", + "etc/terminfo/x/xterm-256color", + "etc/terminfo/x/xterm-color", + "etc/terminfo/x/xterm-xfree86" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "readline@8.3.3-r1", + "Name": "readline", + "Identifier": { + "PURL": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "f50058781c93e1f2" + }, + "Version": "8.3.3-r1", + "Arch": "x86_64", + "SrcName": "readline", + "SrcVersion": "8.3.3-r1", + "Licenses": [ + "GPL-3.0-or-later" + ], + "Maintainer": "qaqland \u003cqaq@qaq.land\u003e", + "DependsOn": [ + "libncursesw@6.6_p20260516-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:945b16e378bc00e44d89d4de8124bba7647fdf4d", + "InstalledFiles": [ + "etc/inputrc", + "usr/lib/libreadline.so.8", + "usr/lib/libreadline.so.8.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "scanelf@1.3.9-r1", + "Name": "scanelf", + "Identifier": { + "PURL": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "936394657a1626fb" + }, + "Version": "1.3.9-r1", + "Arch": "x86_64", + "SrcName": "pax-utils", + "SrcVersion": "1.3.9-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:013f903d0ba219673aebbdd04f74bb5ed82b01f0", + "InstalledFiles": [ + "usr/bin/scanelf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "sqlite-libs@3.53.4-r0", + "Name": "sqlite-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "8b10aee2ccc192de" + }, + "Version": "3.53.4-r0", + "Arch": "x86_64", + "SrcName": "sqlite", + "SrcVersion": "3.53.4-r0", + "Licenses": [ + "blessing" + ], + "Maintainer": "Jingyun Hua \u003chuajingyun@loongson.cn\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:f7630ceb37c232b6609861aeab6cdb9cd120e6fa", + "InstalledFiles": [ + "usr/lib/libsqlite3.so.0", + "usr/lib/libsqlite3.so.3.53.4" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ssl_client@1.37.0-r31", + "Name": "ssl_client", + "Identifier": { + "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "d42e31f15a4ce47a" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c220f4a5125a313af733e98def94132bb1e9d40d", + "InstalledFiles": [ + "usr/bin/ssl_client" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "tzdata@2026c-r0", + "Name": "tzdata", + "Identifier": { + "PURL": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "52c6b50eff629f9d" + }, + "Version": "2026c-r0", + "Arch": "x86_64", + "SrcName": "tzdata", + "SrcVersion": "2026c-r0", + "Licenses": [ + "Public-Domain" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + "Digest": "sha1:61f7544ecd8dd63eac23fe3e645702fda92ef02a", + "InstalledFiles": [ + "usr/share/zoneinfo/CET", + "usr/share/zoneinfo/CST6CDT", + "usr/share/zoneinfo/Cuba", + "usr/share/zoneinfo/EET", + "usr/share/zoneinfo/EST", + "usr/share/zoneinfo/EST5EDT", + "usr/share/zoneinfo/Egypt", + "usr/share/zoneinfo/Eire", + "usr/share/zoneinfo/Factory", + "usr/share/zoneinfo/GB", + "usr/share/zoneinfo/GB-Eire", + "usr/share/zoneinfo/GMT", + "usr/share/zoneinfo/GMT+0", + "usr/share/zoneinfo/GMT-0", + "usr/share/zoneinfo/GMT0", + "usr/share/zoneinfo/Greenwich", + "usr/share/zoneinfo/HST", + "usr/share/zoneinfo/Hongkong", + "usr/share/zoneinfo/Iceland", + "usr/share/zoneinfo/Iran", + "usr/share/zoneinfo/Israel", + "usr/share/zoneinfo/Jamaica", + "usr/share/zoneinfo/Japan", + "usr/share/zoneinfo/Kwajalein", + "usr/share/zoneinfo/Libya", + "usr/share/zoneinfo/MET", + "usr/share/zoneinfo/MST", + "usr/share/zoneinfo/MST7MDT", + "usr/share/zoneinfo/NZ", + "usr/share/zoneinfo/NZ-CHAT", + "usr/share/zoneinfo/Navajo", + "usr/share/zoneinfo/PRC", + "usr/share/zoneinfo/PST8PDT", + "usr/share/zoneinfo/Poland", + "usr/share/zoneinfo/Portugal", + "usr/share/zoneinfo/ROC", + "usr/share/zoneinfo/ROK", + "usr/share/zoneinfo/Singapore", + "usr/share/zoneinfo/Turkey", + "usr/share/zoneinfo/UCT", + "usr/share/zoneinfo/UTC", + "usr/share/zoneinfo/Universal", + "usr/share/zoneinfo/W-SU", + "usr/share/zoneinfo/WET", + "usr/share/zoneinfo/Zulu", + "usr/share/zoneinfo/iso3166.tab", + "usr/share/zoneinfo/leap-seconds.list", + "usr/share/zoneinfo/posixrules", + "usr/share/zoneinfo/zone.tab", + "usr/share/zoneinfo/zone1970.tab", + "usr/share/zoneinfo/Africa/Abidjan", + "usr/share/zoneinfo/Africa/Accra", + "usr/share/zoneinfo/Africa/Addis_Ababa", + "usr/share/zoneinfo/Africa/Algiers", + "usr/share/zoneinfo/Africa/Asmara", + "usr/share/zoneinfo/Africa/Asmera", + "usr/share/zoneinfo/Africa/Bamako", + "usr/share/zoneinfo/Africa/Bangui", + "usr/share/zoneinfo/Africa/Banjul", + "usr/share/zoneinfo/Africa/Bissau", + "usr/share/zoneinfo/Africa/Blantyre", + "usr/share/zoneinfo/Africa/Brazzaville", + "usr/share/zoneinfo/Africa/Bujumbura", + "usr/share/zoneinfo/Africa/Cairo", + "usr/share/zoneinfo/Africa/Casablanca", + "usr/share/zoneinfo/Africa/Ceuta", + "usr/share/zoneinfo/Africa/Conakry", + "usr/share/zoneinfo/Africa/Dakar", + "usr/share/zoneinfo/Africa/Dar_es_Salaam", + "usr/share/zoneinfo/Africa/Djibouti", + "usr/share/zoneinfo/Africa/Douala", + "usr/share/zoneinfo/Africa/El_Aaiun", + "usr/share/zoneinfo/Africa/Freetown", + "usr/share/zoneinfo/Africa/Gaborone", + "usr/share/zoneinfo/Africa/Harare", + "usr/share/zoneinfo/Africa/Johannesburg", + "usr/share/zoneinfo/Africa/Juba", + "usr/share/zoneinfo/Africa/Kampala", + "usr/share/zoneinfo/Africa/Khartoum", + "usr/share/zoneinfo/Africa/Kigali", + "usr/share/zoneinfo/Africa/Kinshasa", + "usr/share/zoneinfo/Africa/Lagos", + "usr/share/zoneinfo/Africa/Libreville", + "usr/share/zoneinfo/Africa/Lome", + "usr/share/zoneinfo/Africa/Luanda", + "usr/share/zoneinfo/Africa/Lubumbashi", + "usr/share/zoneinfo/Africa/Lusaka", + "usr/share/zoneinfo/Africa/Malabo", + "usr/share/zoneinfo/Africa/Maputo", + "usr/share/zoneinfo/Africa/Maseru", + "usr/share/zoneinfo/Africa/Mbabane", + "usr/share/zoneinfo/Africa/Mogadishu", + "usr/share/zoneinfo/Africa/Monrovia", + "usr/share/zoneinfo/Africa/Nairobi", + "usr/share/zoneinfo/Africa/Ndjamena", + "usr/share/zoneinfo/Africa/Niamey", + "usr/share/zoneinfo/Africa/Nouakchott", + "usr/share/zoneinfo/Africa/Ouagadougou", + "usr/share/zoneinfo/Africa/Porto-Novo", + "usr/share/zoneinfo/Africa/Sao_Tome", + "usr/share/zoneinfo/Africa/Timbuktu", + "usr/share/zoneinfo/Africa/Tripoli", + "usr/share/zoneinfo/Africa/Tunis", + "usr/share/zoneinfo/Africa/Windhoek", + "usr/share/zoneinfo/America/Adak", + "usr/share/zoneinfo/America/Anchorage", + "usr/share/zoneinfo/America/Anguilla", + "usr/share/zoneinfo/America/Antigua", + "usr/share/zoneinfo/America/Araguaina", + "usr/share/zoneinfo/America/Aruba", + "usr/share/zoneinfo/America/Asuncion", + "usr/share/zoneinfo/America/Atikokan", + "usr/share/zoneinfo/America/Atka", + "usr/share/zoneinfo/America/Bahia", + "usr/share/zoneinfo/America/Bahia_Banderas", + "usr/share/zoneinfo/America/Barbados", + "usr/share/zoneinfo/America/Belem", + "usr/share/zoneinfo/America/Belize", + "usr/share/zoneinfo/America/Blanc-Sablon", + "usr/share/zoneinfo/America/Boa_Vista", + "usr/share/zoneinfo/America/Bogota", + "usr/share/zoneinfo/America/Boise", + "usr/share/zoneinfo/America/Buenos_Aires", + "usr/share/zoneinfo/America/Cambridge_Bay", + "usr/share/zoneinfo/America/Campo_Grande", + "usr/share/zoneinfo/America/Cancun", + "usr/share/zoneinfo/America/Caracas", + "usr/share/zoneinfo/America/Catamarca", + "usr/share/zoneinfo/America/Cayenne", + "usr/share/zoneinfo/America/Cayman", + "usr/share/zoneinfo/America/Chicago", + "usr/share/zoneinfo/America/Chihuahua", + "usr/share/zoneinfo/America/Ciudad_Juarez", + "usr/share/zoneinfo/America/Coral_Harbour", + "usr/share/zoneinfo/America/Cordoba", + "usr/share/zoneinfo/America/Costa_Rica", + "usr/share/zoneinfo/America/Coyhaique", + "usr/share/zoneinfo/America/Creston", + "usr/share/zoneinfo/America/Cuiaba", + "usr/share/zoneinfo/America/Curacao", + "usr/share/zoneinfo/America/Danmarkshavn", + "usr/share/zoneinfo/America/Dawson", + "usr/share/zoneinfo/America/Dawson_Creek", + "usr/share/zoneinfo/America/Denver", + "usr/share/zoneinfo/America/Detroit", + "usr/share/zoneinfo/America/Dominica", + "usr/share/zoneinfo/America/Edmonton", + "usr/share/zoneinfo/America/Eirunepe", + "usr/share/zoneinfo/America/El_Salvador", + "usr/share/zoneinfo/America/Ensenada", + "usr/share/zoneinfo/America/Fort_Nelson", + "usr/share/zoneinfo/America/Fort_Wayne", + "usr/share/zoneinfo/America/Fortaleza", + "usr/share/zoneinfo/America/Glace_Bay", + "usr/share/zoneinfo/America/Godthab", + "usr/share/zoneinfo/America/Goose_Bay", + "usr/share/zoneinfo/America/Grand_Turk", + "usr/share/zoneinfo/America/Grenada", + "usr/share/zoneinfo/America/Guadeloupe", + "usr/share/zoneinfo/America/Guatemala", + "usr/share/zoneinfo/America/Guayaquil", + "usr/share/zoneinfo/America/Guyana", + "usr/share/zoneinfo/America/Halifax", + "usr/share/zoneinfo/America/Havana", + "usr/share/zoneinfo/America/Hermosillo", + "usr/share/zoneinfo/America/Indianapolis", + "usr/share/zoneinfo/America/Inuvik", + "usr/share/zoneinfo/America/Iqaluit", + "usr/share/zoneinfo/America/Jamaica", + "usr/share/zoneinfo/America/Jujuy", + "usr/share/zoneinfo/America/Juneau", + "usr/share/zoneinfo/America/Knox_IN", + "usr/share/zoneinfo/America/Kralendijk", + "usr/share/zoneinfo/America/La_Paz", + "usr/share/zoneinfo/America/Lima", + "usr/share/zoneinfo/America/Los_Angeles", + "usr/share/zoneinfo/America/Louisville", + "usr/share/zoneinfo/America/Lower_Princes", + "usr/share/zoneinfo/America/Maceio", + "usr/share/zoneinfo/America/Managua", + "usr/share/zoneinfo/America/Manaus", + "usr/share/zoneinfo/America/Marigot", + "usr/share/zoneinfo/America/Martinique", + "usr/share/zoneinfo/America/Matamoros", + "usr/share/zoneinfo/America/Mazatlan", + "usr/share/zoneinfo/America/Mendoza", + "usr/share/zoneinfo/America/Menominee", + "usr/share/zoneinfo/America/Merida", + "usr/share/zoneinfo/America/Metlakatla", + "usr/share/zoneinfo/America/Mexico_City", + "usr/share/zoneinfo/America/Miquelon", + "usr/share/zoneinfo/America/Moncton", + "usr/share/zoneinfo/America/Monterrey", + "usr/share/zoneinfo/America/Montevideo", + "usr/share/zoneinfo/America/Montreal", + "usr/share/zoneinfo/America/Montserrat", + "usr/share/zoneinfo/America/Nassau", + "usr/share/zoneinfo/America/New_York", + "usr/share/zoneinfo/America/Nipigon", + "usr/share/zoneinfo/America/Nome", + "usr/share/zoneinfo/America/Noronha", + "usr/share/zoneinfo/America/Nuuk", + "usr/share/zoneinfo/America/Ojinaga", + "usr/share/zoneinfo/America/Panama", + "usr/share/zoneinfo/America/Pangnirtung", + "usr/share/zoneinfo/America/Paramaribo", + "usr/share/zoneinfo/America/Phoenix", + "usr/share/zoneinfo/America/Port-au-Prince", + "usr/share/zoneinfo/America/Port_of_Spain", + "usr/share/zoneinfo/America/Porto_Acre", + "usr/share/zoneinfo/America/Porto_Velho", + "usr/share/zoneinfo/America/Puerto_Rico", + "usr/share/zoneinfo/America/Punta_Arenas", + "usr/share/zoneinfo/America/Rainy_River", + "usr/share/zoneinfo/America/Rankin_Inlet", + "usr/share/zoneinfo/America/Recife", + "usr/share/zoneinfo/America/Regina", + "usr/share/zoneinfo/America/Resolute", + "usr/share/zoneinfo/America/Rio_Branco", + "usr/share/zoneinfo/America/Rosario", + "usr/share/zoneinfo/America/Santa_Isabel", + "usr/share/zoneinfo/America/Santarem", + "usr/share/zoneinfo/America/Santiago", + "usr/share/zoneinfo/America/Santo_Domingo", + "usr/share/zoneinfo/America/Sao_Paulo", + "usr/share/zoneinfo/America/Scoresbysund", + "usr/share/zoneinfo/America/Shiprock", + "usr/share/zoneinfo/America/Sitka", + "usr/share/zoneinfo/America/St_Barthelemy", + "usr/share/zoneinfo/America/St_Johns", + "usr/share/zoneinfo/America/St_Kitts", + "usr/share/zoneinfo/America/St_Lucia", + "usr/share/zoneinfo/America/St_Thomas", + "usr/share/zoneinfo/America/St_Vincent", + "usr/share/zoneinfo/America/Swift_Current", + "usr/share/zoneinfo/America/Tegucigalpa", + "usr/share/zoneinfo/America/Thule", + "usr/share/zoneinfo/America/Thunder_Bay", + "usr/share/zoneinfo/America/Tijuana", + "usr/share/zoneinfo/America/Toronto", + "usr/share/zoneinfo/America/Tortola", + "usr/share/zoneinfo/America/Vancouver", + "usr/share/zoneinfo/America/Virgin", + "usr/share/zoneinfo/America/Whitehorse", + "usr/share/zoneinfo/America/Winnipeg", + "usr/share/zoneinfo/America/Yakutat", + "usr/share/zoneinfo/America/Yellowknife", + "usr/share/zoneinfo/America/Argentina/Buenos_Aires", + "usr/share/zoneinfo/America/Argentina/Catamarca", + "usr/share/zoneinfo/America/Argentina/ComodRivadavia", + "usr/share/zoneinfo/America/Argentina/Cordoba", + "usr/share/zoneinfo/America/Argentina/Jujuy", + "usr/share/zoneinfo/America/Argentina/La_Rioja", + "usr/share/zoneinfo/America/Argentina/Mendoza", + "usr/share/zoneinfo/America/Argentina/Rio_Gallegos", + "usr/share/zoneinfo/America/Argentina/Salta", + "usr/share/zoneinfo/America/Argentina/San_Juan", + "usr/share/zoneinfo/America/Argentina/San_Luis", + "usr/share/zoneinfo/America/Argentina/Tucuman", + "usr/share/zoneinfo/America/Argentina/Ushuaia", + "usr/share/zoneinfo/America/Indiana/Indianapolis", + "usr/share/zoneinfo/America/Indiana/Knox", + "usr/share/zoneinfo/America/Indiana/Marengo", + "usr/share/zoneinfo/America/Indiana/Petersburg", + "usr/share/zoneinfo/America/Indiana/Tell_City", + "usr/share/zoneinfo/America/Indiana/Vevay", + "usr/share/zoneinfo/America/Indiana/Vincennes", + "usr/share/zoneinfo/America/Indiana/Winamac", + "usr/share/zoneinfo/America/Kentucky/Louisville", + "usr/share/zoneinfo/America/Kentucky/Monticello", + "usr/share/zoneinfo/America/North_Dakota/Beulah", + "usr/share/zoneinfo/America/North_Dakota/Center", + "usr/share/zoneinfo/America/North_Dakota/New_Salem", + "usr/share/zoneinfo/Antarctica/Casey", + "usr/share/zoneinfo/Antarctica/Davis", + "usr/share/zoneinfo/Antarctica/DumontDUrville", + "usr/share/zoneinfo/Antarctica/Macquarie", + "usr/share/zoneinfo/Antarctica/Mawson", + "usr/share/zoneinfo/Antarctica/McMurdo", + "usr/share/zoneinfo/Antarctica/Palmer", + "usr/share/zoneinfo/Antarctica/Rothera", + "usr/share/zoneinfo/Antarctica/South_Pole", + "usr/share/zoneinfo/Antarctica/Syowa", + "usr/share/zoneinfo/Antarctica/Troll", + "usr/share/zoneinfo/Antarctica/Vostok", + "usr/share/zoneinfo/Arctic/Longyearbyen", + "usr/share/zoneinfo/Asia/Aden", + "usr/share/zoneinfo/Asia/Almaty", + "usr/share/zoneinfo/Asia/Amman", + "usr/share/zoneinfo/Asia/Anadyr", + "usr/share/zoneinfo/Asia/Aqtau", + "usr/share/zoneinfo/Asia/Aqtobe", + "usr/share/zoneinfo/Asia/Ashgabat", + "usr/share/zoneinfo/Asia/Ashkhabad", + "usr/share/zoneinfo/Asia/Atyrau", + "usr/share/zoneinfo/Asia/Baghdad", + "usr/share/zoneinfo/Asia/Bahrain", + "usr/share/zoneinfo/Asia/Baku", + "usr/share/zoneinfo/Asia/Bangkok", + "usr/share/zoneinfo/Asia/Barnaul", + "usr/share/zoneinfo/Asia/Beirut", + "usr/share/zoneinfo/Asia/Bishkek", + "usr/share/zoneinfo/Asia/Brunei", + "usr/share/zoneinfo/Asia/Calcutta", + "usr/share/zoneinfo/Asia/Chita", + "usr/share/zoneinfo/Asia/Choibalsan", + "usr/share/zoneinfo/Asia/Chongqing", + "usr/share/zoneinfo/Asia/Chungking", + "usr/share/zoneinfo/Asia/Colombo", + "usr/share/zoneinfo/Asia/Dacca", + "usr/share/zoneinfo/Asia/Damascus", + "usr/share/zoneinfo/Asia/Dhaka", + "usr/share/zoneinfo/Asia/Dili", + "usr/share/zoneinfo/Asia/Dubai", + "usr/share/zoneinfo/Asia/Dushanbe", + "usr/share/zoneinfo/Asia/Famagusta", + "usr/share/zoneinfo/Asia/Gaza", + "usr/share/zoneinfo/Asia/Harbin", + "usr/share/zoneinfo/Asia/Hebron", + "usr/share/zoneinfo/Asia/Ho_Chi_Minh", + "usr/share/zoneinfo/Asia/Hong_Kong", + "usr/share/zoneinfo/Asia/Hovd", + "usr/share/zoneinfo/Asia/Irkutsk", + "usr/share/zoneinfo/Asia/Istanbul", + "usr/share/zoneinfo/Asia/Jakarta", + "usr/share/zoneinfo/Asia/Jayapura", + "usr/share/zoneinfo/Asia/Jerusalem", + "usr/share/zoneinfo/Asia/Kabul", + "usr/share/zoneinfo/Asia/Kamchatka", + "usr/share/zoneinfo/Asia/Karachi", + "usr/share/zoneinfo/Asia/Kashgar", + "usr/share/zoneinfo/Asia/Kathmandu", + "usr/share/zoneinfo/Asia/Katmandu", + "usr/share/zoneinfo/Asia/Khandyga", + "usr/share/zoneinfo/Asia/Kolkata", + "usr/share/zoneinfo/Asia/Krasnoyarsk", + "usr/share/zoneinfo/Asia/Kuala_Lumpur", + "usr/share/zoneinfo/Asia/Kuching", + "usr/share/zoneinfo/Asia/Kuwait", + "usr/share/zoneinfo/Asia/Macao", + "usr/share/zoneinfo/Asia/Macau", + "usr/share/zoneinfo/Asia/Magadan", + "usr/share/zoneinfo/Asia/Makassar", + "usr/share/zoneinfo/Asia/Manila", + "usr/share/zoneinfo/Asia/Muscat", + "usr/share/zoneinfo/Asia/Nicosia", + "usr/share/zoneinfo/Asia/Novokuznetsk", + "usr/share/zoneinfo/Asia/Novosibirsk", + "usr/share/zoneinfo/Asia/Omsk", + "usr/share/zoneinfo/Asia/Oral", + "usr/share/zoneinfo/Asia/Phnom_Penh", + "usr/share/zoneinfo/Asia/Pontianak", + "usr/share/zoneinfo/Asia/Pyongyang", + "usr/share/zoneinfo/Asia/Qatar", + "usr/share/zoneinfo/Asia/Qostanay", + "usr/share/zoneinfo/Asia/Qyzylorda", + "usr/share/zoneinfo/Asia/Rangoon", + "usr/share/zoneinfo/Asia/Riyadh", + "usr/share/zoneinfo/Asia/Saigon", + "usr/share/zoneinfo/Asia/Sakhalin", + "usr/share/zoneinfo/Asia/Samarkand", + "usr/share/zoneinfo/Asia/Seoul", + "usr/share/zoneinfo/Asia/Shanghai", + "usr/share/zoneinfo/Asia/Singapore", + "usr/share/zoneinfo/Asia/Srednekolymsk", + "usr/share/zoneinfo/Asia/Taipei", + "usr/share/zoneinfo/Asia/Tashkent", + "usr/share/zoneinfo/Asia/Tbilisi", + "usr/share/zoneinfo/Asia/Tehran", + "usr/share/zoneinfo/Asia/Tel_Aviv", + "usr/share/zoneinfo/Asia/Thimbu", + "usr/share/zoneinfo/Asia/Thimphu", + "usr/share/zoneinfo/Asia/Tokyo", + "usr/share/zoneinfo/Asia/Tomsk", + "usr/share/zoneinfo/Asia/Ujung_Pandang", + "usr/share/zoneinfo/Asia/Ulaanbaatar", + "usr/share/zoneinfo/Asia/Ulan_Bator", + "usr/share/zoneinfo/Asia/Urumqi", + "usr/share/zoneinfo/Asia/Ust-Nera", + "usr/share/zoneinfo/Asia/Vientiane", + "usr/share/zoneinfo/Asia/Vladivostok", + "usr/share/zoneinfo/Asia/Yakutsk", + "usr/share/zoneinfo/Asia/Yangon", + "usr/share/zoneinfo/Asia/Yekaterinburg", + "usr/share/zoneinfo/Asia/Yerevan", + "usr/share/zoneinfo/Atlantic/Azores", + "usr/share/zoneinfo/Atlantic/Bermuda", + "usr/share/zoneinfo/Atlantic/Canary", + "usr/share/zoneinfo/Atlantic/Cape_Verde", + "usr/share/zoneinfo/Atlantic/Faeroe", + "usr/share/zoneinfo/Atlantic/Faroe", + "usr/share/zoneinfo/Atlantic/Jan_Mayen", + "usr/share/zoneinfo/Atlantic/Madeira", + "usr/share/zoneinfo/Atlantic/Reykjavik", + "usr/share/zoneinfo/Atlantic/South_Georgia", + "usr/share/zoneinfo/Atlantic/St_Helena", + "usr/share/zoneinfo/Atlantic/Stanley", + "usr/share/zoneinfo/Australia/ACT", + "usr/share/zoneinfo/Australia/Adelaide", + "usr/share/zoneinfo/Australia/Brisbane", + "usr/share/zoneinfo/Australia/Broken_Hill", + "usr/share/zoneinfo/Australia/Canberra", + "usr/share/zoneinfo/Australia/Currie", + "usr/share/zoneinfo/Australia/Darwin", + "usr/share/zoneinfo/Australia/Eucla", + "usr/share/zoneinfo/Australia/Hobart", + "usr/share/zoneinfo/Australia/LHI", + "usr/share/zoneinfo/Australia/Lindeman", + "usr/share/zoneinfo/Australia/Lord_Howe", + "usr/share/zoneinfo/Australia/Melbourne", + "usr/share/zoneinfo/Australia/NSW", + "usr/share/zoneinfo/Australia/North", + "usr/share/zoneinfo/Australia/Perth", + "usr/share/zoneinfo/Australia/Queensland", + "usr/share/zoneinfo/Australia/South", + "usr/share/zoneinfo/Australia/Sydney", + "usr/share/zoneinfo/Australia/Tasmania", + "usr/share/zoneinfo/Australia/Victoria", + "usr/share/zoneinfo/Australia/West", + "usr/share/zoneinfo/Australia/Yancowinna", + "usr/share/zoneinfo/Brazil/Acre", + "usr/share/zoneinfo/Brazil/DeNoronha", + "usr/share/zoneinfo/Brazil/East", + "usr/share/zoneinfo/Brazil/West", + "usr/share/zoneinfo/Canada/Atlantic", + "usr/share/zoneinfo/Canada/Central", + "usr/share/zoneinfo/Canada/Eastern", + "usr/share/zoneinfo/Canada/Mountain", + "usr/share/zoneinfo/Canada/Newfoundland", + "usr/share/zoneinfo/Canada/Pacific", + "usr/share/zoneinfo/Canada/Saskatchewan", + "usr/share/zoneinfo/Canada/Yukon", + "usr/share/zoneinfo/Chile/Continental", + "usr/share/zoneinfo/Chile/EasterIsland", + "usr/share/zoneinfo/Etc/GMT", + "usr/share/zoneinfo/Etc/GMT+0", + "usr/share/zoneinfo/Etc/GMT+1", + "usr/share/zoneinfo/Etc/GMT+10", + "usr/share/zoneinfo/Etc/GMT+11", + "usr/share/zoneinfo/Etc/GMT+12", + "usr/share/zoneinfo/Etc/GMT+2", + "usr/share/zoneinfo/Etc/GMT+3", + "usr/share/zoneinfo/Etc/GMT+4", + "usr/share/zoneinfo/Etc/GMT+5", + "usr/share/zoneinfo/Etc/GMT+6", + "usr/share/zoneinfo/Etc/GMT+7", + "usr/share/zoneinfo/Etc/GMT+8", + "usr/share/zoneinfo/Etc/GMT+9", + "usr/share/zoneinfo/Etc/GMT-0", + "usr/share/zoneinfo/Etc/GMT-1", + "usr/share/zoneinfo/Etc/GMT-10", + "usr/share/zoneinfo/Etc/GMT-11", + "usr/share/zoneinfo/Etc/GMT-12", + "usr/share/zoneinfo/Etc/GMT-13", + "usr/share/zoneinfo/Etc/GMT-14", + "usr/share/zoneinfo/Etc/GMT-2", + "usr/share/zoneinfo/Etc/GMT-3", + "usr/share/zoneinfo/Etc/GMT-4", + "usr/share/zoneinfo/Etc/GMT-5", + "usr/share/zoneinfo/Etc/GMT-6", + "usr/share/zoneinfo/Etc/GMT-7", + "usr/share/zoneinfo/Etc/GMT-8", + "usr/share/zoneinfo/Etc/GMT-9", + "usr/share/zoneinfo/Etc/GMT0", + "usr/share/zoneinfo/Etc/Greenwich", + "usr/share/zoneinfo/Etc/UCT", + "usr/share/zoneinfo/Etc/UTC", + "usr/share/zoneinfo/Etc/Universal", + "usr/share/zoneinfo/Etc/Zulu", + "usr/share/zoneinfo/Europe/Amsterdam", + "usr/share/zoneinfo/Europe/Andorra", + "usr/share/zoneinfo/Europe/Astrakhan", + "usr/share/zoneinfo/Europe/Athens", + "usr/share/zoneinfo/Europe/Belfast", + "usr/share/zoneinfo/Europe/Belgrade", + "usr/share/zoneinfo/Europe/Berlin", + "usr/share/zoneinfo/Europe/Bratislava", + "usr/share/zoneinfo/Europe/Brussels", + "usr/share/zoneinfo/Europe/Bucharest", + "usr/share/zoneinfo/Europe/Budapest", + "usr/share/zoneinfo/Europe/Busingen", + "usr/share/zoneinfo/Europe/Chisinau", + "usr/share/zoneinfo/Europe/Copenhagen", + "usr/share/zoneinfo/Europe/Dublin", + "usr/share/zoneinfo/Europe/Gibraltar", + "usr/share/zoneinfo/Europe/Guernsey", + "usr/share/zoneinfo/Europe/Helsinki", + "usr/share/zoneinfo/Europe/Isle_of_Man", + "usr/share/zoneinfo/Europe/Istanbul", + "usr/share/zoneinfo/Europe/Jersey", + "usr/share/zoneinfo/Europe/Kaliningrad", + "usr/share/zoneinfo/Europe/Kiev", + "usr/share/zoneinfo/Europe/Kirov", + "usr/share/zoneinfo/Europe/Kyiv", + "usr/share/zoneinfo/Europe/Lisbon", + "usr/share/zoneinfo/Europe/Ljubljana", + "usr/share/zoneinfo/Europe/London", + "usr/share/zoneinfo/Europe/Luxembourg", + "usr/share/zoneinfo/Europe/Madrid", + "usr/share/zoneinfo/Europe/Malta", + "usr/share/zoneinfo/Europe/Mariehamn", + "usr/share/zoneinfo/Europe/Minsk", + "usr/share/zoneinfo/Europe/Monaco", + "usr/share/zoneinfo/Europe/Moscow", + "usr/share/zoneinfo/Europe/Nicosia", + "usr/share/zoneinfo/Europe/Oslo", + "usr/share/zoneinfo/Europe/Paris", + "usr/share/zoneinfo/Europe/Podgorica", + "usr/share/zoneinfo/Europe/Prague", + "usr/share/zoneinfo/Europe/Riga", + "usr/share/zoneinfo/Europe/Rome", + "usr/share/zoneinfo/Europe/Samara", + "usr/share/zoneinfo/Europe/San_Marino", + "usr/share/zoneinfo/Europe/Sarajevo", + "usr/share/zoneinfo/Europe/Saratov", + "usr/share/zoneinfo/Europe/Simferopol", + "usr/share/zoneinfo/Europe/Skopje", + "usr/share/zoneinfo/Europe/Sofia", + "usr/share/zoneinfo/Europe/Stockholm", + "usr/share/zoneinfo/Europe/Tallinn", + "usr/share/zoneinfo/Europe/Tirane", + "usr/share/zoneinfo/Europe/Tiraspol", + "usr/share/zoneinfo/Europe/Ulyanovsk", + "usr/share/zoneinfo/Europe/Uzhgorod", + "usr/share/zoneinfo/Europe/Vaduz", + "usr/share/zoneinfo/Europe/Vatican", + "usr/share/zoneinfo/Europe/Vienna", + "usr/share/zoneinfo/Europe/Vilnius", + "usr/share/zoneinfo/Europe/Volgograd", + "usr/share/zoneinfo/Europe/Warsaw", + "usr/share/zoneinfo/Europe/Zagreb", + "usr/share/zoneinfo/Europe/Zaporozhye", + "usr/share/zoneinfo/Europe/Zurich", + "usr/share/zoneinfo/Indian/Antananarivo", + "usr/share/zoneinfo/Indian/Chagos", + "usr/share/zoneinfo/Indian/Christmas", + "usr/share/zoneinfo/Indian/Cocos", + "usr/share/zoneinfo/Indian/Comoro", + "usr/share/zoneinfo/Indian/Kerguelen", + "usr/share/zoneinfo/Indian/Mahe", + "usr/share/zoneinfo/Indian/Maldives", + "usr/share/zoneinfo/Indian/Mauritius", + "usr/share/zoneinfo/Indian/Mayotte", + "usr/share/zoneinfo/Indian/Reunion", + "usr/share/zoneinfo/Mexico/BajaNorte", + "usr/share/zoneinfo/Mexico/BajaSur", + "usr/share/zoneinfo/Mexico/General", + "usr/share/zoneinfo/Pacific/Apia", + "usr/share/zoneinfo/Pacific/Auckland", + "usr/share/zoneinfo/Pacific/Bougainville", + "usr/share/zoneinfo/Pacific/Chatham", + "usr/share/zoneinfo/Pacific/Chuuk", + "usr/share/zoneinfo/Pacific/Easter", + "usr/share/zoneinfo/Pacific/Efate", + "usr/share/zoneinfo/Pacific/Enderbury", + "usr/share/zoneinfo/Pacific/Fakaofo", + "usr/share/zoneinfo/Pacific/Fiji", + "usr/share/zoneinfo/Pacific/Funafuti", + "usr/share/zoneinfo/Pacific/Galapagos", + "usr/share/zoneinfo/Pacific/Gambier", + "usr/share/zoneinfo/Pacific/Guadalcanal", + "usr/share/zoneinfo/Pacific/Guam", + "usr/share/zoneinfo/Pacific/Honolulu", + "usr/share/zoneinfo/Pacific/Johnston", + "usr/share/zoneinfo/Pacific/Kanton", + "usr/share/zoneinfo/Pacific/Kiritimati", + "usr/share/zoneinfo/Pacific/Kosrae", + "usr/share/zoneinfo/Pacific/Kwajalein", + "usr/share/zoneinfo/Pacific/Majuro", + "usr/share/zoneinfo/Pacific/Marquesas", + "usr/share/zoneinfo/Pacific/Midway", + "usr/share/zoneinfo/Pacific/Nauru", + "usr/share/zoneinfo/Pacific/Niue", + "usr/share/zoneinfo/Pacific/Norfolk", + "usr/share/zoneinfo/Pacific/Noumea", + "usr/share/zoneinfo/Pacific/Pago_Pago", + "usr/share/zoneinfo/Pacific/Palau", + "usr/share/zoneinfo/Pacific/Pitcairn", + "usr/share/zoneinfo/Pacific/Pohnpei", + "usr/share/zoneinfo/Pacific/Ponape", + "usr/share/zoneinfo/Pacific/Port_Moresby", + "usr/share/zoneinfo/Pacific/Rarotonga", + "usr/share/zoneinfo/Pacific/Saipan", + "usr/share/zoneinfo/Pacific/Samoa", + "usr/share/zoneinfo/Pacific/Tahiti", + "usr/share/zoneinfo/Pacific/Tarawa", + "usr/share/zoneinfo/Pacific/Tongatapu", + "usr/share/zoneinfo/Pacific/Truk", + "usr/share/zoneinfo/Pacific/Wake", + "usr/share/zoneinfo/Pacific/Wallis", + "usr/share/zoneinfo/Pacific/Yap", + "usr/share/zoneinfo/US/Alaska", + "usr/share/zoneinfo/US/Aleutian", + "usr/share/zoneinfo/US/Arizona", + "usr/share/zoneinfo/US/Central", + "usr/share/zoneinfo/US/East-Indiana", + "usr/share/zoneinfo/US/Eastern", + "usr/share/zoneinfo/US/Hawaii", + "usr/share/zoneinfo/US/Indiana-Starke", + "usr/share/zoneinfo/US/Michigan", + "usr/share/zoneinfo/US/Mountain", + "usr/share/zoneinfo/US/Pacific", + "usr/share/zoneinfo/US/Samoa" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "xz-libs@5.8.3-r0", + "Name": "xz-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "1ae658a5f132a091" + }, + "Version": "5.8.3-r0", + "Arch": "x86_64", + "SrcName": "xz", + "SrcVersion": "5.8.3-r0", + "Licenses": [ + "GPL-2.0-or-later", + "0BSD", + "Public-Domain", + "LGPL-2.1-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:4c92c5be0c5bef404e93c880eba9037a9b147347", + "InstalledFiles": [ + "usr/lib/liblzma.so.5", + "usr/lib/liblzma.so.5.8.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "zlib@1.3.2-r0", + "Name": "zlib", + "Identifier": { + "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e37054a2982d6c16" + }, + "Version": "1.3.2-r0", + "Arch": "x86_64", + "SrcName": "zlib", + "SrcVersion": "1.3.2-r0", + "Licenses": [ + "Zlib" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:dd4c3d102acaef2a71a1495951d55fabc8680613", + "InstalledFiles": [ + "usr/lib/libz.so.1", + "usr/lib/libz.so.1.3.2" + ], + "AnalyzedBy": "apk" + } + ], + "Vulnerabilities": [ + { + "VulnerabilityID": "CVE-2026-85091", + "PkgID": "zlib@1.3.2-r0", + "PkgName": "zlib", + "PkgIdentifier": { + "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e37054a2982d6c16" + }, + "InstalledVersion": "1.3.2-r0", + "FixedVersion": "1.3.2-r1", + "Status": "fixed", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", + "DataSource": { + "ID": "alpine", + "Name": "Alpine Secdb", + "URL": "https://secdb.alpinelinux.org/" + }, + "Fingerprint": "sha256:ceeda859a20a0899c3ebfc8ed22f7f9935b25d2fac00d05c203ecc67a4118973", + "Title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", + "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", + "Severity": "MEDIUM", + "CweIDs": [ + "CWE-787" + ], + "VendorSeverity": { + "ubuntu": 2 + }, + "References": [ + "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", + "https://github.com/madler/zlib", + "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", + "https://www.cve.org/CVERecord?id=CVE-2026-85091", + "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" + ], + "PublishedDate": "2026-09-03T13:06:20.573Z", + "LastModifiedDate": "2026-09-09T20:41:07.123Z" + } + ] + }, + { + "Target": "Python", + "Class": "lang-pkgs", + "Type": "python-pkg", + "Packages": [ + { + "Name": "PyJWT", + "Identifier": { + "PURL": "pkg:pypi/pyjwt@2.15.1", + "UID": "d3f5f9a421b8abc9" + }, + "Version": "2.15.1", + "Licenses": [ + "MIT" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/pyjwt-2.15.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "cffi", + "Identifier": { + "PURL": "pkg:pypi/cffi@2.1.1", + "UID": "21042e2f37e33c05" + }, + "Version": "2.1.1", + "Licenses": [ + "MIT-0" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "cryptography", + "Identifier": { + "PURL": "pkg:pypi/cryptography@50.0.1", + "UID": "dcb3df6383fe2a60" + }, + "Version": "50.0.1", + "Licenses": [ + "Apache-2.0 OR BSD-3-Clause" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/cryptography-50.0.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "informed-decision", + "Identifier": { + "PURL": "pkg:pypi/informed-decision@0.2.0", + "UID": "7989f2afae8ff568" + }, + "Version": "0.2.0", + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/informed_decision-0.2.0.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "pycparser", + "Identifier": { + "PURL": "pkg:pypi/pycparser@3.0", + "UID": "e5a4d03f15a695ff" + }, + "Version": "3.0", + "Licenses": [ + "BSD-3-Clause" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/pycparser-3.0.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "waitress", + "Identifier": { + "PURL": "pkg:pypi/waitress@3.0.2", + "UID": "806e218e1c1e85f" + }, + "Version": "3.0.2", + "Licenses": [ + "ZPL-2.1" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/waitress-3.0.2.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + } + ] + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json new file mode 100644 index 0000000..eb0297e --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json @@ -0,0 +1 @@ +{"Id":"sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31","RepoTags":["informed-decision:zlib-r1-local-20261011"],"RepoDigests":["informed-decision@sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31"],"Created":"2026-10-11T09:29:32.511197114+02:00","Config":{"User":"10001:10001","ExposedPorts":{"8080/tcp":{},"8081/tcp":{}},"Env":["PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","LANG=C.UTF-8","GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305","PYTHON_VERSION=3.12.14","PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a","PYTHONDONTWRITEBYTECODE=1","PYTHONUNBUFFERED=1"],"Entrypoint":["informed-decision-container"],"WorkingDir":"/app","Labels":{"org.opencontainers.image.base.digest":"sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a","org.opencontainers.image.revision":"uncommitted-T05-local-preparation","social.coulomb.release.scope":"INFD-WP-0009-T05/zlib-85091-r1","social.coulomb.source.context.sha256":"c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d","social.coulomb.source.policy.sha256":"9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"}},"Architecture":"amd64","Os":"linux","Size":31557919,"RootFS":{"Type":"layers","Layers":["sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c","sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd","sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366","sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe","sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1","sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c","sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59","sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02","sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3","sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007","sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e"]},"Metadata":{"LastTagTime":"2026-10-11T07:29:32.766526483Z"},"Descriptor":{"mediaType":"application/vnd.oci.image.manifest.v1+json","digest":"sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31","size":2752}} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json new file mode 100644 index 0000000..f194470 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json @@ -0,0 +1 @@ +{"uid": 10001, "gid": 10001, "policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", "policy_mode": "0o644", "policy_uid": 0, "app_file_sha256": {"__init__.py": "0ffebe048ba583e7b623f60e8f449950dc5fd49afce2398381fa143eee834e19", "__main__.py": "3ba1467fa2d47fcf0bd032e8694904450775adf763a6e6f9e4888cc3ce3ed92b", "approval_client.py": "56c201dda358cb4bef11a15da141bb68562cdde9e37b4a880bf1e9257ae82cb6", "approval_http.py": "dfaac1faed80a068aa78a8c87b80db99b8887a8fc3767eebc9d6261a98f1e334", "audit.py": "06da36a8f3451b4abc7a46da2df66d5939524c170658b879499b2a47a1b10cd3", "canonicalize.py": "517bbc6b81cc839636b97863ebdefd38aa375d10f4915feb9bf21867f992f765", "container.py": "5f40d2321ee3f52673238011116e741e7b2ac17e28119f100fbcc490db208fbc", "disposition.py": "5ddd19c2444f8e6c9bb090d04045cf1227a34554e000f07b3f677325bf8089f8", "evidence.py": "169ed59ac53ef534a6db835ba371a92177c0ffb000b04203507242e2159ebc21", "http_transport.py": "eda90098f8bf2e5a47d819bf6ae0b0d1dcaf9a87aad3cb61503d060be666339a", "hub_writeback.py": "98b9caa8096c2c3eb8ecfe33900a0ace98453e7608f504fd08a64f50156519a3", "intake.py": "a733b4b608b9ea90b2c8293901aa14388a0bf0d3719f121038bfdcc1faca2038", "intake_approval.py": "52f8b3643e4c5c6f56f2ef1fd9c7747da2165f8f88122e93b3f3ee3ecae48c73", "intake_delivery.py": "4771520cc96325d93bc3f8e08005c3d714a5597582cb1adccc0b0fa73dac0b0d", "intake_hub.py": "c3daddce31791a6e82f7b07406ef4d75bccba5a278fab01dab378a06abceabc8", "intake_service.py": "99ea285a725c58b7571e2a69ceb558f16bbcca4ec391607a0cc2d0459de3b318", "lifecycle.py": "e25f865828e541b2889cd6c9afe0ce7ca4441bf35155304cc7de7c86c44b28e8", "lifecycle_commands.py": "783ec451dd7ef33dc0cfd72c1633ea5208dfd463afeaa0b68d279f156a9b0828", "lifecycle_http.py": "d4b95421d54663f041a10b4f42ac9c013493fa7a770223ab45877b451a7a7c7d", "lifecycle_review.py": "b6d69be6c56f3e2f411501083e199195190df6c740a01b07e82a476268ca3629", "lifecycle_service.py": "2dde9280214e68e5e7a7b48d703886947c2a46139ada86e8ff2283a9d4b55a70", "lifecycle_ui.py": "448e9169607c487e362d4d0d1730aec33987b6dcf12c49dfff7de3aaaab7ae03", "memo.py": "697058863a4e6de2c143a2433eaaf5e15e5e7375dc5459af6911b146567e8b5d", "oidc.py": "6b24dac9537a12141a361c4577feaf42f6c197d8d87da16ca47a08daf6916915", "policy.py": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", "presentation.py": "54375ccd8358fac41de220bccadbee09f8b7c8ebbeeafaafd381a7456331da50", "provenance.py": "de02c6bf162865ba9619d74cfd68dd0a5d7f81e6c9e427f67f848cb2c2214f83", "records.py": "82f696151895c51b168144a3078d05764da3499b96917c465629ce0836fa8e33", "requester.py": "66de1af80a5fb2442c1e4407148b581de24b671b5f76c9d2a0458d38e27833a8", "review.py": "d4a085b0ee3e65a9976b9b656ec87a8c735be8d74cfdc9bb55feeb90917c688e", "runtime.py": "535940eed76c5f21ec4c379796fbfddfd85fc309aad0de4d64afda06cdc2d3c5", "stance.py": "62b96b76eba4ec277344172f10f6233e979dda4d079f972d9a55c4e5aed96c3c", "store.py": "9c14b10becb99da19349073e9aa691c25a205df4a2c4d932f37d64f13e8d3b41", "ui.py": "ff0671dc7be4d08ab8f0d38504f70afd355ad3a8a6293620c75864ca56a53ec9", "web.py": "bd08a6b0ea0e418ea1e31e46edab6b7478de9779b823af4f5d72fd1346197e42", "workload.py": "b86cebf5e7a8182b24bb7f9fdbd6f0e17b578d690d9f06c541e713d7d995c5e8"}, "apk_packages": {".python-rundeps": "20260901.001029", "alpine-baselayout": "3.7.2-r1", "alpine-baselayout-data": "3.7.2-r1", "alpine-keys": "2.6-r0", "alpine-release": "3.24.1-r0", "apk-tools": "3.0.6-r0", "busybox": "1.37.0-r31", "busybox-binsh": "1.37.0-r31", "ca-certificates": "20260611-r0", "ca-certificates-bundle": "20260611-r0", "gdbm": "1.26-r0", "keyutils-libs": "1.6.3-r4", "krb5-conf": "1.0-r2", "krb5-libs": "1.22.2-r1", "libapk": "3.0.6-r0", "libbz2": "1.0.8-r6", "libcom_err": "1.47.4-r0", "libcrypto3": "3.5.8-r0", "libffi": "3.5.2-r1", "libintl": "1.0-r0", "libncursesw": "6.6_p20260516-r0", "libnsl": "2.0.1-r2", "libpanelw": "6.6_p20260516-r0", "libssl3": "3.5.8-r0", "libtirpc": "1.3.5-r1", "libtirpc-conf": "1.3.5-r1", "libuuid": "2.42.3-r1", "libverto": "0.3.2-r2", "musl": "1.2.6-r2", "musl-utils": "1.2.6-r2", "ncurses-terminfo-base": "6.6_p20260516-r0", "readline": "8.3.3-r1", "scanelf": "1.3.9-r1", "sqlite-libs": "3.53.4-r0", "ssl_client": "1.37.0-r31", "tzdata": "2026c-r0", "xz-libs": "5.8.3-r0", "zlib": "1.3.2-r1"}, "apk_world_sha256": "61a659443a49627ba7114faa13a4870a2ede26b314064829ced169412be7002e", "apk_keys_sha256": {"alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub": "9c102bcc376af1498d549b77bdbfa815ae86faa1d2d82f040e616b18ef2df2d4", "alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub": "12f899e55a7691225603d6fb3324940fc51cd7f133e7ead788663c2b7eecb00c", "alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub": "207e4696d3c05f7cb05966aee557307151f1f00217af4143c1bcaf33b8df733f"}, "python_dependencies": {"informed-decision": "0.2.0", "PyJWT": "2.15.1", "cryptography": "50.0.1", "cffi": "2.1.1", "pycparser": "3.0", "waitress": "3.0.2"}, "zlib_runtime_version": "1.3.2", "zlib_compile_version": "1.3.2", "libz_sha256": "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2", "compression_vectors_pass": 4, "malformed_zlib_refusals": 3, "crypto_jwt_waitress_smoke": true, "openssl": "OpenSSL 3.5.8 25 Aug 2026", "network_accessed": false, "database_opened": false, "provider_or_customer_data_used": false} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json new file mode 100644 index 0000000..14db792 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json @@ -0,0 +1,9 @@ +{ + "files": { + ".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a", + "Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15", + "zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + "context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json new file mode 100644 index 0000000..a3da11e --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json @@ -0,0 +1,12 @@ +{ + "zlib-1.3.2-r1.apk": { + "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk", + "sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "bytes": 56210 + }, + "APKINDEX.tar.gz": { + "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz", + "sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5", + "bytes": 528370 + } +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json new file mode 100644 index 0000000..a32a636 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json @@ -0,0 +1,102 @@ +{ + "task_id": "INFD-WP-0009-T05", + "risk_record": "INFD-RISK-20261011-ZLIB-85091", + "state": "local-source-candidate-verified-unpublished-unapproved", + "base_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "candidate_saved_oci_config_digest": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "source_revision": "uncommitted-T05-local-preparation", + "source_context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "build_inputs": { + ".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a", + "Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15", + "zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + "official_downloads": { + "zlib-1.3.2-r1.apk": { + "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk", + "sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "bytes": 56210 + }, + "APKINDEX.tar.gz": { + "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz", + "sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5", + "bytes": 528370 + } + }, + "signature_verification": "Actual apk verify package+index returned OK against keys installed in exact763 base; no allow-untrusted", + "package_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "official_aports_commit": "0afa2da0e8c8051c6f8f64a7a388e5a259904245", + "final_files_changed": [ + "lib/apk/db/installed", + "usr/lib/libz.so.1.3.2" + ], + "base_layers_preserved": 9, + "effective_runtime_configuration_unchanged": true, + "raw_config_serialization_unchanged": false, + "serialization_caveat": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "app_files_unchanged": 36, + "policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", + "installed_purpose_variants_pass": 10, + "purpose_transport_synthetic": true, + "native_provider_test": false, + "compression_vectors_pass": 4, + "malformed_zlib_refusals": 3, + "crypto_jwt_waitress_smoke": true, + "source_negative_tests": 4, + "source_negative_mutations": 8, + "full_sbom_package_count": 44, + "baseline_full_scan_findings": { + "MEDIUM": 1, + "id": "CVE-2026-85091" + }, + "candidate_full_scan_allseverity_findings": 0, + "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 v0.74", + "scanner_db_metadata": { + "Version": 2, + "NextUpdate": "2026-10-11T18:59:50.889010572Z", + "UpdatedAt": "2026-10-10T18:59:50.889010923Z", + "DownloadedAt": "2026-10-10T23:32:32.380033131Z" + }, + "scanner_db_sha256": "03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917", + "scan_caveat": "Alpine3.24 absent EOL list warning; actual OS detector ran38OS+6Python. Zero findings is this DB snapshot, not unknown-future vulnerability assurance or estate risk grade.", + "suppression_or_severity_filter": false, + "evidence_file_sha256": { + "artifact-comparison.json": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa", + "base-runtime.json": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24", + "base-sbom.cdx.json": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50", + "base-trivy-full.json": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6", + "candidate-image-inspect.json": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de", + "candidate-runtime.json": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124", + "context-source.json": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828", + "download-receipt.json": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d", + "official-zlib-index-entry.txt": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a", + "official-zlib-package-info.txt": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a", + "sbom.cdx.json": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb", + "trivy-full.json": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9", + "verify_local_artifacts.py": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa" + }, + "local_saved_image_tar_sha256": "0142526048de5662b4afc1ff7b82b5bf4554642ff811e29f364082e5de9be075", + "local_saved_image_tar_owner_attachment": false, + "build_resource_bound": "legacy builder --network none,256MiB/oneCPU; runtime128MiB/oneCPU; scanner1GiB/oneCPU", + "native_runtime_or_database_or_customer_data_or_credentials_accessed": false, + "native_backup_or_rollout": false, + "owner_source_edits_or_push": false, + "registry_publication_executed": false, + "founder_release_approval": false, + "workflow_yaml_and_bash_syntax": "passed, exact SHA/fixedowner context and admittedexistingregistry capability; CIactualbuild not executed", + "local_refinements_retained": [ + "Initial build --cpus flag unavailable in buildx; switched to explicit existinglegacy builder boundedquota", + "APK preupgrade=false argument refused; corrected no-preupgrade flag", + "Filesystem check found apk.log metadata delta; no-logfile confines finaldiff to twofiles", + "One intermediate local build context accidentally included public scan cache/export artifacts1.529GB; corrected separate4file context and .dockerignore(finaltransfer589.8kB); no secrets/native data involved", + "Read-only cache copy tried inaccessible priorfanal; isolated DB-only copy exactSHA03cacb... used; no ownership/permission loosening" + ] +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt new file mode 100644 index 0000000..5cc6c46 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt @@ -0,0 +1,15 @@ +C:Q1T1JcjMIE+EuLTKQNs744mVjwVsY= +P:zlib +V:1.3.2-r1 +A:x86_64 +S:56210 +I:108376 +T:A compression/decompression Library +U:https://zlib.net/ +L:Zlib +o:zlib +m:Natanael Copa +t:1791318860 +c:0afa2da0e8c8051c6f8f64a7a388e5a259904245 +D:so:libc.musl-x86_64.so.1 +p:so:libz.so.1=1.3.2 diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt new file mode 100644 index 0000000..35e8543 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt @@ -0,0 +1,18 @@ +# Generated by abuild 3.17.0-r0 +# using fakeroot version 1.37.2 +pkgname = zlib +pkgver = 1.3.2-r1 +pkgdesc = A compression/decompression Library +url = https://zlib.net/ +builddate = 1791318860 +packager = Buildozer +size = 108376 +arch = x86_64 +origin = zlib +commit = 0afa2da0e8c8051c6f8f64a7a388e5a259904245 +maintainer = Natanael Copa +license = Zlib +# automatically detected: +provides = so:libz.so.1=1.3.2 +depend = so:libc.musl-x86_64.so.1 +datahash = 9839ce70203b5f89b54614de122f9086f58d09ad01cb95b3ba85049655f47d3b diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json new file mode 100644 index 0000000..3fc6402 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json @@ -0,0 +1,26 @@ +{ + "proposal_id": "INFD-WP-0009-T05/zlib-85091-r1", + "state": "prepared-local-candidate-unpublished-unapproved", + "task_id": "INFD-WP-0009-T05", + "risk_record": "INFD-RISK-20261011-ZLIB-85091", + "candidate_local_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "candidate_registry_digest": null, + "base_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "source_context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "scope": "Only zlib1.3.2-r0\u2192r1 from signedofficialAlpine3.24/x86_64main package; no broaderAlpine/Python/base/app refresh", + "scan": "Actualfull44package sameDB base1MED\u2192candidate0allseverity,no suppressions", + "native_effect": "None prepared/applied; laterpublishedregistryproof and distinct exactfounderDeployment-only release proposal required. Current763 image/schema5/config/policy9d/identity/PVC/credentials/nativec96T04outcome and protectedjournals untouched.", + "next_gates": [ + "Rootsourceapply/review/commit and normaladmittedownerCIcandidatepublication(no borrowedcredential/newgrant)", + "Exact CI/sourceSHA registrydescriptor/layer/config/signature/pkgreadback + actualpublishedfullscan/SBOM/sourcecontext proof", + "Scopednewimagecandidate sourcevalues onlyafteractualdigest, freshmetadata/admission/diff/UID/capacity/sealedconfig/storage checks and exactdistinctinformeddecisionfounderapproval", + "Actualinstalledr1/hash/runtimepurpose/reliability/fullscan verification beforeT05complete; same-schema rollbackto763 preservescurrentDB" + ], + "rollback": "Futureimage-onlyrollbacktoexact763, keepcurrentDB/schema5/config/records; no snapshotrestore/helper/journalrewrite", + "manual_review_due": "2026-10-18", + "automatic_controller": false, + "cost_estimate_EUR": 0, + "cost_caveat": "Existinglocal/CI compute and~0.6MiBpublicsourcecontext, image/scan artifacts andattendedengineering unpriced; no estateincidentloss/autonomygrant", + "maker_only": true, + "human_native_release_approval": false +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json new file mode 100644 index 0000000..c37c6b8 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json @@ -0,0 +1,2517 @@ +{ + "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json", + "bomFormat": "CycloneDX", + "specVersion": "1.7", + "serialNumber": "urn:uuid:d5bad06c-fbb6-43dc-ad11-350bac137879", + "version": 1, + "metadata": { + "timestamp": "2026-10-11T07:31:28+00:00", + "tools": { + "components": [ + { + "type": "application", + "manufacturer": { + "name": "Aqua Security Software Ltd." + }, + "group": "aquasecurity", + "name": "trivy", + "version": "0.74.0" + } + ] + }, + "component": { + "bom-ref": "826fbc25-7bf3-47dc-8757-1977ae81aac7", + "type": "container", + "name": "/artifact/image.tar", + "properties": [ + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "name": "aquasecurity:trivy:ImageID", + "value": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f" + }, + { + "name": "aquasecurity:trivy:Labels:org.opencontainers.image.base.digest", + "value": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a" + }, + { + "name": "aquasecurity:trivy:Labels:org.opencontainers.image.revision", + "value": "uncommitted-T05-local-preparation" + }, + { + "name": "aquasecurity:trivy:Labels:social.coulomb.release.scope", + "value": "INFD-WP-0009-T05/zlib-85091-r1" + }, + { + "name": "aquasecurity:trivy:Labels:social.coulomb.source.context.sha256", + "value": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" + }, + { + "name": "aquasecurity:trivy:Labels:social.coulomb.source.policy.sha256", + "value": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + { + "name": "aquasecurity:trivy:Reference", + "value": "informed-decision:zlib-r1-local-20261011" + }, + { + "name": "aquasecurity:trivy:RepoTag", + "value": "informed-decision:zlib-r1-local-20261011" + }, + { + "name": "aquasecurity:trivy:SchemaVersion", + "value": "2" + }, + { + "name": "aquasecurity:trivy:Size", + "value": "89032192" + } + ] + } + }, + "components": [ + { + "bom-ref": "e38bd52f-08ed-4477-902a-c1cdf68a9c1b", + "type": "operating-system", + "name": "alpine", + "version": "3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:Class", + "value": "os-pkgs" + }, + { + "name": "aquasecurity:trivy:Type", + "value": "alpine" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "type": "library", + "name": ".python-rundeps", + "version": "20260901.001029", + "hashes": [ + { + "alg": "SHA-1", + "content": "51d0c1e7d88a414345799f0309185c625013ef32" + } + ], + "purl": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": ".python-rundeps@20260901.001029" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-baselayout-data", + "version": "3.7.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "c6f9bded17d844b6f1b0bb5766d2c35c0d5c8508" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-baselayout-data@3.7.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-baselayout" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.7.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-baselayout", + "version": "3.7.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "f0fcfdc2f4da058af6473bc45c4eab62916225b2" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-baselayout@3.7.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-baselayout" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.7.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-keys", + "version": "2.6-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "d8d6b80e53c059a77e4915da78ba964f3ffea240" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-keys@2.6-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-keys" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2.6-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-release", + "version": "3.24.1-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "bc6912a25cdc7733e0035ed509eceaa4026946e3" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-release@3.24.1-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-base" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.24.1-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "apk-tools", + "version": "3.0.6-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "043333589798a1f52e09ae63f026c6c8fa676d34" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "apk-tools@3.0.6-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "apk-tools" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.0.6-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Sören Tempel " + }, + "name": "busybox-binsh", + "version": "1.37.0-r31", + "hashes": [ + { + "alg": "SHA-1", + "content": "5cbd14acc6f1804c5bac6c77dc2c492f010b0fc7" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "busybox-binsh@1.37.0-r31" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "busybox" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.37.0-r31" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Sören Tempel " + }, + "name": "busybox", + "version": "1.37.0-r31", + "hashes": [ + { + "alg": "SHA-1", + "content": "b5405ebc02f7dd8be95b6265c54b243d5456ab8f" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "busybox@1.37.0-r31" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "busybox" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.37.0-r31" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "ca-certificates-bundle", + "version": "20260611-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "c9534a03750bdfae341f10969016090fc11febbd" + } + ], + "licenses": [ + { + "license": { + "id": "MPL-2.0" + } + }, + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ca-certificates-bundle@20260611-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ca-certificates" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "20260611-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "ca-certificates", + "version": "20260611-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "8f2a04abeb54b331e2970a0a0dffb7bd6bdde567" + } + ], + "licenses": [ + { + "license": { + "id": "MPL-2.0" + } + }, + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ca-certificates@20260611-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ca-certificates" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "20260611-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "gdbm", + "version": "1.26-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "619493d8124fe49a8ee1d8f7a1372cf7e3977337" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-3.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "gdbm@1.26-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "gdbm" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.26-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "keyutils-libs", + "version": "1.6.3-r4", + "hashes": [ + { + "alg": "SHA-1", + "content": "b7331c96f077fc3522ee4361a441d1097204cd90" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-or-later" + } + }, + { + "license": { + "id": "LGPL-2.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "keyutils-libs@1.6.3-r4" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "keyutils" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.6.3-r4" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "krb5-conf", + "version": "1.0-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "40a11e0690a59e110367b62a80661024e9942a2d" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "krb5-conf@1.0-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "krb5-conf" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.0-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "krb5-libs", + "version": "1.22.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "ef02346e21b817ff379e4601e5b1fc9760e5e31a" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "krb5-libs@1.22.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "krb5" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.22.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libapk", + "version": "3.0.6-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "523a8f58104589f74f743d501c81bf6517155378" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libapk@3.0.6-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "apk-tools" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.0.6-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libbz2", + "version": "1.0.8-r6", + "hashes": [ + { + "alg": "SHA-1", + "content": "08566ba5c7af97c25474be8b24e8b48f0116b67d" + } + ], + "licenses": [ + { + "license": { + "name": "bzip-2-1.0.6" + } + } + ], + "purl": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libbz2@1.0.8-r6" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "bzip2" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.0.8-r6" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libcom_err", + "version": "1.47.4-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "4b9fb5899ea0b1c0cfbb2a2c5952704437d4ecef" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-or-later" + } + }, + { + "license": { + "id": "LGPL-2.0-or-later" + } + }, + { + "license": { + "id": "BSD-3-Clause" + } + }, + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libcom_err@1.47.4-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "e2fsprogs" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.47.4-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libcrypto3", + "version": "3.5.8-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "1b3b9fc0c136f4936932bcb2ec21499f0ae5dfd3" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "purl": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libcrypto3@3.5.8-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "openssl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.5.8-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libffi", + "version": "3.5.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "2f7b261f7fcecc4eebd8b330e7f6fb80713bfe3a" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libffi@3.5.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libffi" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.5.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Carlo Landmeter " + }, + "name": "libintl", + "version": "1.0-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "282d6642ccac87237e43a864159d73cf5abe7550" + } + ], + "licenses": [ + { + "license": { + "id": "LGPL-2.1-or-later" + } + } + ], + "purl": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libintl@1.0-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "gettext" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.0-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Milan P. Stanić " + }, + "name": "libncursesw", + "version": "6.6_p20260516-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "9f318e6e324d6827274829194cf6ac6afbaded12" + } + ], + "licenses": [ + { + "license": { + "name": "X-11" + } + } + ], + "purl": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libncursesw@6.6_p20260516-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ncurses" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "6.6_p20260516-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "name": "libnsl", + "version": "2.0.1-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "5194adbf26560b52be318481a7af294ab05fd795" + } + ], + "licenses": [ + { + "license": { + "id": "LGPL-2.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libnsl@2.0.1-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libnsl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2.0.1-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Milan P. Stanić " + }, + "name": "libpanelw", + "version": "6.6_p20260516-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "149bdc434232ed11fc5bb975ba519a07154a6f56" + } + ], + "licenses": [ + { + "license": { + "name": "X-11" + } + } + ], + "purl": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libpanelw@6.6_p20260516-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ncurses" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "6.6_p20260516-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libssl3", + "version": "3.5.8-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "5f9b1e55d821953d2e2b1db322dad70a3b5041ea" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "purl": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libssl3@3.5.8-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "openssl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.5.8-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libtirpc-conf", + "version": "1.3.5-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "0c17d9988dc986c90e22f79778df047eca9973ff" + } + ], + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libtirpc-conf@1.3.5-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libtirpc" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.5-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libtirpc", + "version": "1.3.5-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "c32865bd86a8b8829d152279cabbc5ac6d430eb2" + } + ], + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libtirpc@1.3.5-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libtirpc" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.5-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libuuid", + "version": "2.42.3-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "8f041ef637ad75f381cc0c034f2afbbb0303264e" + } + ], + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libuuid@2.42.3-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "util-linux" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2.42.3-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Francesco Colista " + }, + "name": "libverto", + "version": "0.3.2-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "73233059338142e4ac6d8fb8bb0074e93da75dc1" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libverto@0.3.2-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libverto" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "0.3.2-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "musl-utils", + "version": "1.2.6-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "75ada3c48d63ec5d87c42fdf934a3fdd11298dc5" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + }, + { + "license": { + "id": "BSD-2-Clause" + } + }, + { + "license": { + "id": "GPL-2.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "musl-utils@1.2.6-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "musl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.2.6-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "musl", + "version": "1.2.6-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "0f7e5827e4e1a73631beda27b78431a8ba240e05" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "musl@1.2.6-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "musl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.2.6-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Milan P. Stanić " + }, + "name": "ncurses-terminfo-base", + "version": "6.6_p20260516-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "9d551d828e9c8ee52c5801c1d6046828ebf15752" + } + ], + "licenses": [ + { + "license": { + "name": "X-11" + } + } + ], + "purl": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ncurses-terminfo-base@6.6_p20260516-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ncurses" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "6.6_p20260516-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "qaqland " + }, + "name": "readline", + "version": "8.3.3-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "945b16e378bc00e44d89d4de8124bba7647fdf4d" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-3.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "readline@8.3.3-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "readline" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "8.3.3-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "scanelf", + "version": "1.3.9-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "013f903d0ba219673aebbdd04f74bb5ed82b01f0" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "scanelf@1.3.9-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "pax-utils" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.9-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Jingyun Hua " + }, + "name": "sqlite-libs", + "version": "3.53.4-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "f7630ceb37c232b6609861aeab6cdb9cd120e6fa" + } + ], + "licenses": [ + { + "license": { + "id": "blessing" + } + } + ], + "purl": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "sqlite-libs@3.53.4-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "sqlite" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.53.4-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Sören Tempel " + }, + "name": "ssl_client", + "version": "1.37.0-r31", + "hashes": [ + { + "alg": "SHA-1", + "content": "c220f4a5125a313af733e98def94132bb1e9d40d" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ssl_client@1.37.0-r31" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "busybox" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.37.0-r31" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "tzdata", + "version": "2026c-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "61f7544ecd8dd63eac23fe3e645702fda92ef02a" + } + ], + "licenses": [ + { + "license": { + "name": "Public-Domain" + } + } + ], + "purl": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "tzdata@2026c-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "tzdata" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2026c-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "xz-libs", + "version": "5.8.3-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "4c92c5be0c5bef404e93c880eba9037a9b147347" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-or-later" + } + }, + { + "license": { + "id": "0BSD" + } + }, + { + "license": { + "name": "Public-Domain" + } + }, + { + "license": { + "id": "LGPL-2.1-or-later" + } + } + ], + "purl": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "xz-libs@5.8.3-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "xz" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "5.8.3-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "zlib", + "version": "1.3.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "4f525c8cc204f84b8b4ca40db3be389958f056c6" + } + ], + "licenses": [ + { + "license": { + "id": "Zlib" + } + } + ], + "purl": "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:645872f9a17cb984e868cc31e749d9db7227a520a47e5d39cc5836f98eb2f731" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "zlib@1.3.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "zlib" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.2-r1" + } + ] + }, + { + "bom-ref": "pkg:pypi/cffi@2.1.1", + "type": "library", + "name": "cffi", + "version": "2.1.1", + "licenses": [ + { + "license": { + "id": "MIT-0" + } + } + ], + "purl": "pkg:pypi/cffi@2.1.1", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/cryptography@50.0.1", + "type": "library", + "name": "cryptography", + "version": "50.0.1", + "licenses": [ + { + "expression": "Apache-2.0 OR BSD-3-Clause" + } + ], + "purl": "pkg:pypi/cryptography@50.0.1", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/cryptography-50.0.1.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/informed-decision@0.2.0", + "type": "library", + "name": "informed-decision", + "version": "0.2.0", + "purl": "pkg:pypi/informed-decision@0.2.0", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/informed_decision-0.2.0.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/pycparser@3.0", + "type": "library", + "name": "pycparser", + "version": "3.0", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:pypi/pycparser@3.0", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/pycparser-3.0.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/pyjwt@2.15.1", + "type": "library", + "name": "PyJWT", + "version": "2.15.1", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:pypi/pyjwt@2.15.1", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/pyjwt-2.15.1.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/waitress@3.0.2", + "type": "library", + "name": "waitress", + "version": "3.0.2", + "licenses": [ + { + "license": { + "id": "ZPL-2.1" + } + } + ], + "purl": "pkg:pypi/waitress@3.0.2", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/waitress-3.0.2.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + } + ], + "dependencies": [ + { + "ref": "826fbc25-7bf3-47dc-8757-1977ae81aac7", + "dependsOn": [ + "e38bd52f-08ed-4477-902a-c1cdf68a9c1b", + "pkg:pypi/cffi@2.1.1", + "pkg:pypi/cryptography@50.0.1", + "pkg:pypi/informed-decision@0.2.0", + "pkg:pypi/pycparser@3.0", + "pkg:pypi/pyjwt@2.15.1", + "pkg:pypi/waitress@3.0.2" + ] + }, + { + "ref": "e38bd52f-08ed-4477-902a-c1cdf68a9c1b", + "dependsOn": [ + "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:pypi/cffi@2.1.1", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/cryptography@50.0.1", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/informed-decision@0.2.0", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/pycparser@3.0", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/pyjwt@2.15.1", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/waitress@3.0.2", + "dependsOn": [] + } + ], + "vulnerabilities": [] +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json new file mode 100644 index 0000000..2206ce4 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json @@ -0,0 +1,2394 @@ +{ + "SchemaVersion": 2, + "Trivy": { + "Version": "0.74.0" + }, + "ReportID": "01a129df-705c-7447-93b1-af5b8eaa125c", + "CreatedAt": "2026-10-11T07:31:11.580284541Z", + "ArtifactID": "sha256:b504e33e63ad77e2e103c2924d2f16f73d279b0a1ddd6affac01422524b96eb3", + "ArtifactName": "/artifact/image.tar", + "ArtifactType": "container_image", + "Metadata": { + "Size": 89032192, + "OS": { + "Family": "alpine", + "Name": "3.24.1" + }, + "ImageID": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "DiffIDs": [ + "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c", + "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd", + "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366", + "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe", + "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1", + "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c", + "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59", + "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02", + "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3", + "sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007", + "sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e" + ], + "RepoTags": [ + "informed-decision:zlib-r1-local-20261011" + ], + "Reference": "informed-decision:zlib-r1-local-20261011", + "ImageConfig": { + "architecture": "amd64", + "created": "2026-10-11T09:29:32.511197114+02:00", + "history": [ + { + "created": "2026-06-16T00:01:29.967161902Z", + "created_by": "ADD alpine-minirootfs-3.24.1-x86_64.tar.gz / # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-06-16T00:01:29.967161902Z", + "created_by": "CMD [\"/bin/sh\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV LANG=C.UTF-8", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "RUN /bin/sh -c set -eux; \tapk add --no-cache \t\tca-certificates \t\ttzdata \t; # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PYTHON_VERSION=3.12.14", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:10:30.672225972Z", + "created_by": "RUN /bin/sh -c set -eux; \t\tapk add --no-cache --virtual .build-deps \t\tbluez-dev \t\tbzip2-dev \t\tdpkg-dev dpkg \t\tfindutils \t\tg++ \t\tgcc \t\tgdbm-dev \t\tgnupg \t\tlibc-dev \t\tlibffi-dev \t\tlibnsl-dev \t\tlibtirpc-dev \t\tlinux-headers \t\tmake \t\tncurses-dev \t\topenssl-dev \t\tpax-utils \t\treadline-dev \t\tsqlite-dev \t\ttar \t\ttcl-dev \t\ttk \t\ttk-dev \t\tutil-linux-dev \t\txz \t\txz-dev \t\tzlib-dev \t; \t\twget -O python.tar.xz \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz\"; \techo \"$PYTHON_SHA256 *python.tar.xz\" | sha256sum -c -; \twget -O python.tar.xz.asc \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc\"; \tGNUPGHOME=\"$(mktemp -d)\"; export GNUPGHOME; \tgpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$GPG_KEY\"; \tgpg --batch --verify python.tar.xz.asc python.tar.xz; \tgpgconf --kill all; \trm -rf \"$GNUPGHOME\" python.tar.xz.asc; \tmkdir -p /usr/src/python; \ttar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; \trm python.tar.xz; \t\tcd /usr/src/python; \tgnuArch=\"$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)\"; \t./configure \t\t--build=\"$gnuArch\" \t\t--enable-loadable-sqlite-extensions \t\t--enable-option-checking=fatal \t\t--enable-shared \t\t$(test \"${gnuArch%%-*}\" != 'riscv64' \u0026\u0026 echo '--with-lto') \t\t--with-ensurepip \t; \tnproc=\"$(nproc)\"; \tEXTRA_CFLAGS=\"-DTHREAD_STACK_SIZE=0x100000\"; \tLDFLAGS=\"${LDFLAGS:-} -Wl,--strip-all\"; \tarch=\"$(apk --print-arch)\"; \tcase \"$arch\" in \t\tx86_64|aarch64) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer\"; \t\t\t;; \t\tx86) \t\t\t;; \t\t*) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer\"; \t\t\t;; \tesac; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-}\" \t; \trm python; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\\$\\$ORIGIN/../lib'\" \t\tpython \t; \tmake install; \t\tcd /; \trm -rf /usr/src/python; \t\tfind /usr/local -depth \t\t\\( \t\t\t\\( -type d -a \\( -name test -o -name tests -o -name idle_test \\) \\) \t\t\t-o \\( -type f -a \\( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \\) \\) \t\t\\) -exec rm -rf '{}' + \t; \t\tfind /usr/local -type f -executable -not \\( -name '*tkinter*' \\) -exec scanelf --needed --nobanner --format '%n#p' '{}' ';' \t\t| tr ',' '\\n' \t\t| sort -u \t\t| awk 'system(\"[ -e /usr/local/lib/\" $1 \" ]\") == 0 { next } { print \"so:\" $1 }' \t\t| xargs -rt apk add --no-network --virtual .python-rundeps \t; \tapk del --no-network .build-deps; \t\texport PYTHONDONTWRITEBYTECODE=1; \tpython3 --version; \tpip3 --version # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:10:30.782726003Z", + "created_by": "RUN /bin/sh -c set -eux; \tfor src in idle3 pip3 pydoc3 python3 python3-config; do \t\tdst=\"$(echo \"$src\" | tr -d 3)\"; \t\t[ -s \"/usr/local/bin/$src\" ]; \t\t[ ! -e \"/usr/local/bin/$dst\" ]; \t\tln -svT \"$src\" \"/usr/local/bin/$dst\"; \tdone # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:10:30.782726003Z", + "created_by": "CMD [\"python3\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-11T00:49:47.962156876+02:00", + "created_by": "ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-11T00:49:47.962156876+02:00", + "created_by": "RUN /bin/sh -c apk add --no-cache 'libuuid\u003e=2.42.3-r1' \u0026\u0026 addgroup -S -g 10001 informed \u0026\u0026 adduser -S -u 10001 -G informed -H informed # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:55.351944978+02:00", + "created_by": "COPY /opt/venv /opt/venv # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.462092072+02:00", + "created_by": "RUN /bin/sh -c rm -rf /usr/local/bin/pip* /usr/local/lib/python3.12/site-packages/pip* /usr/local/lib/python3.12/site-packages/setuptools* /usr/local/lib/python3.12/site-packages/pkg_resources /opt/venv/bin/pip* /opt/venv/lib/python3.12/site-packages/pip* /opt/venv/lib/python3.12/site-packages/setuptools* /opt/venv/lib/python3.12/site-packages/pkg_resources # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "WORKDIR /app", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "USER 10001:10001", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "EXPOSE [8080/tcp 8081/tcp]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "ENTRYPOINT [\"informed-decision-container\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-11T01:15:11.991443676Z", + "created_by": "/bin/sh -c #(nop) ARG SOURCE_REVISION", + "empty_layer": true + }, + { + "created": "2026-10-11T01:21:04.716126392Z", + "created_by": "/bin/sh -c #(nop) LABEL org.opencontainers.image.revision=3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168 org.opencontainers.image.base.digest=sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173 social.coulomb.source.policy.sha256=9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62 social.coulomb.release.scope=INFD-WP-0009-T04/purpose-overlay-v1", + "empty_layer": true + }, + { + "created": "2026-10-11T01:21:04.787527697Z", + "created_by": "/bin/sh -c #(nop) COPY file:2be9cb36e7253e15733673359cda8caa22986b6888822a008c1b360d909994e0 in /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py " + }, + { + "created": "2026-10-11T09:23:35.324082353+02:00", + "created_by": "/bin/sh -c #(nop) ARG SOURCE_REVISION=uncommitted-T05-local-preparation", + "empty_layer": true + }, + { + "created": "2026-10-11T09:23:36.10318027+02:00", + "created_by": "/bin/sh -c #(nop) ARG SOURCE_CONTEXT_SHA256", + "empty_layer": true + }, + { + "created": "2026-10-11T09:23:36.876646839+02:00", + "created_by": "/bin/sh -c #(nop) USER 0:0", + "empty_layer": true + }, + { + "created": "2026-10-11T07:23:37.652390037Z", + "created_by": "/bin/sh -c #(nop) COPY multi:e4d183fdf93ea6320911bb7398e4860a1b9b96fe0768cfd3d0260955517dd272 in /tmp/infd-zlib/x86_64/ " + }, + { + "created": "2026-10-11T09:29:30.865525337+02:00", + "created_by": "|2 SOURCE_CONTEXT_SHA256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d SOURCE_REVISION=uncommitted-T05-local-preparation /bin/sh -c echo '63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk' | sha256sum -c - \u0026\u0026 echo '24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 /tmp/infd-zlib/x86_64/APKINDEX.tar.gz' | sha256sum -c - \u0026\u0026 apk verify /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk /tmp/infd-zlib/x86_64/APKINDEX.tar.gz \u0026\u0026 apk upgrade --no-logfile --no-network --no-cache --no-preupgrade --repositories-file /dev/null --repository /tmp/infd-zlib zlib \u0026\u0026 apk info --exists 'zlib=1.3.2-r1' \u0026\u0026 rm -rf /tmp/infd-zlib" + }, + { + "created": "2026-10-11T09:29:31.735346534+02:00", + "created_by": "/bin/sh -c #(nop) USER 10001:10001", + "empty_layer": true + }, + { + "created": "2026-10-11T09:29:32.511197114+02:00", + "created_by": "/bin/sh -c #(nop) LABEL org.opencontainers.image.revision=uncommitted-T05-local-preparation org.opencontainers.image.base.digest=sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a social.coulomb.source.context.sha256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d social.coulomb.source.policy.sha256=9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62 social.coulomb.release.scope=INFD-WP-0009-T05/zlib-85091-r1", + "empty_layer": true + } + ], + "os": "linux", + "rootfs": { + "type": "layers", + "diff_ids": [ + "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c", + "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd", + "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366", + "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe", + "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1", + "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c", + "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59", + "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02", + "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3", + "sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007", + "sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e" + ] + }, + "config": { + "Entrypoint": [ + "informed-decision-container" + ], + "Env": [ + "PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "LANG=C.UTF-8", + "GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", + "PYTHON_VERSION=3.12.14", + "PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a", + "PYTHONDONTWRITEBYTECODE=1", + "PYTHONUNBUFFERED=1" + ], + "Labels": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "User": "10001:10001", + "WorkingDir": "/app", + "ExposedPorts": { + "8080/tcp": {}, + "8081/tcp": {} + } + } + }, + "Layers": [ + { + "Size": 8697856, + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "Size": 1538048, + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "Size": 47150592, + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "Size": 5120, + "Digest": "sha256:ed62c91ccd94e36a928e96d704cfcf20861302590245cc12aa89a15a5d6be29b", + "DiffID": "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe" + }, + { + "Size": 131584, + "Digest": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86", + "DiffID": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "Size": 30705664, + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "Size": 12288, + "Digest": "sha256:16a3dba6b720d3059eab918cd3596f94145ac9cf4d456f925a21f0f72522863f", + "DiffID": "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59" + }, + { + "Size": 1536, + "Digest": "sha256:e73dd464fbff5607cc62a1b2b66b0eefe737dfad4db8e7b58a48cda7c12d94d3", + "DiffID": "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02" + }, + { + "Size": 15360, + "Digest": "sha256:cfee29c2f8119d2a39714ecbe5095a2dc1c986054f2e1fe0a6565163242417e3", + "DiffID": "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + }, + { + "Size": 588288, + "Digest": "sha256:aa48f13a5258c67abfc00447e2ca2490ee838e166e83bfe7a8b7bb2bf2ee2466", + "DiffID": "sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007" + }, + { + "Size": 185856, + "Digest": "sha256:645872f9a17cb984e868cc31e749d9db7227a520a47e5d39cc5836f98eb2f731", + "DiffID": "sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e" + } + ] + }, + "Results": [ + { + "Target": "/artifact/image.tar (alpine 3.24.1)", + "Class": "os-pkgs", + "Type": "alpine", + "Packages": [ + { + "ID": ".python-rundeps@20260901.001029", + "Name": ".python-rundeps", + "Identifier": { + "PURL": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch\u0026distro=3.24.1", + "UID": "62fa84f88695c077" + }, + "Version": "20260901.001029", + "Arch": "noarch", + "DependsOn": [ + "gdbm@1.26-r0", + "libbz2@1.0.8-r6", + "libcrypto3@3.5.8-r0", + "libffi@3.5.2-r1", + "libncursesw@6.6_p20260516-r0", + "libnsl@2.0.1-r2", + "libpanelw@6.6_p20260516-r0", + "libssl3@3.5.8-r0", + "libtirpc@1.3.5-r1", + "libuuid@2.42.3-r1", + "musl@1.2.6-r2", + "readline@8.3.3-r1", + "sqlite-libs@3.53.4-r0", + "xz-libs@5.8.3-r0", + "zlib@1.3.2-r1" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:51d0c1e7d88a414345799f0309185c625013ef32", + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-baselayout@3.7.2-r1", + "Name": "alpine-baselayout", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "1b9c543300f8073e" + }, + "Version": "3.7.2-r1", + "Arch": "x86_64", + "SrcName": "alpine-baselayout", + "SrcVersion": "3.7.2-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "alpine-baselayout-data@3.7.2-r1", + "busybox-binsh@1.37.0-r31" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:f0fcfdc2f4da058af6473bc45c4eab62916225b2", + "InstalledFiles": [ + "etc/motd", + "etc/crontabs/root", + "etc/modprobe.d/aliases.conf", + "etc/modprobe.d/blacklist.conf", + "etc/modprobe.d/i386.conf", + "etc/profile.d/20locale.sh", + "etc/profile.d/README", + "etc/profile.d/color_prompt.sh.disabled", + "usr/lib/sysctl.d/00-alpine.conf", + "var/lock", + "var/run", + "var/spool/mail", + "var/spool/cron/crontabs" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-baselayout-data@3.7.2-r1", + "Name": "alpine-baselayout-data", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "fcc3cd90122d8aa7" + }, + "Version": "3.7.2-r1", + "Arch": "x86_64", + "SrcName": "alpine-baselayout", + "SrcVersion": "3.7.2-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c6f9bded17d844b6f1b0bb5766d2c35c0d5c8508", + "InstalledFiles": [ + "etc/fstab", + "etc/group", + "etc/hostname", + "etc/hosts", + "etc/inittab", + "etc/modules", + "etc/mtab", + "etc/nsswitch.conf", + "etc/passwd", + "etc/profile", + "etc/protocols", + "etc/services", + "etc/shadow", + "etc/shells", + "etc/sysctl.conf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-keys@2.6-r0", + "Name": "alpine-keys", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "cb1f6c8fa74713e0" + }, + "Version": "2.6-r0", + "Arch": "x86_64", + "SrcName": "alpine-keys", + "SrcVersion": "2.6-r0", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:d8d6b80e53c059a77e4915da78ba964f3ffea240", + "InstalledFiles": [ + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", + "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", + "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", + "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", + "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", + "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", + "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", + "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", + "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", + "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", + "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", + "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", + "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-release@3.24.1-r0", + "Name": "alpine-release", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "6cfad6f36e1f31aa" + }, + "Version": "3.24.1-r0", + "Arch": "x86_64", + "SrcName": "alpine-base", + "SrcVersion": "3.24.1-r0", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "alpine-keys@2.6-r0" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:bc6912a25cdc7733e0035ed509eceaa4026946e3", + "InstalledFiles": [ + "etc/alpine-release", + "etc/issue", + "etc/os-release", + "etc/secfixes.d/alpine", + "usr/lib/os-release" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "apk-tools@3.0.6-r0", + "Name": "apk-tools", + "Identifier": { + "PURL": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "b37730591f24ae44" + }, + "Version": "3.0.6-r0", + "Arch": "x86_64", + "SrcName": "apk-tools", + "SrcVersion": "3.0.6-r0", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "ca-certificates-bundle@20260611-r0", + "libapk@3.0.6-r0", + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2", + "zlib@1.3.2-r1" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:043333589798a1f52e09ae63f026c6c8fa676d34", + "InstalledFiles": [ + "sbin/apk" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "busybox@1.37.0-r31", + "Name": "busybox", + "Identifier": { + "PURL": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "771020c43c8440bf" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:b5405ebc02f7dd8be95b6265c54b243d5456ab8f", + "InstalledFiles": [ + "bin/busybox", + "etc/securetty", + "etc/busybox-paths.d/busybox", + "etc/logrotate.d/acpid", + "etc/network/if-up.d/dad", + "etc/udhcpc/udhcpc.conf", + "usr/share/udhcpc/default.script" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "busybox-binsh@1.37.0-r31", + "Name": "busybox-binsh", + "Identifier": { + "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "1ec8a3d5d2b63297" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "busybox@1.37.0-r31" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:5cbd14acc6f1804c5bac6c77dc2c492f010b0fc7", + "InstalledFiles": [ + "bin/sh" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ca-certificates@20260611-r0", + "Name": "ca-certificates", + "Identifier": { + "PURL": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "2a3c316ee83c6198" + }, + "Version": "20260611-r0", + "Arch": "x86_64", + "SrcName": "ca-certificates", + "SrcVersion": "20260611-r0", + "Licenses": [ + "MPL-2.0", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "busybox-binsh@1.37.0-r31", + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + "Digest": "sha1:8f2a04abeb54b331e2970a0a0dffb7bd6bdde567", + "InstalledFiles": [ + "etc/ca-certificates.conf", + "etc/apk/protected_paths.d/ca-certificates.list", + "etc/ca-certificates/update.d/certhash", + "usr/bin/c_rehash", + "usr/sbin/update-ca-certificates", + "usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", + "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", + "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", + "usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", + "usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", + "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", + "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", + "usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", + "usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", + "usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", + "usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", + "usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", + "usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", + "usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", + "usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", + "usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", + "usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", + "usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", + "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", + "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", + "usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", + "usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", + "usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", + "usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", + "usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/Izenpe.com.crt", + "usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", + "usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", + "usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", + "usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", + "usr/share/ca-certificates/mozilla/OISTE_Server_Root_ECC_G1.crt", + "usr/share/ca-certificates/mozilla/OISTE_Server_Root_RSA_G1.crt", + "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", + "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", + "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", + "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", + "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", + "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", + "usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", + "usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", + "usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", + "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", + "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", + "usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", + "usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", + "usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", + "usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", + "usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt", + "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", + "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", + "usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", + "usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", + "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", + "usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", + "usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", + "usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", + "usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", + "usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", + "usr/share/ca-certificates/mozilla/e-Szigno_TLS_Root_CA_2023.crt", + "usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", + "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", + "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", + "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", + "usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", + "usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ca-certificates-bundle@20260611-r0", + "Name": "ca-certificates-bundle", + "Identifier": { + "PURL": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "20337c2ea28bef28" + }, + "Version": "20260611-r0", + "Arch": "x86_64", + "SrcName": "ca-certificates", + "SrcVersion": "20260611-r0", + "Licenses": [ + "MPL-2.0", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c9534a03750bdfae341f10969016090fc11febbd", + "InstalledFiles": [ + "etc/ssl/cert.pem", + "etc/ssl/certs/ca-certificates.crt", + "etc/ssl1.1/cert.pem", + "etc/ssl1.1/certs" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "gdbm@1.26-r0", + "Name": "gdbm", + "Identifier": { + "PURL": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "5eb1a3f86262ca77" + }, + "Version": "1.26-r0", + "Arch": "x86_64", + "SrcName": "gdbm", + "SrcVersion": "1.26-r0", + "Licenses": [ + "GPL-3.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:619493d8124fe49a8ee1d8f7a1372cf7e3977337", + "InstalledFiles": [ + "usr/lib/libgdbm.so.6", + "usr/lib/libgdbm.so.6.0.0", + "usr/lib/libgdbm_compat.so.4", + "usr/lib/libgdbm_compat.so.4.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "keyutils-libs@1.6.3-r4", + "Name": "keyutils-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64\u0026distro=3.24.1", + "UID": "a1a29120eb342032" + }, + "Version": "1.6.3-r4", + "Arch": "x86_64", + "SrcName": "keyutils", + "SrcVersion": "1.6.3-r4", + "Licenses": [ + "GPL-2.0-or-later", + "LGPL-2.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:b7331c96f077fc3522ee4361a441d1097204cd90", + "InstalledFiles": [ + "usr/lib/libkeyutils.so.1", + "usr/lib/libkeyutils.so.1.10" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "krb5-conf@1.0-r2", + "Name": "krb5-conf", + "Identifier": { + "PURL": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "e7cf94ba8b6dbc33" + }, + "Version": "1.0-r2", + "Arch": "x86_64", + "SrcName": "krb5-conf", + "SrcVersion": "1.0-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:40a11e0690a59e110367b62a80661024e9942a2d", + "InstalledFiles": [ + "etc/krb5.conf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "krb5-libs@1.22.2-r1", + "Name": "krb5-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "958f8b4a4f087dac" + }, + "Version": "1.22.2-r1", + "Arch": "x86_64", + "SrcName": "krb5", + "SrcVersion": "1.22.2-r1", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "keyutils-libs@1.6.3-r4", + "krb5-conf@1.0-r2", + "libcom_err@1.47.4-r0", + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "libverto@0.3.2-r2", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:ef02346e21b817ff379e4601e5b1fc9760e5e31a", + "InstalledFiles": [ + "usr/lib/libgssapi_krb5.so.2", + "usr/lib/libgssapi_krb5.so.2.2", + "usr/lib/libgssrpc.so.4", + "usr/lib/libgssrpc.so.4.2", + "usr/lib/libk5crypto.so.3", + "usr/lib/libk5crypto.so.3.1", + "usr/lib/libkadm5clnt_mit.so.12", + "usr/lib/libkadm5clnt_mit.so.12.0", + "usr/lib/libkadm5srv_mit.so.12", + "usr/lib/libkadm5srv_mit.so.12.0", + "usr/lib/libkdb5.so.10", + "usr/lib/libkdb5.so.10.0", + "usr/lib/libkrad.so.0", + "usr/lib/libkrad.so.0.0", + "usr/lib/libkrb5.so.3", + "usr/lib/libkrb5.so.3.3", + "usr/lib/libkrb5support.so.0", + "usr/lib/libkrb5support.so.0.1", + "usr/lib/krb5/plugins/kdb/db2.so", + "usr/lib/krb5/plugins/preauth/otp.so", + "usr/lib/krb5/plugins/preauth/spake.so", + "usr/lib/krb5/plugins/preauth/test.so", + "usr/lib/krb5/plugins/tls/k5tls.so" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libapk@3.0.6-r0", + "Name": "libapk", + "Identifier": { + "PURL": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "779641db16cf6477" + }, + "Version": "3.0.6-r0", + "Arch": "x86_64", + "SrcName": "apk-tools", + "SrcVersion": "3.0.6-r0", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "musl@1.2.6-r2", + "zlib@1.3.2-r1" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:523a8f58104589f74f743d501c81bf6517155378", + "InstalledFiles": [ + "usr/lib/libapk.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libbz2@1.0.8-r6", + "Name": "libbz2", + "Identifier": { + "PURL": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64\u0026distro=3.24.1", + "UID": "48e17539404e2d56" + }, + "Version": "1.0.8-r6", + "Arch": "x86_64", + "SrcName": "bzip2", + "SrcVersion": "1.0.8-r6", + "Licenses": [ + "bzip-2-1.0.6" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:08566ba5c7af97c25474be8b24e8b48f0116b67d", + "InstalledFiles": [ + "usr/lib/libbz2.so.1", + "usr/lib/libbz2.so.1.0.8" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libcom_err@1.47.4-r0", + "Name": "libcom_err", + "Identifier": { + "PURL": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "3fc35a3f66d192af" + }, + "Version": "1.47.4-r0", + "Arch": "x86_64", + "SrcName": "e2fsprogs", + "SrcVersion": "1.47.4-r0", + "Licenses": [ + "GPL-2.0-or-later", + "LGPL-2.0-or-later", + "BSD-3-Clause", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:4b9fb5899ea0b1c0cfbb2a2c5952704437d4ecef", + "InstalledFiles": [ + "usr/lib/libcom_err.so.2", + "usr/lib/libcom_err.so.2.1" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libcrypto3@3.5.8-r0", + "Name": "libcrypto3", + "Identifier": { + "PURL": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "4299bba2ba9c96aa" + }, + "Version": "3.5.8-r0", + "Arch": "x86_64", + "SrcName": "openssl", + "SrcVersion": "3.5.8-r0", + "Licenses": [ + "Apache-2.0" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:1b3b9fc0c136f4936932bcb2ec21499f0ae5dfd3", + "InstalledFiles": [ + "etc/ssl/ct_log_list.cnf", + "etc/ssl/ct_log_list.cnf.dist", + "etc/ssl/openssl.cnf", + "etc/ssl/openssl.cnf.dist", + "usr/lib/libcrypto.so.3", + "usr/lib/engines-3/afalg.so", + "usr/lib/engines-3/capi.so", + "usr/lib/engines-3/loader_attic.so", + "usr/lib/engines-3/padlock.so", + "usr/lib/ossl-modules/legacy.so" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libffi@3.5.2-r1", + "Name": "libffi", + "Identifier": { + "PURL": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "d3eaa921287b1ccd" + }, + "Version": "3.5.2-r1", + "Arch": "x86_64", + "SrcName": "libffi", + "SrcVersion": "3.5.2-r1", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:2f7b261f7fcecc4eebd8b330e7f6fb80713bfe3a", + "InstalledFiles": [ + "usr/lib/libffi.so.8", + "usr/lib/libffi.so.8.2.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libintl@1.0-r0", + "Name": "libintl", + "Identifier": { + "PURL": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "25c18808d8fc87e0" + }, + "Version": "1.0-r0", + "Arch": "x86_64", + "SrcName": "gettext", + "SrcVersion": "1.0-r0", + "Licenses": [ + "LGPL-2.1-or-later" + ], + "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:282d6642ccac87237e43a864159d73cf5abe7550", + "InstalledFiles": [ + "usr/lib/libintl.so.8", + "usr/lib/libintl.so.8.4.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libncursesw@6.6_p20260516-r0", + "Name": "libncursesw", + "Identifier": { + "PURL": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e8939f45e2191bcc" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "DependsOn": [ + "musl@1.2.6-r2", + "ncurses-terminfo-base@6.6_p20260516-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:9f318e6e324d6827274829194cf6ac6afbaded12", + "InstalledFiles": [ + "usr/lib/libncursesw.so.6", + "usr/lib/libncursesw.so.6.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libnsl@2.0.1-r2", + "Name": "libnsl", + "Identifier": { + "PURL": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "3d893c60d41da67b" + }, + "Version": "2.0.1-r2", + "Arch": "x86_64", + "SrcName": "libnsl", + "SrcVersion": "2.0.1-r2", + "Licenses": [ + "LGPL-2.0-or-later" + ], + "DependsOn": [ + "libintl@1.0-r0", + "libtirpc@1.3.5-r1", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:5194adbf26560b52be318481a7af294ab05fd795", + "InstalledFiles": [ + "usr/lib/libnsl.so.3", + "usr/lib/libnsl.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libpanelw@6.6_p20260516-r0", + "Name": "libpanelw", + "Identifier": { + "PURL": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "ef1ad9bb256b373" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "DependsOn": [ + "libncursesw@6.6_p20260516-r0", + "musl@1.2.6-r2", + "ncurses-terminfo-base@6.6_p20260516-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:149bdc434232ed11fc5bb975ba519a07154a6f56", + "InstalledFiles": [ + "usr/lib/libpanelw.so.6", + "usr/lib/libpanelw.so.6.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libssl3@3.5.8-r0", + "Name": "libssl3", + "Identifier": { + "PURL": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "f290ab59b88b1c4a" + }, + "Version": "3.5.8-r0", + "Arch": "x86_64", + "SrcName": "openssl", + "SrcVersion": "3.5.8-r0", + "Licenses": [ + "Apache-2.0" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:5f9b1e55d821953d2e2b1db322dad70a3b5041ea", + "InstalledFiles": [ + "usr/lib/libssl.so.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libtirpc@1.3.5-r1", + "Name": "libtirpc", + "Identifier": { + "PURL": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "471c8d955ca03be5" + }, + "Version": "1.3.5-r1", + "Arch": "x86_64", + "SrcName": "libtirpc", + "SrcVersion": "1.3.5-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "krb5-libs@1.22.2-r1", + "libtirpc-conf@1.3.5-r1", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:c32865bd86a8b8829d152279cabbc5ac6d430eb2", + "InstalledFiles": [ + "usr/lib/libtirpc.so.3", + "usr/lib/libtirpc.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libtirpc-conf@1.3.5-r1", + "Name": "libtirpc-conf", + "Identifier": { + "PURL": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "3437392c14aad33f" + }, + "Version": "1.3.5-r1", + "Arch": "x86_64", + "SrcName": "libtirpc", + "SrcVersion": "1.3.5-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:0c17d9988dc986c90e22f79778df047eca9973ff", + "InstalledFiles": [ + "etc/bindresvport.blacklist", + "etc/netconfig" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libuuid@2.42.3-r1", + "Name": "libuuid", + "Identifier": { + "PURL": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "c444e9cdd1bdda40" + }, + "Version": "2.42.3-r1", + "Arch": "x86_64", + "SrcName": "util-linux", + "SrcVersion": "2.42.3-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86", + "DiffID": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + "Digest": "sha1:8f041ef637ad75f381cc0c034f2afbbb0303264e", + "InstalledFiles": [ + "usr/lib/libuuid.so.1", + "usr/lib/libuuid.so.1.3.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libverto@0.3.2-r2", + "Name": "libverto", + "Identifier": { + "PURL": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "9df4321a283a6cf6" + }, + "Version": "0.3.2-r2", + "Arch": "x86_64", + "SrcName": "libverto", + "SrcVersion": "0.3.2-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:73233059338142e4ac6d8fb8bb0074e93da75dc1", + "InstalledFiles": [ + "usr/lib/libverto.so.1", + "usr/lib/libverto.so.1.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "musl@1.2.6-r2", + "Name": "musl", + "Identifier": { + "PURL": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "1f8cb44befe503d4" + }, + "Version": "1.2.6-r2", + "Arch": "x86_64", + "SrcName": "musl", + "SrcVersion": "1.2.6-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:0f7e5827e4e1a73631beda27b78431a8ba240e05", + "InstalledFiles": [ + "lib/ld-musl-x86_64.so.1", + "lib/libc.musl-x86_64.so.1" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "musl-utils@1.2.6-r2", + "Name": "musl-utils", + "Identifier": { + "PURL": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "4497482ec1d943e1" + }, + "Version": "1.2.6-r2", + "Arch": "x86_64", + "SrcName": "musl", + "SrcVersion": "1.2.6-r2", + "Licenses": [ + "MIT", + "BSD-2-Clause", + "GPL-2.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2", + "scanelf@1.3.9-r1" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:75ada3c48d63ec5d87c42fdf934a3fdd11298dc5", + "InstalledFiles": [ + "sbin/ldconfig", + "usr/bin/getconf", + "usr/bin/getent", + "usr/bin/iconv", + "usr/bin/ldd" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ncurses-terminfo-base@6.6_p20260516-r0", + "Name": "ncurses-terminfo-base", + "Identifier": { + "PURL": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e7fac5c6a6e9ae8" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:9d551d828e9c8ee52c5801c1d6046828ebf15752", + "InstalledFiles": [ + "etc/terminfo/a/alacritty", + "etc/terminfo/a/ansi", + "etc/terminfo/d/dumb", + "etc/terminfo/g/gnome", + "etc/terminfo/g/gnome-256color", + "etc/terminfo/k/konsole", + "etc/terminfo/k/konsole-256color", + "etc/terminfo/k/konsole-linux", + "etc/terminfo/l/linux", + "etc/terminfo/p/putty", + "etc/terminfo/p/putty-256color", + "etc/terminfo/r/rxvt", + "etc/terminfo/r/rxvt-256color", + "etc/terminfo/s/screen", + "etc/terminfo/s/screen-256color", + "etc/terminfo/s/st-0.6", + "etc/terminfo/s/st-0.7", + "etc/terminfo/s/st-0.8", + "etc/terminfo/s/st-0.8.5", + "etc/terminfo/s/st-16color", + "etc/terminfo/s/st-256color", + "etc/terminfo/s/st-direct", + "etc/terminfo/s/sun", + "etc/terminfo/t/terminator", + "etc/terminfo/t/terminology", + "etc/terminfo/t/terminology-0.6.1", + "etc/terminfo/t/terminology-1.0.0", + "etc/terminfo/t/terminology-1.8.1", + "etc/terminfo/t/tmux", + "etc/terminfo/t/tmux-256color", + "etc/terminfo/v/vt100", + "etc/terminfo/v/vt102", + "etc/terminfo/v/vt200", + "etc/terminfo/v/vt220", + "etc/terminfo/v/vt52", + "etc/terminfo/v/vte", + "etc/terminfo/v/vte-256color", + "etc/terminfo/x/xterm", + "etc/terminfo/x/xterm-256color", + "etc/terminfo/x/xterm-color", + "etc/terminfo/x/xterm-xfree86" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "readline@8.3.3-r1", + "Name": "readline", + "Identifier": { + "PURL": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "f50058781c93e1f2" + }, + "Version": "8.3.3-r1", + "Arch": "x86_64", + "SrcName": "readline", + "SrcVersion": "8.3.3-r1", + "Licenses": [ + "GPL-3.0-or-later" + ], + "Maintainer": "qaqland \u003cqaq@qaq.land\u003e", + "DependsOn": [ + "libncursesw@6.6_p20260516-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:945b16e378bc00e44d89d4de8124bba7647fdf4d", + "InstalledFiles": [ + "etc/inputrc", + "usr/lib/libreadline.so.8", + "usr/lib/libreadline.so.8.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "scanelf@1.3.9-r1", + "Name": "scanelf", + "Identifier": { + "PURL": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "936394657a1626fb" + }, + "Version": "1.3.9-r1", + "Arch": "x86_64", + "SrcName": "pax-utils", + "SrcVersion": "1.3.9-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:013f903d0ba219673aebbdd04f74bb5ed82b01f0", + "InstalledFiles": [ + "usr/bin/scanelf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "sqlite-libs@3.53.4-r0", + "Name": "sqlite-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "8b10aee2ccc192de" + }, + "Version": "3.53.4-r0", + "Arch": "x86_64", + "SrcName": "sqlite", + "SrcVersion": "3.53.4-r0", + "Licenses": [ + "blessing" + ], + "Maintainer": "Jingyun Hua \u003chuajingyun@loongson.cn\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:f7630ceb37c232b6609861aeab6cdb9cd120e6fa", + "InstalledFiles": [ + "usr/lib/libsqlite3.so.0", + "usr/lib/libsqlite3.so.3.53.4" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ssl_client@1.37.0-r31", + "Name": "ssl_client", + "Identifier": { + "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "d42e31f15a4ce47a" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c220f4a5125a313af733e98def94132bb1e9d40d", + "InstalledFiles": [ + "usr/bin/ssl_client" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "tzdata@2026c-r0", + "Name": "tzdata", + "Identifier": { + "PURL": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "52c6b50eff629f9d" + }, + "Version": "2026c-r0", + "Arch": "x86_64", + "SrcName": "tzdata", + "SrcVersion": "2026c-r0", + "Licenses": [ + "Public-Domain" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + "Digest": "sha1:61f7544ecd8dd63eac23fe3e645702fda92ef02a", + "InstalledFiles": [ + "usr/share/zoneinfo/CET", + "usr/share/zoneinfo/CST6CDT", + "usr/share/zoneinfo/Cuba", + "usr/share/zoneinfo/EET", + "usr/share/zoneinfo/EST", + "usr/share/zoneinfo/EST5EDT", + "usr/share/zoneinfo/Egypt", + "usr/share/zoneinfo/Eire", + "usr/share/zoneinfo/Factory", + "usr/share/zoneinfo/GB", + "usr/share/zoneinfo/GB-Eire", + "usr/share/zoneinfo/GMT", + "usr/share/zoneinfo/GMT+0", + "usr/share/zoneinfo/GMT-0", + "usr/share/zoneinfo/GMT0", + "usr/share/zoneinfo/Greenwich", + "usr/share/zoneinfo/HST", + "usr/share/zoneinfo/Hongkong", + "usr/share/zoneinfo/Iceland", + "usr/share/zoneinfo/Iran", + "usr/share/zoneinfo/Israel", + "usr/share/zoneinfo/Jamaica", + "usr/share/zoneinfo/Japan", + "usr/share/zoneinfo/Kwajalein", + "usr/share/zoneinfo/Libya", + "usr/share/zoneinfo/MET", + "usr/share/zoneinfo/MST", + "usr/share/zoneinfo/MST7MDT", + "usr/share/zoneinfo/NZ", + "usr/share/zoneinfo/NZ-CHAT", + "usr/share/zoneinfo/Navajo", + "usr/share/zoneinfo/PRC", + "usr/share/zoneinfo/PST8PDT", + "usr/share/zoneinfo/Poland", + "usr/share/zoneinfo/Portugal", + "usr/share/zoneinfo/ROC", + "usr/share/zoneinfo/ROK", + "usr/share/zoneinfo/Singapore", + "usr/share/zoneinfo/Turkey", + "usr/share/zoneinfo/UCT", + "usr/share/zoneinfo/UTC", + "usr/share/zoneinfo/Universal", + "usr/share/zoneinfo/W-SU", + "usr/share/zoneinfo/WET", + "usr/share/zoneinfo/Zulu", + "usr/share/zoneinfo/iso3166.tab", + "usr/share/zoneinfo/leap-seconds.list", + "usr/share/zoneinfo/posixrules", + "usr/share/zoneinfo/zone.tab", + "usr/share/zoneinfo/zone1970.tab", + "usr/share/zoneinfo/Africa/Abidjan", + "usr/share/zoneinfo/Africa/Accra", + "usr/share/zoneinfo/Africa/Addis_Ababa", + "usr/share/zoneinfo/Africa/Algiers", + "usr/share/zoneinfo/Africa/Asmara", + "usr/share/zoneinfo/Africa/Asmera", + "usr/share/zoneinfo/Africa/Bamako", + "usr/share/zoneinfo/Africa/Bangui", + "usr/share/zoneinfo/Africa/Banjul", + "usr/share/zoneinfo/Africa/Bissau", + "usr/share/zoneinfo/Africa/Blantyre", + "usr/share/zoneinfo/Africa/Brazzaville", + "usr/share/zoneinfo/Africa/Bujumbura", + "usr/share/zoneinfo/Africa/Cairo", + "usr/share/zoneinfo/Africa/Casablanca", + "usr/share/zoneinfo/Africa/Ceuta", + "usr/share/zoneinfo/Africa/Conakry", + "usr/share/zoneinfo/Africa/Dakar", + "usr/share/zoneinfo/Africa/Dar_es_Salaam", + "usr/share/zoneinfo/Africa/Djibouti", + "usr/share/zoneinfo/Africa/Douala", + "usr/share/zoneinfo/Africa/El_Aaiun", + "usr/share/zoneinfo/Africa/Freetown", + "usr/share/zoneinfo/Africa/Gaborone", + "usr/share/zoneinfo/Africa/Harare", + "usr/share/zoneinfo/Africa/Johannesburg", + "usr/share/zoneinfo/Africa/Juba", + "usr/share/zoneinfo/Africa/Kampala", + "usr/share/zoneinfo/Africa/Khartoum", + "usr/share/zoneinfo/Africa/Kigali", + "usr/share/zoneinfo/Africa/Kinshasa", + "usr/share/zoneinfo/Africa/Lagos", + "usr/share/zoneinfo/Africa/Libreville", + "usr/share/zoneinfo/Africa/Lome", + "usr/share/zoneinfo/Africa/Luanda", + "usr/share/zoneinfo/Africa/Lubumbashi", + "usr/share/zoneinfo/Africa/Lusaka", + "usr/share/zoneinfo/Africa/Malabo", + "usr/share/zoneinfo/Africa/Maputo", + "usr/share/zoneinfo/Africa/Maseru", + "usr/share/zoneinfo/Africa/Mbabane", + "usr/share/zoneinfo/Africa/Mogadishu", + "usr/share/zoneinfo/Africa/Monrovia", + "usr/share/zoneinfo/Africa/Nairobi", + "usr/share/zoneinfo/Africa/Ndjamena", + "usr/share/zoneinfo/Africa/Niamey", + "usr/share/zoneinfo/Africa/Nouakchott", + "usr/share/zoneinfo/Africa/Ouagadougou", + "usr/share/zoneinfo/Africa/Porto-Novo", + "usr/share/zoneinfo/Africa/Sao_Tome", + "usr/share/zoneinfo/Africa/Timbuktu", + "usr/share/zoneinfo/Africa/Tripoli", + "usr/share/zoneinfo/Africa/Tunis", + "usr/share/zoneinfo/Africa/Windhoek", + "usr/share/zoneinfo/America/Adak", + "usr/share/zoneinfo/America/Anchorage", + "usr/share/zoneinfo/America/Anguilla", + "usr/share/zoneinfo/America/Antigua", + "usr/share/zoneinfo/America/Araguaina", + "usr/share/zoneinfo/America/Aruba", + "usr/share/zoneinfo/America/Asuncion", + "usr/share/zoneinfo/America/Atikokan", + "usr/share/zoneinfo/America/Atka", + "usr/share/zoneinfo/America/Bahia", + "usr/share/zoneinfo/America/Bahia_Banderas", + "usr/share/zoneinfo/America/Barbados", + "usr/share/zoneinfo/America/Belem", + "usr/share/zoneinfo/America/Belize", + "usr/share/zoneinfo/America/Blanc-Sablon", + "usr/share/zoneinfo/America/Boa_Vista", + "usr/share/zoneinfo/America/Bogota", + "usr/share/zoneinfo/America/Boise", + "usr/share/zoneinfo/America/Buenos_Aires", + "usr/share/zoneinfo/America/Cambridge_Bay", + "usr/share/zoneinfo/America/Campo_Grande", + "usr/share/zoneinfo/America/Cancun", + "usr/share/zoneinfo/America/Caracas", + "usr/share/zoneinfo/America/Catamarca", + "usr/share/zoneinfo/America/Cayenne", + "usr/share/zoneinfo/America/Cayman", + "usr/share/zoneinfo/America/Chicago", + "usr/share/zoneinfo/America/Chihuahua", + "usr/share/zoneinfo/America/Ciudad_Juarez", + "usr/share/zoneinfo/America/Coral_Harbour", + "usr/share/zoneinfo/America/Cordoba", + "usr/share/zoneinfo/America/Costa_Rica", + "usr/share/zoneinfo/America/Coyhaique", + "usr/share/zoneinfo/America/Creston", + "usr/share/zoneinfo/America/Cuiaba", + "usr/share/zoneinfo/America/Curacao", + "usr/share/zoneinfo/America/Danmarkshavn", + "usr/share/zoneinfo/America/Dawson", + "usr/share/zoneinfo/America/Dawson_Creek", + "usr/share/zoneinfo/America/Denver", + "usr/share/zoneinfo/America/Detroit", + "usr/share/zoneinfo/America/Dominica", + "usr/share/zoneinfo/America/Edmonton", + "usr/share/zoneinfo/America/Eirunepe", + "usr/share/zoneinfo/America/El_Salvador", + "usr/share/zoneinfo/America/Ensenada", + "usr/share/zoneinfo/America/Fort_Nelson", + "usr/share/zoneinfo/America/Fort_Wayne", + "usr/share/zoneinfo/America/Fortaleza", + "usr/share/zoneinfo/America/Glace_Bay", + "usr/share/zoneinfo/America/Godthab", + "usr/share/zoneinfo/America/Goose_Bay", + "usr/share/zoneinfo/America/Grand_Turk", + "usr/share/zoneinfo/America/Grenada", + "usr/share/zoneinfo/America/Guadeloupe", + "usr/share/zoneinfo/America/Guatemala", + "usr/share/zoneinfo/America/Guayaquil", + "usr/share/zoneinfo/America/Guyana", + "usr/share/zoneinfo/America/Halifax", + "usr/share/zoneinfo/America/Havana", + "usr/share/zoneinfo/America/Hermosillo", + "usr/share/zoneinfo/America/Indianapolis", + "usr/share/zoneinfo/America/Inuvik", + "usr/share/zoneinfo/America/Iqaluit", + "usr/share/zoneinfo/America/Jamaica", + "usr/share/zoneinfo/America/Jujuy", + "usr/share/zoneinfo/America/Juneau", + "usr/share/zoneinfo/America/Knox_IN", + "usr/share/zoneinfo/America/Kralendijk", + "usr/share/zoneinfo/America/La_Paz", + "usr/share/zoneinfo/America/Lima", + "usr/share/zoneinfo/America/Los_Angeles", + "usr/share/zoneinfo/America/Louisville", + "usr/share/zoneinfo/America/Lower_Princes", + "usr/share/zoneinfo/America/Maceio", + "usr/share/zoneinfo/America/Managua", + "usr/share/zoneinfo/America/Manaus", + "usr/share/zoneinfo/America/Marigot", + "usr/share/zoneinfo/America/Martinique", + "usr/share/zoneinfo/America/Matamoros", + "usr/share/zoneinfo/America/Mazatlan", + "usr/share/zoneinfo/America/Mendoza", + "usr/share/zoneinfo/America/Menominee", + "usr/share/zoneinfo/America/Merida", + "usr/share/zoneinfo/America/Metlakatla", + "usr/share/zoneinfo/America/Mexico_City", + "usr/share/zoneinfo/America/Miquelon", + "usr/share/zoneinfo/America/Moncton", + "usr/share/zoneinfo/America/Monterrey", + "usr/share/zoneinfo/America/Montevideo", + "usr/share/zoneinfo/America/Montreal", + "usr/share/zoneinfo/America/Montserrat", + "usr/share/zoneinfo/America/Nassau", + "usr/share/zoneinfo/America/New_York", + "usr/share/zoneinfo/America/Nipigon", + "usr/share/zoneinfo/America/Nome", + "usr/share/zoneinfo/America/Noronha", + "usr/share/zoneinfo/America/Nuuk", + "usr/share/zoneinfo/America/Ojinaga", + "usr/share/zoneinfo/America/Panama", + "usr/share/zoneinfo/America/Pangnirtung", + "usr/share/zoneinfo/America/Paramaribo", + "usr/share/zoneinfo/America/Phoenix", + "usr/share/zoneinfo/America/Port-au-Prince", + "usr/share/zoneinfo/America/Port_of_Spain", + "usr/share/zoneinfo/America/Porto_Acre", + "usr/share/zoneinfo/America/Porto_Velho", + "usr/share/zoneinfo/America/Puerto_Rico", + "usr/share/zoneinfo/America/Punta_Arenas", + "usr/share/zoneinfo/America/Rainy_River", + "usr/share/zoneinfo/America/Rankin_Inlet", + "usr/share/zoneinfo/America/Recife", + "usr/share/zoneinfo/America/Regina", + "usr/share/zoneinfo/America/Resolute", + "usr/share/zoneinfo/America/Rio_Branco", + "usr/share/zoneinfo/America/Rosario", + "usr/share/zoneinfo/America/Santa_Isabel", + "usr/share/zoneinfo/America/Santarem", + "usr/share/zoneinfo/America/Santiago", + "usr/share/zoneinfo/America/Santo_Domingo", + "usr/share/zoneinfo/America/Sao_Paulo", + "usr/share/zoneinfo/America/Scoresbysund", + "usr/share/zoneinfo/America/Shiprock", + "usr/share/zoneinfo/America/Sitka", + "usr/share/zoneinfo/America/St_Barthelemy", + "usr/share/zoneinfo/America/St_Johns", + "usr/share/zoneinfo/America/St_Kitts", + "usr/share/zoneinfo/America/St_Lucia", + "usr/share/zoneinfo/America/St_Thomas", + "usr/share/zoneinfo/America/St_Vincent", + "usr/share/zoneinfo/America/Swift_Current", + "usr/share/zoneinfo/America/Tegucigalpa", + "usr/share/zoneinfo/America/Thule", + "usr/share/zoneinfo/America/Thunder_Bay", + "usr/share/zoneinfo/America/Tijuana", + "usr/share/zoneinfo/America/Toronto", + "usr/share/zoneinfo/America/Tortola", + "usr/share/zoneinfo/America/Vancouver", + "usr/share/zoneinfo/America/Virgin", + "usr/share/zoneinfo/America/Whitehorse", + "usr/share/zoneinfo/America/Winnipeg", + "usr/share/zoneinfo/America/Yakutat", + "usr/share/zoneinfo/America/Yellowknife", + "usr/share/zoneinfo/America/Argentina/Buenos_Aires", + "usr/share/zoneinfo/America/Argentina/Catamarca", + "usr/share/zoneinfo/America/Argentina/ComodRivadavia", + "usr/share/zoneinfo/America/Argentina/Cordoba", + "usr/share/zoneinfo/America/Argentina/Jujuy", + "usr/share/zoneinfo/America/Argentina/La_Rioja", + "usr/share/zoneinfo/America/Argentina/Mendoza", + "usr/share/zoneinfo/America/Argentina/Rio_Gallegos", + "usr/share/zoneinfo/America/Argentina/Salta", + "usr/share/zoneinfo/America/Argentina/San_Juan", + "usr/share/zoneinfo/America/Argentina/San_Luis", + "usr/share/zoneinfo/America/Argentina/Tucuman", + "usr/share/zoneinfo/America/Argentina/Ushuaia", + "usr/share/zoneinfo/America/Indiana/Indianapolis", + "usr/share/zoneinfo/America/Indiana/Knox", + "usr/share/zoneinfo/America/Indiana/Marengo", + "usr/share/zoneinfo/America/Indiana/Petersburg", + "usr/share/zoneinfo/America/Indiana/Tell_City", + "usr/share/zoneinfo/America/Indiana/Vevay", + "usr/share/zoneinfo/America/Indiana/Vincennes", + "usr/share/zoneinfo/America/Indiana/Winamac", + "usr/share/zoneinfo/America/Kentucky/Louisville", + "usr/share/zoneinfo/America/Kentucky/Monticello", + "usr/share/zoneinfo/America/North_Dakota/Beulah", + "usr/share/zoneinfo/America/North_Dakota/Center", + "usr/share/zoneinfo/America/North_Dakota/New_Salem", + "usr/share/zoneinfo/Antarctica/Casey", + "usr/share/zoneinfo/Antarctica/Davis", + "usr/share/zoneinfo/Antarctica/DumontDUrville", + "usr/share/zoneinfo/Antarctica/Macquarie", + "usr/share/zoneinfo/Antarctica/Mawson", + "usr/share/zoneinfo/Antarctica/McMurdo", + "usr/share/zoneinfo/Antarctica/Palmer", + "usr/share/zoneinfo/Antarctica/Rothera", + "usr/share/zoneinfo/Antarctica/South_Pole", + "usr/share/zoneinfo/Antarctica/Syowa", + "usr/share/zoneinfo/Antarctica/Troll", + "usr/share/zoneinfo/Antarctica/Vostok", + "usr/share/zoneinfo/Arctic/Longyearbyen", + "usr/share/zoneinfo/Asia/Aden", + "usr/share/zoneinfo/Asia/Almaty", + "usr/share/zoneinfo/Asia/Amman", + "usr/share/zoneinfo/Asia/Anadyr", + "usr/share/zoneinfo/Asia/Aqtau", + "usr/share/zoneinfo/Asia/Aqtobe", + "usr/share/zoneinfo/Asia/Ashgabat", + "usr/share/zoneinfo/Asia/Ashkhabad", + "usr/share/zoneinfo/Asia/Atyrau", + "usr/share/zoneinfo/Asia/Baghdad", + "usr/share/zoneinfo/Asia/Bahrain", + "usr/share/zoneinfo/Asia/Baku", + "usr/share/zoneinfo/Asia/Bangkok", + "usr/share/zoneinfo/Asia/Barnaul", + "usr/share/zoneinfo/Asia/Beirut", + "usr/share/zoneinfo/Asia/Bishkek", + "usr/share/zoneinfo/Asia/Brunei", + "usr/share/zoneinfo/Asia/Calcutta", + "usr/share/zoneinfo/Asia/Chita", + "usr/share/zoneinfo/Asia/Choibalsan", + "usr/share/zoneinfo/Asia/Chongqing", + "usr/share/zoneinfo/Asia/Chungking", + "usr/share/zoneinfo/Asia/Colombo", + "usr/share/zoneinfo/Asia/Dacca", + "usr/share/zoneinfo/Asia/Damascus", + "usr/share/zoneinfo/Asia/Dhaka", + "usr/share/zoneinfo/Asia/Dili", + "usr/share/zoneinfo/Asia/Dubai", + "usr/share/zoneinfo/Asia/Dushanbe", + "usr/share/zoneinfo/Asia/Famagusta", + "usr/share/zoneinfo/Asia/Gaza", + "usr/share/zoneinfo/Asia/Harbin", + "usr/share/zoneinfo/Asia/Hebron", + "usr/share/zoneinfo/Asia/Ho_Chi_Minh", + "usr/share/zoneinfo/Asia/Hong_Kong", + "usr/share/zoneinfo/Asia/Hovd", + "usr/share/zoneinfo/Asia/Irkutsk", + "usr/share/zoneinfo/Asia/Istanbul", + "usr/share/zoneinfo/Asia/Jakarta", + "usr/share/zoneinfo/Asia/Jayapura", + "usr/share/zoneinfo/Asia/Jerusalem", + "usr/share/zoneinfo/Asia/Kabul", + "usr/share/zoneinfo/Asia/Kamchatka", + "usr/share/zoneinfo/Asia/Karachi", + "usr/share/zoneinfo/Asia/Kashgar", + "usr/share/zoneinfo/Asia/Kathmandu", + "usr/share/zoneinfo/Asia/Katmandu", + "usr/share/zoneinfo/Asia/Khandyga", + "usr/share/zoneinfo/Asia/Kolkata", + "usr/share/zoneinfo/Asia/Krasnoyarsk", + "usr/share/zoneinfo/Asia/Kuala_Lumpur", + "usr/share/zoneinfo/Asia/Kuching", + "usr/share/zoneinfo/Asia/Kuwait", + "usr/share/zoneinfo/Asia/Macao", + "usr/share/zoneinfo/Asia/Macau", + "usr/share/zoneinfo/Asia/Magadan", + "usr/share/zoneinfo/Asia/Makassar", + "usr/share/zoneinfo/Asia/Manila", + "usr/share/zoneinfo/Asia/Muscat", + "usr/share/zoneinfo/Asia/Nicosia", + "usr/share/zoneinfo/Asia/Novokuznetsk", + "usr/share/zoneinfo/Asia/Novosibirsk", + "usr/share/zoneinfo/Asia/Omsk", + "usr/share/zoneinfo/Asia/Oral", + "usr/share/zoneinfo/Asia/Phnom_Penh", + "usr/share/zoneinfo/Asia/Pontianak", + "usr/share/zoneinfo/Asia/Pyongyang", + "usr/share/zoneinfo/Asia/Qatar", + "usr/share/zoneinfo/Asia/Qostanay", + "usr/share/zoneinfo/Asia/Qyzylorda", + "usr/share/zoneinfo/Asia/Rangoon", + "usr/share/zoneinfo/Asia/Riyadh", + "usr/share/zoneinfo/Asia/Saigon", + "usr/share/zoneinfo/Asia/Sakhalin", + "usr/share/zoneinfo/Asia/Samarkand", + "usr/share/zoneinfo/Asia/Seoul", + "usr/share/zoneinfo/Asia/Shanghai", + "usr/share/zoneinfo/Asia/Singapore", + "usr/share/zoneinfo/Asia/Srednekolymsk", + "usr/share/zoneinfo/Asia/Taipei", + "usr/share/zoneinfo/Asia/Tashkent", + "usr/share/zoneinfo/Asia/Tbilisi", + "usr/share/zoneinfo/Asia/Tehran", + "usr/share/zoneinfo/Asia/Tel_Aviv", + "usr/share/zoneinfo/Asia/Thimbu", + "usr/share/zoneinfo/Asia/Thimphu", + "usr/share/zoneinfo/Asia/Tokyo", + "usr/share/zoneinfo/Asia/Tomsk", + "usr/share/zoneinfo/Asia/Ujung_Pandang", + "usr/share/zoneinfo/Asia/Ulaanbaatar", + "usr/share/zoneinfo/Asia/Ulan_Bator", + "usr/share/zoneinfo/Asia/Urumqi", + "usr/share/zoneinfo/Asia/Ust-Nera", + "usr/share/zoneinfo/Asia/Vientiane", + "usr/share/zoneinfo/Asia/Vladivostok", + "usr/share/zoneinfo/Asia/Yakutsk", + "usr/share/zoneinfo/Asia/Yangon", + "usr/share/zoneinfo/Asia/Yekaterinburg", + "usr/share/zoneinfo/Asia/Yerevan", + "usr/share/zoneinfo/Atlantic/Azores", + "usr/share/zoneinfo/Atlantic/Bermuda", + "usr/share/zoneinfo/Atlantic/Canary", + "usr/share/zoneinfo/Atlantic/Cape_Verde", + "usr/share/zoneinfo/Atlantic/Faeroe", + "usr/share/zoneinfo/Atlantic/Faroe", + "usr/share/zoneinfo/Atlantic/Jan_Mayen", + "usr/share/zoneinfo/Atlantic/Madeira", + "usr/share/zoneinfo/Atlantic/Reykjavik", + "usr/share/zoneinfo/Atlantic/South_Georgia", + "usr/share/zoneinfo/Atlantic/St_Helena", + "usr/share/zoneinfo/Atlantic/Stanley", + "usr/share/zoneinfo/Australia/ACT", + "usr/share/zoneinfo/Australia/Adelaide", + "usr/share/zoneinfo/Australia/Brisbane", + "usr/share/zoneinfo/Australia/Broken_Hill", + "usr/share/zoneinfo/Australia/Canberra", + "usr/share/zoneinfo/Australia/Currie", + "usr/share/zoneinfo/Australia/Darwin", + "usr/share/zoneinfo/Australia/Eucla", + "usr/share/zoneinfo/Australia/Hobart", + "usr/share/zoneinfo/Australia/LHI", + "usr/share/zoneinfo/Australia/Lindeman", + "usr/share/zoneinfo/Australia/Lord_Howe", + "usr/share/zoneinfo/Australia/Melbourne", + "usr/share/zoneinfo/Australia/NSW", + "usr/share/zoneinfo/Australia/North", + "usr/share/zoneinfo/Australia/Perth", + "usr/share/zoneinfo/Australia/Queensland", + "usr/share/zoneinfo/Australia/South", + "usr/share/zoneinfo/Australia/Sydney", + "usr/share/zoneinfo/Australia/Tasmania", + "usr/share/zoneinfo/Australia/Victoria", + "usr/share/zoneinfo/Australia/West", + "usr/share/zoneinfo/Australia/Yancowinna", + "usr/share/zoneinfo/Brazil/Acre", + "usr/share/zoneinfo/Brazil/DeNoronha", + "usr/share/zoneinfo/Brazil/East", + "usr/share/zoneinfo/Brazil/West", + "usr/share/zoneinfo/Canada/Atlantic", + "usr/share/zoneinfo/Canada/Central", + "usr/share/zoneinfo/Canada/Eastern", + "usr/share/zoneinfo/Canada/Mountain", + "usr/share/zoneinfo/Canada/Newfoundland", + "usr/share/zoneinfo/Canada/Pacific", + "usr/share/zoneinfo/Canada/Saskatchewan", + "usr/share/zoneinfo/Canada/Yukon", + "usr/share/zoneinfo/Chile/Continental", + "usr/share/zoneinfo/Chile/EasterIsland", + "usr/share/zoneinfo/Etc/GMT", + "usr/share/zoneinfo/Etc/GMT+0", + "usr/share/zoneinfo/Etc/GMT+1", + "usr/share/zoneinfo/Etc/GMT+10", + "usr/share/zoneinfo/Etc/GMT+11", + "usr/share/zoneinfo/Etc/GMT+12", + "usr/share/zoneinfo/Etc/GMT+2", + "usr/share/zoneinfo/Etc/GMT+3", + "usr/share/zoneinfo/Etc/GMT+4", + "usr/share/zoneinfo/Etc/GMT+5", + "usr/share/zoneinfo/Etc/GMT+6", + "usr/share/zoneinfo/Etc/GMT+7", + "usr/share/zoneinfo/Etc/GMT+8", + "usr/share/zoneinfo/Etc/GMT+9", + "usr/share/zoneinfo/Etc/GMT-0", + "usr/share/zoneinfo/Etc/GMT-1", + "usr/share/zoneinfo/Etc/GMT-10", + "usr/share/zoneinfo/Etc/GMT-11", + "usr/share/zoneinfo/Etc/GMT-12", + "usr/share/zoneinfo/Etc/GMT-13", + "usr/share/zoneinfo/Etc/GMT-14", + "usr/share/zoneinfo/Etc/GMT-2", + "usr/share/zoneinfo/Etc/GMT-3", + "usr/share/zoneinfo/Etc/GMT-4", + "usr/share/zoneinfo/Etc/GMT-5", + "usr/share/zoneinfo/Etc/GMT-6", + "usr/share/zoneinfo/Etc/GMT-7", + "usr/share/zoneinfo/Etc/GMT-8", + "usr/share/zoneinfo/Etc/GMT-9", + "usr/share/zoneinfo/Etc/GMT0", + "usr/share/zoneinfo/Etc/Greenwich", + "usr/share/zoneinfo/Etc/UCT", + "usr/share/zoneinfo/Etc/UTC", + "usr/share/zoneinfo/Etc/Universal", + "usr/share/zoneinfo/Etc/Zulu", + "usr/share/zoneinfo/Europe/Amsterdam", + "usr/share/zoneinfo/Europe/Andorra", + "usr/share/zoneinfo/Europe/Astrakhan", + "usr/share/zoneinfo/Europe/Athens", + "usr/share/zoneinfo/Europe/Belfast", + "usr/share/zoneinfo/Europe/Belgrade", + "usr/share/zoneinfo/Europe/Berlin", + "usr/share/zoneinfo/Europe/Bratislava", + "usr/share/zoneinfo/Europe/Brussels", + "usr/share/zoneinfo/Europe/Bucharest", + "usr/share/zoneinfo/Europe/Budapest", + "usr/share/zoneinfo/Europe/Busingen", + "usr/share/zoneinfo/Europe/Chisinau", + "usr/share/zoneinfo/Europe/Copenhagen", + "usr/share/zoneinfo/Europe/Dublin", + "usr/share/zoneinfo/Europe/Gibraltar", + "usr/share/zoneinfo/Europe/Guernsey", + "usr/share/zoneinfo/Europe/Helsinki", + "usr/share/zoneinfo/Europe/Isle_of_Man", + "usr/share/zoneinfo/Europe/Istanbul", + "usr/share/zoneinfo/Europe/Jersey", + "usr/share/zoneinfo/Europe/Kaliningrad", + "usr/share/zoneinfo/Europe/Kiev", + "usr/share/zoneinfo/Europe/Kirov", + "usr/share/zoneinfo/Europe/Kyiv", + "usr/share/zoneinfo/Europe/Lisbon", + "usr/share/zoneinfo/Europe/Ljubljana", + "usr/share/zoneinfo/Europe/London", + "usr/share/zoneinfo/Europe/Luxembourg", + "usr/share/zoneinfo/Europe/Madrid", + "usr/share/zoneinfo/Europe/Malta", + "usr/share/zoneinfo/Europe/Mariehamn", + "usr/share/zoneinfo/Europe/Minsk", + "usr/share/zoneinfo/Europe/Monaco", + "usr/share/zoneinfo/Europe/Moscow", + "usr/share/zoneinfo/Europe/Nicosia", + "usr/share/zoneinfo/Europe/Oslo", + "usr/share/zoneinfo/Europe/Paris", + "usr/share/zoneinfo/Europe/Podgorica", + "usr/share/zoneinfo/Europe/Prague", + "usr/share/zoneinfo/Europe/Riga", + "usr/share/zoneinfo/Europe/Rome", + "usr/share/zoneinfo/Europe/Samara", + "usr/share/zoneinfo/Europe/San_Marino", + "usr/share/zoneinfo/Europe/Sarajevo", + "usr/share/zoneinfo/Europe/Saratov", + "usr/share/zoneinfo/Europe/Simferopol", + "usr/share/zoneinfo/Europe/Skopje", + "usr/share/zoneinfo/Europe/Sofia", + "usr/share/zoneinfo/Europe/Stockholm", + "usr/share/zoneinfo/Europe/Tallinn", + "usr/share/zoneinfo/Europe/Tirane", + "usr/share/zoneinfo/Europe/Tiraspol", + "usr/share/zoneinfo/Europe/Ulyanovsk", + "usr/share/zoneinfo/Europe/Uzhgorod", + "usr/share/zoneinfo/Europe/Vaduz", + "usr/share/zoneinfo/Europe/Vatican", + "usr/share/zoneinfo/Europe/Vienna", + "usr/share/zoneinfo/Europe/Vilnius", + "usr/share/zoneinfo/Europe/Volgograd", + "usr/share/zoneinfo/Europe/Warsaw", + "usr/share/zoneinfo/Europe/Zagreb", + "usr/share/zoneinfo/Europe/Zaporozhye", + "usr/share/zoneinfo/Europe/Zurich", + "usr/share/zoneinfo/Indian/Antananarivo", + "usr/share/zoneinfo/Indian/Chagos", + "usr/share/zoneinfo/Indian/Christmas", + "usr/share/zoneinfo/Indian/Cocos", + "usr/share/zoneinfo/Indian/Comoro", + "usr/share/zoneinfo/Indian/Kerguelen", + "usr/share/zoneinfo/Indian/Mahe", + "usr/share/zoneinfo/Indian/Maldives", + "usr/share/zoneinfo/Indian/Mauritius", + "usr/share/zoneinfo/Indian/Mayotte", + "usr/share/zoneinfo/Indian/Reunion", + "usr/share/zoneinfo/Mexico/BajaNorte", + "usr/share/zoneinfo/Mexico/BajaSur", + "usr/share/zoneinfo/Mexico/General", + "usr/share/zoneinfo/Pacific/Apia", + "usr/share/zoneinfo/Pacific/Auckland", + "usr/share/zoneinfo/Pacific/Bougainville", + "usr/share/zoneinfo/Pacific/Chatham", + "usr/share/zoneinfo/Pacific/Chuuk", + "usr/share/zoneinfo/Pacific/Easter", + "usr/share/zoneinfo/Pacific/Efate", + "usr/share/zoneinfo/Pacific/Enderbury", + "usr/share/zoneinfo/Pacific/Fakaofo", + "usr/share/zoneinfo/Pacific/Fiji", + "usr/share/zoneinfo/Pacific/Funafuti", + "usr/share/zoneinfo/Pacific/Galapagos", + "usr/share/zoneinfo/Pacific/Gambier", + "usr/share/zoneinfo/Pacific/Guadalcanal", + "usr/share/zoneinfo/Pacific/Guam", + "usr/share/zoneinfo/Pacific/Honolulu", + "usr/share/zoneinfo/Pacific/Johnston", + "usr/share/zoneinfo/Pacific/Kanton", + "usr/share/zoneinfo/Pacific/Kiritimati", + "usr/share/zoneinfo/Pacific/Kosrae", + "usr/share/zoneinfo/Pacific/Kwajalein", + "usr/share/zoneinfo/Pacific/Majuro", + "usr/share/zoneinfo/Pacific/Marquesas", + "usr/share/zoneinfo/Pacific/Midway", + "usr/share/zoneinfo/Pacific/Nauru", + "usr/share/zoneinfo/Pacific/Niue", + "usr/share/zoneinfo/Pacific/Norfolk", + "usr/share/zoneinfo/Pacific/Noumea", + "usr/share/zoneinfo/Pacific/Pago_Pago", + "usr/share/zoneinfo/Pacific/Palau", + "usr/share/zoneinfo/Pacific/Pitcairn", + "usr/share/zoneinfo/Pacific/Pohnpei", + "usr/share/zoneinfo/Pacific/Ponape", + "usr/share/zoneinfo/Pacific/Port_Moresby", + "usr/share/zoneinfo/Pacific/Rarotonga", + "usr/share/zoneinfo/Pacific/Saipan", + "usr/share/zoneinfo/Pacific/Samoa", + "usr/share/zoneinfo/Pacific/Tahiti", + "usr/share/zoneinfo/Pacific/Tarawa", + "usr/share/zoneinfo/Pacific/Tongatapu", + "usr/share/zoneinfo/Pacific/Truk", + "usr/share/zoneinfo/Pacific/Wake", + "usr/share/zoneinfo/Pacific/Wallis", + "usr/share/zoneinfo/Pacific/Yap", + "usr/share/zoneinfo/US/Alaska", + "usr/share/zoneinfo/US/Aleutian", + "usr/share/zoneinfo/US/Arizona", + "usr/share/zoneinfo/US/Central", + "usr/share/zoneinfo/US/East-Indiana", + "usr/share/zoneinfo/US/Eastern", + "usr/share/zoneinfo/US/Hawaii", + "usr/share/zoneinfo/US/Indiana-Starke", + "usr/share/zoneinfo/US/Michigan", + "usr/share/zoneinfo/US/Mountain", + "usr/share/zoneinfo/US/Pacific", + "usr/share/zoneinfo/US/Samoa" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "xz-libs@5.8.3-r0", + "Name": "xz-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "1ae658a5f132a091" + }, + "Version": "5.8.3-r0", + "Arch": "x86_64", + "SrcName": "xz", + "SrcVersion": "5.8.3-r0", + "Licenses": [ + "GPL-2.0-or-later", + "0BSD", + "Public-Domain", + "LGPL-2.1-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:4c92c5be0c5bef404e93c880eba9037a9b147347", + "InstalledFiles": [ + "usr/lib/liblzma.so.5", + "usr/lib/liblzma.so.5.8.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "zlib@1.3.2-r1", + "Name": "zlib", + "Identifier": { + "PURL": "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "1c01476a88d60a66" + }, + "Version": "1.3.2-r1", + "Arch": "x86_64", + "SrcName": "zlib", + "SrcVersion": "1.3.2-r1", + "Licenses": [ + "Zlib" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:645872f9a17cb984e868cc31e749d9db7227a520a47e5d39cc5836f98eb2f731", + "DiffID": "sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e" + }, + "Digest": "sha1:4f525c8cc204f84b8b4ca40db3be389958f056c6", + "InstalledFiles": [ + "usr/lib/libz.so.1", + "usr/lib/libz.so.1.3.2" + ], + "AnalyzedBy": "apk" + } + ] + }, + { + "Target": "Python", + "Class": "lang-pkgs", + "Type": "python-pkg", + "Packages": [ + { + "Name": "PyJWT", + "Identifier": { + "PURL": "pkg:pypi/pyjwt@2.15.1", + "UID": "d3f5f9a421b8abc9" + }, + "Version": "2.15.1", + "Licenses": [ + "MIT" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/pyjwt-2.15.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "cffi", + "Identifier": { + "PURL": "pkg:pypi/cffi@2.1.1", + "UID": "21042e2f37e33c05" + }, + "Version": "2.1.1", + "Licenses": [ + "MIT-0" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "cryptography", + "Identifier": { + "PURL": "pkg:pypi/cryptography@50.0.1", + "UID": "dcb3df6383fe2a60" + }, + "Version": "50.0.1", + "Licenses": [ + "Apache-2.0 OR BSD-3-Clause" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/cryptography-50.0.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "informed-decision", + "Identifier": { + "PURL": "pkg:pypi/informed-decision@0.2.0", + "UID": "7989f2afae8ff568" + }, + "Version": "0.2.0", + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/informed_decision-0.2.0.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "pycparser", + "Identifier": { + "PURL": "pkg:pypi/pycparser@3.0", + "UID": "e5a4d03f15a695ff" + }, + "Version": "3.0", + "Licenses": [ + "BSD-3-Clause" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/pycparser-3.0.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "waitress", + "Identifier": { + "PURL": "pkg:pypi/waitress@3.0.2", + "UID": "806e218e1c1e85f" + }, + "Version": "3.0.2", + "Licenses": [ + "ZPL-2.1" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/waitress-3.0.2.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + } + ] + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py new file mode 100644 index 0000000..03e4d34 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py @@ -0,0 +1,46 @@ +from pathlib import Path +import hashlib,io,json,tarfile +root=Path('/tmp/infd-zlib-remediation-build') +def image(path): + with tarfile.open(path) as archive: + manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1 + configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes) + files={} + for name in manifest[0]['Layers']: + with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer: + for member in layer: + path=member.name.lstrip('./');p=Path(path) + if p.name=='.wh..wh..opq': + folder=p.parent.as_posix();files={key:value for key,value in files.items() if not key.startswith(folder+'/')};continue + if p.name.startswith('.wh.'): + removed=(p.parent/p.name[4:]).as_posix();files={key:value for key,value in files.items() if key!=removed and not key.startswith(removed+'/')};continue + if member.isfile(): + data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest()) + elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname) + else:continue + files[path]=value + return config,hashlib.sha256(configbytes).hexdigest(),files +base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar') +assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids'] +changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)} +expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +assert set(changed)<=expected,set(changed) +a,b=base['config'].copy(),candidate['config'].copy() +labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{}) +a.pop('Image',None);b.pop('Image',None) +defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None} +for key,value in defaults.items(): + a.setdefault(key,value);b.setdefault(key,value) +assert a==b,(a,b) +components=[] +for name in ['base-sbom.cdx.json','sbom.cdx.json']: + data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')}) +sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)} +assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta +vulns=[] +for name in ['base-trivy-full.json','trivy-full.json']: + data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])]) +assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM' +assert not vulns[1] +proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False} +(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed))) diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py new file mode 100644 index 0000000..523de0f --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py @@ -0,0 +1,19 @@ +"""Exact public input verification only; signature verification remains mandatory in build.""" +import hashlib,json,sys +from pathlib import Path + +def verify(root): + pins=json.loads((root/'pins.json').read_text()) + if set(pins['files'])!={'.dockerignore','Containerfile','zlib-1.3.2-r1.apk','APKINDEX.tar.gz'}:raise ValueError('unclosed inputs') + if pins['base_image']!='forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a':raise ValueError('base pin changed') + for name,digest in pins['files'].items(): + p=root/name + if p.is_symlink() or not p.is_file() or p.stat().st_size>1024*1024:raise ValueError('regular bounded source required') + if hashlib.sha256(p.read_bytes()).hexdigest()!=digest:raise ValueError('changed bytes') + digest=hashlib.sha256(json.dumps(pins['files'],sort_keys=True,separators=(',',':')).encode()).hexdigest() + if digest!=pins['context_sha256']:raise ValueError('context mismatch') + return {'context_sha256':digest,'input_files':4} + +if __name__=='__main__': + try:print(json.dumps(verify(Path(sys.argv[1])))) + except Exception:raise SystemExit('exact build inputs refused') from None diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py new file mode 100644 index 0000000..b8eae32 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py @@ -0,0 +1,29 @@ +"""Package/backend/source metadata only; never opens a database or provider.""" +import ctypes, gzip, hashlib, importlib.metadata, json, os +from pathlib import Path +import ssl, stat, zlib, sys +if sys.flags.optimize:raise RuntimeError("optimized smoke interpreter refused") + +def digest(path):return hashlib.sha256(Path(path).read_bytes()).hexdigest() +packages={} +for entry in Path('/lib/apk/db/installed').read_text().split('\n\n'): + fields=dict(line.split(':',1) for line in entry.splitlines() if ':' in line) + if 'P' in fields:packages[fields['P']]=fields['V'] +module=Path('/opt/venv/lib/python3.12/site-packages/informed_decision/policy.py');info=module.lstat() +app=module.parent +appfiles={str(p.relative_to(app)):digest(p) for p in sorted(app.rglob('*')) if p.is_file() and '__pycache__' not in p.parts} +keys={p.name:digest(p) for p in sorted(Path('/etc/apk/keys').glob('*.pub'))} +vectors=[b'',b'hello zlib',bytes(range(256))*16384,b'a'*1048576] +for value in vectors: + assert zlib.decompress(zlib.compress(value))==value + assert gzip.decompress(gzip.compress(value,mtime=0))==value +failures=0 +for bad in [b'notzlib',zlib.compress(b'fixture')[:-2],b'\x00'*16]: + try:zlib.decompress(bad) + except zlib.error:failures+=1 + else:raise AssertionError('malformed compression accepted') +from cryptography.hazmat.primitives.ciphers.aead import AESGCM +import jwt, waitress +key=bytes(range(32));nonce=b'123456789012';aes=AESGCM(key);cipher=aes.encrypt(nonce,b'synthetic',b'fixture');assert aes.decrypt(nonce,cipher,b'fixture')==b'synthetic' +signed=jwt.encode({'sub':'synthetic'},'synthetic-test-key-only-32bytes!!!!',algorithm='HS256');assert jwt.decode(signed,'synthetic-test-key-only-32bytes!!!!',algorithms=['HS256'])['sub']=='synthetic' +print(json.dumps({'uid':os.getuid(),'gid':os.getgid(),'policy_sha256':digest(module),'policy_mode':oct(stat.S_IMODE(info.st_mode)),'policy_uid':info.st_uid,'app_file_sha256':appfiles,'apk_packages':packages,'apk_world_sha256':digest('/etc/apk/world'),'apk_keys_sha256':keys,'python_dependencies':{d.metadata['Name']:d.version for d in importlib.metadata.distributions()},'zlib_runtime_version':zlib.ZLIB_RUNTIME_VERSION,'zlib_compile_version':zlib.ZLIB_VERSION,'libz_sha256':digest('/usr/lib/libz.so.1.3.2'),'compression_vectors_pass':len(vectors),'malformed_zlib_refusals':failures,'crypto_jwt_waitress_smoke':True,'openssl':ssl.OPENSSL_VERSION,'network_accessed':False,'database_opened':False,'provider_or_customer_data_used':False})) diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py new file mode 100644 index 0000000..d2da70a --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py @@ -0,0 +1,16 @@ +"""Metadata only; no database, provider or native action.""" +import json,sys + +def compare(a,b): + for field in ('app_file_sha256','policy_sha256','policy_uid','policy_mode','uid','gid','apk_world_sha256','apk_keys_sha256','python_dependencies','openssl'): + if a[field]!=b[field]:raise ValueError('unrelated delta: '+field) + changed={name:[a['apk_packages'].get(name),b['apk_packages'].get(name)] for name in set(a['apk_packages'])|set(b['apk_packages']) if a['apk_packages'].get(name)!=b['apk_packages'].get(name)} + if changed!={'zlib':['1.3.2-r0','1.3.2-r1']}:raise ValueError('not exact zlib-only delta') + if b['policy_sha256']!='9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62' or b['uid']!=10001 or b['gid']!=10001 or b['policy_uid']!=0 or b['policy_mode']!='0o644':raise ValueError('purpose/identity differs') + if b['compression_vectors_pass']!=4 or b['malformed_zlib_refusals']!=3 or b['crypto_jwt_waitress_smoke'] is not True:raise ValueError('backend smoke differs') + if b['database_opened'] is not False or b['network_accessed'] is not False or b['provider_or_customer_data_used'] is not False:raise ValueError('unbounded smoke scope') + return {'zlib_only_delta':True,'app_files_identical':len(b['app_file_sha256']),'no_database_or_provider':True} + +if __name__=='__main__': + try:print(json.dumps(compare(json.loads(sys.argv[1]),json.loads(sys.argv[2])))) + except Exception:raise SystemExit('bounded runtime comparison refused') from None diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py new file mode 100644 index 0000000..ae5a917 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py @@ -0,0 +1,32 @@ +import copy,importlib.util,json,tempfile,unittest,shutil +from pathlib import Path +ROOT=Path(__file__).parent +spec=importlib.util.spec_from_file_location('compare',ROOT/'compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp) +spec=importlib.util.spec_from_file_location('inputs',ROOT/'check_build_inputs.py');inputs=importlib.util.module_from_spec(spec);spec.loader.exec_module(inputs) +CASE=ROOT.parents[1]/'docs/evidence/2026-10-11-zlib-remediation-candidate' +class NarrowCandidate(unittest.TestCase): + def test_actual_single_package_delta(self): + a=json.loads((CASE/'base-runtime.json').read_text());b=json.loads((CASE/'candidate-runtime.json').read_text());self.assertTrue(cmp.compare(a,b)['zlib_only_delta']) + def test_unrelated_package_policy_identity_backend_database_python_refuse(self): + a=json.loads((CASE/'base-runtime.json').read_text());original=json.loads((CASE/'candidate-runtime.json').read_text()) + for field in ('package','policy','uid','backend','database','python'): + b=copy.deepcopy(original) + if field=='package':b['apk_packages']['musl']='different' + elif field=='policy':b['policy_sha256']='0'*64 + elif field=='uid':b['uid']=0 + elif field=='backend':b['malformed_zlib_refusals']=0 + elif field=='database':b['database_opened']=True + else:b['python_dependencies']['PyJWT']='different' + with self.subTest(field=field),self.assertRaises(ValueError):cmp.compare(a,b) + def test_mutated_package_or_index_refuse(self): + source=ROOT.parents[1]/'deploy/zlib-overlay' + for name in ('zlib-1.3.2-r1.apk','APKINDEX.tar.gz'): + with tempfile.TemporaryDirectory() as directory: + root=Path(directory)/'context';shutil.copytree(source,root);p=root/name;p.write_bytes(p.read_bytes()+b'changed') + with self.assertRaises(ValueError):inputs.verify(root) + def test_closed_recipe(self): + source=ROOT.parents[1]/'deploy/zlib-overlay';self.assertEqual(inputs.verify(source)['input_files'],4) + text=(source/'Containerfile').read_text() + for fragment in ('--no-preupgrade','--no-logfile','--no-network','--repositories-file /dev/null','--repository /tmp/infd-zlib zlib'):self.assertIn(fragment,text) + self.assertNotIn('--allow-untrusted',text) +if __name__=='__main__':unittest.main() diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md new file mode 100644 index 0000000..e16ecce --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md @@ -0,0 +1,188 @@ +--- +id: INFD-WP-0009 +type: workplan +title: "Repair lifecycle consumer pin after Access Engine v2 policy release" +domain: infotech +repo: informed-decision +status: active +owner: codex +topic_slug: netkingdom +created: "2026-10-10" +updated: "2026-10-11" +flavor: implementation +depends_on: [] +related: + - FLEX-WP-0035 + - INFD-WP-0007 +state_hub_workstream_id: "77eaeabf-0644-595f-b3d5-1168e6a294c4" +--- + +## Diagnose and prepare exact config repair + +```task +id: INFD-WP-0009-T01 +status: done +priority: high +state_hub_task_id: "5c30c308-8fe2-5956-b0c1-66c80bcb07e9" +``` + +Native State Hub lifecycle submission returns HTTP 503 `invalid_decision`. +The service remains Ready but its configured lifecycle package is v1/cee6a79; +Access Engine lifecycle provider now runs v2/da01e045 after FLEX-WP-0035. +The envelope contract remains `flex-auth.decision-record.v1`; this is a policy +pin mismatch, not an envelope compatibility migration. Keep exact package, +version and digest enforcement. Source preparation and regression evidence are +in `docs/evidence/2026-10-10-lifecycle-consumer-pin-repair.md`. + +## Release and verify the config-only repair + +```task +id: INFD-WP-0009-T02 +status: done +priority: high +needs_human: false +state_hub_task_id: "1e6684d7-7676-5c70-b701-9dad124b4f07" +``` + +Apply only the reviewed immutable runtime ConfigMap and Deployment reference +through the existing owner GitOps path after exact scoped supervisor approval. +Image, schema, credentials, audience and review policy remain pinned. Retain +server dry-run/diff, readiness and native State Hub register/publish receipts; +retry with stable write keys, do not infer success from readiness. Root agent +owns live evidence and approval recording. This is a repair of the shipped +initial lifecycle, separate from INFD-WP-0008 expansion. + +**Verified 2026-10-11:** founder approved exact config-only revision +`7db8485ffecdebfabd77a9daec085553c74bf0bf`. Manual Argo Application operation +synced only `informed-decision-runtime-6c221878d051` and Deployment, prune false. +Application Succeeded/Healthy; generation24 observed24 Ready1; `/readyz`200; +consumer v2/da01e045 and unchanged image7f5c6cb verified. Native lifecycle +registration and publication succeeded (events28/29). A later review request +rejected packet validation; this separate caller error does not undo verified +authoring. Custodian evidence records original approval, execution and rollback: +`docs/evidence/2026-10-10-security-consolidation/infd-pin-repair-preflight.json`. + +## Explicitly reject advisory purpose at consumer boundary + +```task +id: INFD-WP-0009-T03 +status: done +priority: medium +state_hub_task_id: "ee798d7d-5e60-5247-9c9b-285a7f65cf11" +``` + +PolicyClient now validates binding purpose: absent or exact empty string only; +readback and malformed purposes are refused. Nine purpose variants and a real +provider response contamination test preserve the binding, pin, expiry and +obligations gates. This task covers source implementation and regression tests. +At source implementation time the runtime image lacked this patch. Service build/native release belongs +to T04, separate from the config-only T02 repair. + + +## Release the advisory-purpose source correction + +```task +id: INFD-WP-0009-T04 +status: done +priority: medium +state_hub_task_id: "0e1bb868-7bc2-5d4d-953c-e0edaf660ad0" +``` + +Build and scan a new service image including T03, retain provenance and backup +compatibility evidence, prepare a separate scoped image proposal, and verify +native binding/refusal after the owner's approved release. Do not fold an image +change into the config-only T02 proposal. The pre-release runtime baseline was exact7f5c6cb. + +**Historical local preparation 2026-10-11:** narrow single-module image overlay on immutable running +7f5c6cb; exact source policy SHA-256 9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62. +Local image/index b8b58944786015a5375304241c149d1dab885eb539d6d8945f56b01a3c2bc821 +is built and retained, unpublished and undeployed. Base layer prefix and runtime +configuration are preserved; installed-image 10 purpose variants pass; 13 +container checks include restart and synthetic consistent backup/restore. A +fresh Trivy database scan has zero HIGH/CRITICAL findings, with its Alpine EOL +warning retained. See `docs/evidence/2026-10-11-purpose-hardening/README.md`. +Remaining gates: source-bound registry publication and exact digest verification, +fresh native snapshot/restore compatibility, owner GitOps server dry-run/diff, +separate scoped supervisor approval and native post-release binding/refusal. +No release approval or actual production-data restore is inferred from fixtures. + +**Publication and release preparation 2026-10-11:** actual owner CI +task11484/run3 succeeds at source3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168, +publishing immutable image763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a. +The failed run1/f66 and run2/ace are retained as refinements in the same trial. +Anonymous registry readback proves all8base compressed blobs/rootfs unchanged +plus only policy.py; legacy media-type/default-config serialization differences +are explicit. Pulled published artifact UID10001/GID10001, installed mode0644 +and exactpolicy hash, all10purpose forms pass. Full pinned scanner/DB covers +44packages: 0HIGH/CRITICAL, 1fixableMEDIUM CVE-2026-85091 in zlib1.3.2-r0, +identical actual current-base scan. This is not a zero-CVE release or estate +risk grade. T05 and INFD-RISK-20261011-ZLIB-85091 are live owner follow-through. + +The exact separate20document informed-decision packet is prepared and +offline typed/intake validated, with no submission or founder disposition +claimed. Source candidates differ solely in Deploymentimage and retain +ConfigMap6c221878d051/schema5/PVC/identity/policy pins. Fresh read-only +serverdryrun/clientdiff pass with sealedUID/fullconfiguration and actualCM/PVC +UID/contentchecksum/boundvolume custody; optimizedinterpreters refused. +Independent review refinement requires stdlib mode=ro schema5/integrity/count +checks before any native/offline admin/Store open (native gate notexecuted); existingmanual +Argo remains Healthy/OutOfSync at7db8485, not whole-app reconciled. +Remaining gates: independent owner review, actual founder native approval, +fresh protected native consistent snapshot/off-cluster custody/offline restore, +refresh preflight, exact owner-source pin/Deployment-only manual sync and +verified native installed purpose/refusal/lifecycle behavior. Synthetic native +placement checks are not new provider authorization evidence. Runtime remains7f5c. + +Evidence: `docs/evidence/2026-10-11-purpose-image-release/`. + +**Actual approved release and independent verification, 2026-10-11:** source +c96b0c6d881e855d1d158003c6de90ef390262e2, fresh version2 founder acceptance, +existing-snapshot rescue, isolated actual-data compatibility and disposable +cleanup, fresh cutover backup/private exact copy, and Deployment-only manual +image763c release are evidenced. Independent read-only reconciliation confirms +Ready generation25, exact image/module/config/PVC/controlled Pod, UID/GID10001, +schema5/integrity and preserved live counts16records/56events/0pending, +336delivered/43confirmed; healthz/readyz200. Authenticated actual lifecycle.outcomes +readback at07:01:37 after Ready07:00:42 traverses installed canonical PDP gates. +Installed ten purpose fixtures (two canonical allows/eight refusals) are synthetic, +not provider advisory responses. The separate denial probe remains unexecuted. +This satisfies the bounded T04 release/consumer verification, without declaring +full emission guarantee, all human MFA or a zero-CVE image. Earlier preparation +gates above are historical. Original failed drill-copy and final verifier +UNCERTAIN remain immutable; no failed phase replay/helper amendment or scored +new trial. Argo omitted false prune is independently reconciled to exact approved +non-pruning operation; future verifier defect is live unpromoted INFD-IN-0010. +T05 remains todo/due2026-10-18, so WP0009 remains active. +Review/evidence: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md +and docs/evidence/2026-10-11-purpose-native-acceptance/. + +## Resolve inherited published-image zlib finding + +```task +id: INFD-WP-0009-T05 +status: progress +priority: medium +state_hub_task_id: "1743596f-8558-5a6b-afef-4dd5c1e9c0ae" +``` + +Owner follow-through `INFD-RISK-20261011-ZLIB-85091` tracks actual published +base and purpose-overlay scan finding CVE-2026-85091: zlib 1.3.2-r0, fixed +1.3.2-r1, scanner MEDIUM; this is not an estate risk grade. Prepare and verify a +separate source-bound base/dependency refresh, then obtain distinct native +release approval before changing the workload. Review due 2026-10-18; the date +is a manual owner follow-up, with no automatic expiry/rollback controller. +T04 cannot be treated as a zero-CVE release or silently include the base fix. +Preserve the original detection, pending founder disposition and remediation +evidence. Close only after actual installed-package proof and full rescan. + +Evidence: `docs/evidence/2026-10-11-purpose-image-release/inherited-vulnerability-follow-through.json`. + +2026-10-11 — T05 bounded zlib-only source candidate preparation: +Exactcurrent763base andsignedofficialr1/packageindex buildoffline. Actual44package +fullscan sameDB baseline1MEDCVE85091→localcandidate0allseverity. Finalfilesystem +deltaonlylibz+APKdb;36appfiles/policy9d/world/keys/Python/runtime unchanged. +Localcandidate is unpublished/unapproved;4sourcenegative tests+actualbackend +and10purpose checks pass. Source/evidence:docs/evidence/2026-10-11-zlib-remediation-candidate/. +T05progress/planactive:actualownerCIpublishedprovenance/fullscan/SBOM,distinctnative +founderreleaseapproval andactualinstalledr1/runtime/fullrescan still required. +NoT04/nativec96/helper/journal/DB/ConfigMap/PVC/identity/policy changes. diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/README.md b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/README.md new file mode 100644 index 0000000..6e251f2 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/README.md @@ -0,0 +1,13 @@ +# Separate T05 zlib-only candidate — local verified, unpublished/unapproved + +Exact current purpose image763c is the base. Signed official Alpine3.24/main/x86_64 zlib1.3.2-r1 and APKINDEX are preserved as exact public source artifacts in deploy/zlib-overlay with their HTTPS origin/SHA/packagecommit/signature metadata. Both actually verified against base trusted keys. The offline named-package upgrade uses only that repository, disables preupgrade/network/logging, restoresUID10001 and removes temporarypublic artifacts. Only final libz binary and APK installeddatabase differ; world/repository/keys/app36files/Python/OpenSSL/policy9d remain unchanged. Raw Docker legacy/OCI default serialization differs; effective runtime config is proved equal, not byte-identical. + +Local daemonimageID78bfdcc... differs from Docker-save OCIconfig625d... after serialization; both are explicitly identified in receipt. Neither is a registry/release digest. Localfull sameDB scan covers44packages: baseactual1MEDCVE85091, candidatezeroallseverity; fullbaseline/candidateJSON+CycloneDX and filesystemaudit retained. Alpine3.24 EOLlistwarning/detection coverage is disclosed. No filters/ignoreunfixed or estateRiskgrade. Four source tests include eight unrelatedpackage/source/identity/backend/database/Python/artifactmutation refusals; actualcompression/crypto/JWT/waitress andteninstalledpurpose variants pass. Purpose providertransport remains synthetic, no database/provider/customerdata accessed. + +Four-file sourcecontext hashc554e62a... is actualbuiltinput; localOCIrevision is honestly uncommitted preparation. New sourceworkflow uses exact GITHUB_SHA/archive/four inputhashes and existing admitted ownerregistry capability; no newPAT/login/grant. It publishes only a candidate with installedpackage/appidentity/purpose guards. CIpublication has NOT run. Root must commit/source-sync thenverifyactualregistry/nativeCI provenance and fullscan/SBOM before any new release question. Do notpin a localimageID in owneradmission/servicevalues. + +T05 staysprogress/planactive, manualfollowupdueOct18 withoutautotimer. T04/nativec96/protectedjournals/snapshotcustody/helpers/current763deployment remain untouched. Only after actualpublishedproof, exact scopedfounderapproval andnativeinstalledr1/runtime/fullrescan canT05 close. Futureimage-onlyrollbackkeepslatestDB and prior763, neverrestoresoldrecords. See proposal.json/local-candidate-verification.json for exactproofs/refinementlimits. + +Platform audit refinement (same T05 proposal): the checker now refuses optimized Python before artifact reads and compares directory mode, UID and GID. The actual existing image passed the expanded audit with no directory changes and the same two changed files. Three synthetic tests cover optimization and three directory drift cases. Original 27-file source/manifest and actual scan receipts are retained in `initial-8d345bb2/`; this was a source guard correction, not an original candidate failure. Recipe, four-file build context, image78 and full scan bytes are unchanged. + +Whiteout refinement: preserve the leading dot in OCI whiteout names and model root/nested removal and opaque directories. Four semantic fixtures pass. Actual image re-audit still reports 313 unchanged directories and only the same two changed files. Intermediate 64509029 manifest and changed evidence bytes are retained separately; the existing candidate did not fail. diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/archive-map.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/archive-map.json new file mode 100644 index 0000000..f491804 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/archive-map.json @@ -0,0 +1,30 @@ +{ + "original_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0", + "retained_changed_evidence": [ + { + "path": "verify_local_artifacts.py", + "sha256": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41" + }, + { + "path": "test_artifact_audit.py", + "sha256": "8635859fb63f8778e48ae4f3532e6fc37eb1fbc289801ec5b68b8a90bb6fc364" + }, + { + "path": "artifact-comparison.json", + "sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89" + }, + { + "path": "local-candidate-verification.json", + "sha256": "51505fa91e8d498c2eb3814442e89b01621290f1b39da08a5f460f6f6f9f112c" + }, + { + "path": "audit-refinement.json", + "sha256": "de852da5990326642e0c0d15ed74ab21513b4227c5634ba7146568876e750c6a" + }, + { + "path": "README.md", + "sha256": "c999a0c326a95e74082258851a5c4669395937a8fed95927f114ff08a18e0d6b" + } + ], + "other_bytes": "Unchanged current source and prior source archives" +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/artifact-comparison.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/artifact-comparison.json new file mode 100644 index 0000000..c99f1fb --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/artifact-comparison.json @@ -0,0 +1,75 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "directory_metadata_compared": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false, + "candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "candidate_local_image_config_id_kind": "Docker-save OCI export config SHA; distinct from legacy daemon imageID; closed default serialization differs." +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/audit-refinement.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/audit-refinement.json new file mode 100644 index 0000000..07f9d35 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/audit-refinement.json @@ -0,0 +1,24 @@ +{ + "proposal_id": "INFD-WP-0009-T05/zlib-85091-r1", + "same_trial": true, + "original_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "original_local_verification_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1", + "reason": "Platform source-review guard gaps; original actual candidate/build/scan did not fail", + "changes": [ + "Explicit optimized Python refusal before any archive/JSON read", + "Filesystem audit includes final directory mode/UID/GID metadata", + "Three synthetic tests: optimized malformed artifact refuses before read; unchanged directory passes; mode/UID/GID mutation refuses", + "Preserve OCI whiteout leading dots and clear root/nested descendants correctly; four semantic fixtures cover removal and opacity" + ], + "actual_existing_artifact_reaudit": "Passed; no directory metadata differences, same two changed files", + "candidate_image_unchanged": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "four_file_build_context_unchanged": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "registry_publication": false, + "native_changes": false, + "checker_sha256": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41", + "tests_sha256": "8635859fb63f8778e48ae4f3532e6fc37eb1fbc289801ec5b68b8a90bb6fc364", + "comparison_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89", + "verification_sha256": "51505fa91e8d498c2eb3814442e89b01621290f1b39da08a5f460f6f6f9f112c", + "intermediate_source_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8", + "whiteout_refinement_note": "Conservative incorrect effective-rootfs modeling in the intermediate checker, not failure of the actual candidate" +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/local-candidate-verification.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/local-candidate-verification.json new file mode 100644 index 0000000..894f88e --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/local-candidate-verification.json @@ -0,0 +1,111 @@ +{ + "task_id": "INFD-WP-0009-T05", + "risk_record": "INFD-RISK-20261011-ZLIB-85091", + "state": "local-source-candidate-verified-unpublished-unapproved", + "base_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "candidate_saved_oci_config_digest": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "source_revision": "uncommitted-T05-local-preparation", + "source_context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "build_inputs": { + ".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a", + "Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15", + "zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + "official_downloads": { + "zlib-1.3.2-r1.apk": { + "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk", + "sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "bytes": 56210 + }, + "APKINDEX.tar.gz": { + "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz", + "sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5", + "bytes": 528370 + } + }, + "signature_verification": "Actual apk verify package+index returned OK against keys installed in exact763 base; no allow-untrusted", + "package_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "official_aports_commit": "0afa2da0e8c8051c6f8f64a7a388e5a259904245", + "final_files_changed": [ + "lib/apk/db/installed", + "usr/lib/libz.so.1.3.2" + ], + "base_layers_preserved": 9, + "effective_runtime_configuration_unchanged": true, + "raw_config_serialization_unchanged": false, + "serialization_caveat": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "app_files_unchanged": 36, + "policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", + "installed_purpose_variants_pass": 10, + "purpose_transport_synthetic": true, + "native_provider_test": false, + "compression_vectors_pass": 4, + "malformed_zlib_refusals": 3, + "crypto_jwt_waitress_smoke": true, + "source_negative_tests": 4, + "source_negative_mutations": 8, + "full_sbom_package_count": 44, + "baseline_full_scan_findings": { + "MEDIUM": 1, + "id": "CVE-2026-85091" + }, + "candidate_full_scan_allseverity_findings": 0, + "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 v0.74", + "scanner_db_metadata": { + "Version": 2, + "NextUpdate": "2026-10-11T18:59:50.889010572Z", + "UpdatedAt": "2026-10-10T18:59:50.889010923Z", + "DownloadedAt": "2026-10-10T23:32:32.380033131Z" + }, + "scanner_db_sha256": "03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917", + "scan_caveat": "Alpine3.24 absent EOL list warning; actual OS detector ran38OS+6Python. Zero findings is this DB snapshot, not unknown-future vulnerability assurance or estate risk grade.", + "suppression_or_severity_filter": false, + "evidence_file_sha256": { + "artifact-comparison.json": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89", + "base-runtime.json": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24", + "base-sbom.cdx.json": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50", + "base-trivy-full.json": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6", + "candidate-image-inspect.json": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de", + "candidate-runtime.json": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124", + "context-source.json": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828", + "download-receipt.json": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d", + "official-zlib-index-entry.txt": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a", + "official-zlib-package-info.txt": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a", + "sbom.cdx.json": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb", + "trivy-full.json": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9", + "verify_local_artifacts.py": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41", + "test_artifact_audit.py": "8635859fb63f8778e48ae4f3532e6fc37eb1fbc289801ec5b68b8a90bb6fc364" + }, + "local_saved_image_tar_sha256": "0142526048de5662b4afc1ff7b82b5bf4554642ff811e29f364082e5de9be075", + "local_saved_image_tar_owner_attachment": false, + "build_resource_bound": "legacy builder --network none,256MiB/oneCPU; runtime128MiB/oneCPU; scanner1GiB/oneCPU", + "native_runtime_or_database_or_customer_data_or_credentials_accessed": false, + "native_backup_or_rollout": false, + "owner_source_edits_or_push": false, + "registry_publication_executed": false, + "founder_release_approval": false, + "workflow_yaml_and_bash_syntax": "passed, exact SHA/fixedowner context and admittedexistingregistry capability; CIactualbuild not executed", + "local_refinements_retained": [ + "Initial build --cpus flag unavailable in buildx; switched to explicit existinglegacy builder boundedquota", + "APK preupgrade=false argument refused; corrected no-preupgrade flag", + "Filesystem check found apk.log metadata delta; no-logfile confines finaldiff to twofiles", + "One intermediate local build context accidentally included public scan cache/export artifacts1.529GB; corrected separate4file context and .dockerignore(finaltransfer589.8kB); no secrets/native data involved", + "Read-only cache copy tried inaccessible priorfanal; isolated DB-only copy exactSHA03cacb... used; no ownership/permission loosening" + ], + "directory_metadata_compared": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "artifact_audit_regression_tests": 4, + "artifact_audit_negative_cases": 4, + "initial_source_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "whiteout_semantic_cases": 4 +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/original-manifest.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/original-manifest.json new file mode 100644 index 0000000..19bf3a4 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/original-manifest.json @@ -0,0 +1,464 @@ +[ + { + "repo": "informed-decision", + "path": ".forgejo/workflows/zlib-overlay-image.yaml", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml", + "original_sha256": null, + "staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/.dockerignore", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore", + "original_sha256": null, + "staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/APKINDEX.tar.gz", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz", + "original_sha256": null, + "staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/Containerfile", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile", + "original_sha256": null, + "staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/pins.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json", + "original_sha256": null, + "staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "original_sha256": null, + "staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "original_sha256": null, + "staged_sha256": "c999a0c326a95e74082258851a5c4669395937a8fed95927f114ff08a18e0d6b" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json", + "original_sha256": null, + "staged_sha256": "de852da5990326642e0c0d15ed74ab21513b4227c5634ba7146568876e750c6a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "original_sha256": null, + "staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "original_sha256": null, + "staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "original_sha256": null, + "staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "original_sha256": null, + "staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "original_sha256": null, + "staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "original_sha256": null, + "staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json", + "original_sha256": null, + "staged_sha256": "91384b270c0462223af1ff66e3ca75db5fce692c56c6bde6df435e6a2a079c5e" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json", + "original_sha256": null, + "staged_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml", + "original_sha256": null, + "staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore", + "original_sha256": null, + "staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz", + "original_sha256": null, + "staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile", + "original_sha256": null, + "staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json", + "original_sha256": null, + "staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "original_sha256": null, + "staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "original_sha256": null, + "staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "original_sha256": null, + "staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "original_sha256": null, + "staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "original_sha256": null, + "staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "original_sha256": null, + "staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "original_sha256": null, + "staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "original_sha256": null, + "staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "original_sha256": null, + "staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "original_sha256": null, + "staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "original_sha256": null, + "staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "original_sha256": null, + "staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "original_sha256": null, + "staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py", + "original_sha256": null, + "staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py", + "original_sha256": null, + "staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py", + "original_sha256": null, + "staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py", + "original_sha256": null, + "staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "original_sha256": null, + "staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md", + "original_sha256": null, + "staged_sha256": "4d0b0ed0b41f2098adfa2e626c641360855cd0e717bbd2d7a6c155cee2ae91ec" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json", + "original_sha256": null, + "staged_sha256": "3e81c1cedb2e3b25d83a779011898181a7860ff76532ede5fa3e9b8f63632700" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json", + "original_sha256": null, + "staged_sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json", + "original_sha256": null, + "staged_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json", + "original_sha256": null, + "staged_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py", + "original_sha256": null, + "staged_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "original_sha256": null, + "staged_sha256": "51505fa91e8d498c2eb3814442e89b01621290f1b39da08a5f460f6f6f9f112c" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "original_sha256": null, + "staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "original_sha256": null, + "staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "original_sha256": null, + "staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py", + "original_sha256": null, + "staged_sha256": "8635859fb63f8778e48ae4f3532e6fc37eb1fbc289801ec5b68b8a90bb6fc364" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "original_sha256": null, + "staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "08805c1e23f88626bc5e80cf7d9547af4149547bd091d02cb32ad1bd18820f41" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/check_build_inputs.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py", + "original_sha256": null, + "staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/check_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py", + "original_sha256": null, + "staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/compare_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py", + "original_sha256": null, + "staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/test_candidate.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py", + "original_sha256": null, + "staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9" + }, + { + "repo": "informed-decision", + "path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223", + "staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4" + } +] diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/test_artifact_audit.py b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/test_artifact_audit.py new file mode 100644 index 0000000..df4e82c --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/test_artifact_audit.py @@ -0,0 +1,63 @@ +"""Synthetic artifact boundaries; never access owner/native databases.""" +from pathlib import Path +import io,json,subprocess,sys,tarfile,tempfile,unittest +CHECKER=Path(__file__).with_name('verify_local_artifacts.py') +def add(t,name,data=None,metadata=(0o755,0,0)): + m=tarfile.TarInfo(name);m.mode,m.uid,m.gid=metadata + if data is None:m.type=tarfile.DIRTYPE;t.addfile(m) + else:m.size=len(data);t.addfile(m,io.BytesIO(data)) +def archive(path,layers,ids): + with tarfile.open(path,'w') as t: + add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':[f'{i}.tar' for i in range(len(layers))]}]).encode()) + add(t,'config.json',json.dumps({'rootfs':{'diff_ids':ids},'config':{}}).encode()) + for i,data in enumerate(layers):add(t,f'{i}.tar',data) +def layer(metadata): + b=io.BytesIO() + with tarfile.open(fileobj=b,mode='w') as t:add(t,'usr',metadata=metadata) + return b.getvalue() +def fixture(root,metadata=(0o755,0,0)): + base=layer((0o755,0,0));candidate=layer(metadata) + archive(root/'base-image.tar',[base],['base']) + archive(root/'image.tar',[base,candidate,layer(metadata)],['base','overlay','cleanup']) + for name,version in [('base-sbom.cdx.json','1.3.2-r0'),('sbom.cdx.json','1.3.2-r1')]: + (root/name).write_text(json.dumps({'components':[{'name':'zlib','version':version,'purl':'pkg:apk/zlib'}]})) + for name,findings in [('base-trivy-full.json',[{'VulnerabilityID':'CVE-2026-85091','Severity':'MEDIUM'}]),('trivy-full.json',[])]: + (root/name).write_text(json.dumps({'Results':[{'Vulnerabilities':findings}]})) +class ArtifactAuditTests(unittest.TestCase): + def execute(self,root,optimize=False): + return subprocess.run([sys.executable,*(['-O'] if optimize else []),str(CHECKER),str(root)],capture_output=True,text=True) + def test_optimized_tampered_artifacts_refused_before_read(self): + with tempfile.TemporaryDirectory() as tmp: + root=Path(tmp);(root/'base-image.tar').write_bytes(b'tampered not an archive') + r=self.execute(root,True) + self.assertNotEqual(r.returncode,0);self.assertIn('REFUSED: optimized Python',r.stderr) + self.assertNotIn('ReadError',r.stderr);self.assertFalse((root/'artifact-comparison.json').exists()) + def test_matching_directory_metadata_passes(self): + with tempfile.TemporaryDirectory() as tmp: + root=Path(tmp);fixture(root);r=self.execute(root) + self.assertEqual(r.returncode,0,r.stderr) + proof=json.loads((root/'artifact-comparison.json').read_text()) + self.assertTrue(proof['directory_metadata_compared']);self.assertEqual(proof['directory_metadata_delta'],{}) + def test_directory_mode_uid_gid_drift_refuses(self): + for metadata in [(0o777,0,0),(0o755,10001,0),(0o755,0,10001)]: + with self.subTest(metadata=metadata),tempfile.TemporaryDirectory() as tmp: + root=Path(tmp);fixture(root,metadata);r=self.execute(root) + self.assertNotEqual(r.returncode,0);self.assertIn("{'usr'}",r.stderr) + self.assertFalse((root/'artifact-comparison.json').exists()) + def test_root_and_nested_whiteout_semantics(self): + # Extract only the archive reader definition: the full CLI proof is tested above. + import ast + tree=ast.parse(CHECKER.read_text());function=next(n for n in tree.body if isinstance(n,ast.FunctionDef) and n.name=='image') + namespace={'Path':Path,'tarfile':tarfile,'json':json,'hashlib':__import__('hashlib')} + exec(compile(ast.Module(body=[function],type_ignores=[]),'reader','exec'),namespace) + for marker,expected in [('.wh.usr',set()),('usr/.wh.child',{'usr'}),('usr/.wh..wh..opq',{'usr'}),('.wh..wh..opq',set())]: + with self.subTest(marker=marker),tempfile.TemporaryDirectory() as tmp: + before=io.BytesIO() + with tarfile.open(fileobj=before,mode='w') as t: + add(t,'usr');add(t,'usr/child');add(t,'usr/child/file',b'original') + after=io.BytesIO() + with tarfile.open(fileobj=after,mode='w') as t:add(t,'./'+marker,b'') + path=Path(tmp)/'image.tar';archive(path,[before.getvalue(),after.getvalue()],['base','overlay']) + _,_,files=namespace['image'](path) + self.assertEqual(set(files),expected) +if __name__=='__main__':unittest.main() diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/verify_local_artifacts.py b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/verify_local_artifacts.py new file mode 100644 index 0000000..5973303 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-3e41ab39/verify_local_artifacts.py @@ -0,0 +1,52 @@ +from pathlib import Path +import hashlib,io,json,tarfile,sys +if sys.flags.optimize: + raise SystemExit("REFUSED: optimized Python disables required artifact validation") +root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build') +def image(path): + with tarfile.open(path) as archive: + manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1 + configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes) + files={} + for name in manifest[0]['Layers']: + with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer: + for member in layer: + path=member.name + while path.startswith('./'):path=path[2:] + path=path.lstrip('/');p=Path(path) + if p.name=='.wh..wh..opq': + folder=p.parent.as_posix();prefix='' if folder=='.' else folder+'/' + files={key:value for key,value in files.items() if not key.startswith(prefix)};continue + if p.name.startswith('.wh.'): + removed=(p.parent/p.name[4:]).as_posix();files={key:value for key,value in files.items() if key!=removed and not key.startswith(removed+'/')};continue + if member.isfile(): + data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest()) + elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None) + elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname) + else:continue + files[path]=value + return config,hashlib.sha256(configbytes).hexdigest(),files +base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar') +assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids'] +changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)} +expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +assert set(changed)<=expected,set(changed) +a,b=base['config'].copy(),candidate['config'].copy() +labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{}) +a.pop('Image',None);b.pop('Image',None) +defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None} +for key,value in defaults.items(): + a.setdefault(key,value);b.setdefault(key,value) +assert a==b,(a,b) +components=[] +for name in ['base-sbom.cdx.json','sbom.cdx.json']: + data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')}) +sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)} +assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta +vulns=[] +for name in ['base-trivy-full.json','trivy-full.json']: + data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])]) +assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM' +assert not vulns[1] +proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False} +(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed))) diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md new file mode 100644 index 0000000..b47535b --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/README.md @@ -0,0 +1,11 @@ +# Separate T05 zlib-only candidate — local verified, unpublished/unapproved + +Exact current purpose image763c is the base. Signed official Alpine3.24/main/x86_64 zlib1.3.2-r1 and APKINDEX are preserved as exact public source artifacts in deploy/zlib-overlay with their HTTPS origin/SHA/packagecommit/signature metadata. Both actually verified against base trusted keys. The offline named-package upgrade uses only that repository, disables preupgrade/network/logging, restoresUID10001 and removes temporarypublic artifacts. Only final libz binary and APK installeddatabase differ; world/repository/keys/app36files/Python/OpenSSL/policy9d remain unchanged. Raw Docker legacy/OCI default serialization differs; effective runtime config is proved equal, not byte-identical. + +Local daemonimageID78bfdcc... differs from Docker-save OCIconfig625d... after serialization; both are explicitly identified in receipt. Neither is a registry/release digest. Localfull sameDB scan covers44packages: baseactual1MEDCVE85091, candidatezeroallseverity; fullbaseline/candidateJSON+CycloneDX and filesystemaudit retained. Alpine3.24 EOLlistwarning/detection coverage is disclosed. No filters/ignoreunfixed or estateRiskgrade. Four source tests include eight unrelatedpackage/source/identity/backend/database/Python/artifactmutation refusals; actualcompression/crypto/JWT/waitress andteninstalledpurpose variants pass. Purpose providertransport remains synthetic, no database/provider/customerdata accessed. + +Four-file sourcecontext hashc554e62a... is actualbuiltinput; localOCIrevision is honestly uncommitted preparation. New sourceworkflow uses exact GITHUB_SHA/archive/four inputhashes and existing admitted ownerregistry capability; no newPAT/login/grant. It publishes only a candidate with installedpackage/appidentity/purpose guards. CIpublication has NOT run. Root must commit/source-sync thenverifyactualregistry/nativeCI provenance and fullscan/SBOM before any new release question. Do notpin a localimageID in owneradmission/servicevalues. + +T05 staysprogress/planactive, manualfollowupdueOct18 withoutautotimer. T04/nativec96/protectedjournals/snapshotcustody/helpers/current763deployment remain untouched. Only after actualpublishedproof, exact scopedfounderapproval andnativeinstalledr1/runtime/fullrescan canT05 close. Futureimage-onlyrollbackkeepslatestDB and prior763, neverrestoresoldrecords. See proposal.json/local-candidate-verification.json for exactproofs/refinementlimits. + +Platform audit refinement (same T05 proposal): the checker now refuses optimized Python before artifact reads and compares directory mode, UID and GID. The actual existing image passed the expanded audit with no directory changes and the same two changed files. Three synthetic tests cover optimization and three directory drift cases. Original 27-file source/manifest and actual scan receipts are retained in `initial-8d345bb2/`; this was a source guard correction, not an original candidate failure. Recipe, four-file build context, image78 and full scan bytes are unchanged. diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json new file mode 100644 index 0000000..d7d8965 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/archive-map.json @@ -0,0 +1,30 @@ +{ + "original_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8", + "retained_changed_evidence": [ + { + "path": "verify_local_artifacts.py", + "sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794" + }, + { + "path": "test_artifact_audit.py", + "sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71" + }, + { + "path": "artifact-comparison.json", + "sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89" + }, + { + "path": "local-candidate-verification.json", + "sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92" + }, + { + "path": "audit-refinement.json", + "sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f" + }, + { + "path": "README.md", + "sha256": "4d0b0ed0b41f2098adfa2e626c641360855cd0e717bbd2d7a6c155cee2ae91ec" + } + ], + "other_original_bytes_retained_at": "initial-8d345bb2/owner-snapshot; unchanged paths also remain at current source paths" +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json new file mode 100644 index 0000000..c99f1fb --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/artifact-comparison.json @@ -0,0 +1,75 @@ +{ + "base_image_config_id": "sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779", + "candidate_local_image_config_id": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "base_layers_preserved": 9, + "new_layers": 2, + "effective_runtime_config_identical": true, + "raw_config_bytes_identical": false, + "serialization_note": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "labels_before": { + "org.opencontainers.image.base.digest": "sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173", + "org.opencontainers.image.revision": "3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168", + "social.coulomb.release.scope": "INFD-WP-0009-T04/purpose-overlay-v1", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "labels_after": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "final_changed_files": { + "lib/apk/db/installed": { + "before": [ + "file", + 420, + 0, + 0, + "6383ea3806247e8dbf9ebee8cb30eb8eca63a8ea59662a793127d6a61b988d70" + ], + "after": [ + "file", + 420, + 0, + 0, + "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001" + ] + }, + "usr/lib/libz.so.1.3.2": { + "before": [ + "file", + 493, + 0, + 0, + "a1e2c03dcdedba98a06a00cadfb67a0e0b1cd93986860ec0c5ce66e789c44e57" + ], + "after": [ + "file", + 493, + 0, + 0, + "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + ] + } + }, + "directory_metadata_compared": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "sbom_package_count_base": 44, + "sbom_package_count_candidate": 44, + "sbom_only_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "full_scan_baseline_findings": 1, + "full_scan_candidate_allseverity_findings": 0, + "db_snapshot_same": true, + "native_workload_changed": false, + "candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "candidate_local_image_config_id_kind": "Docker-save OCI export config SHA; distinct from legacy daemon imageID; closed default serialization differs." +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json new file mode 100644 index 0000000..948fb25 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/audit-refinement.json @@ -0,0 +1,21 @@ +{ + "proposal_id": "INFD-WP-0009-T05/zlib-85091-r1", + "same_trial": true, + "original_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "original_local_verification_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1", + "reason": "Platform source-review guard gaps; original actual candidate/build/scan did not fail", + "changes": [ + "Explicit optimized Python refusal before any archive/JSON read", + "Filesystem audit includes final directory mode/UID/GID metadata", + "Three synthetic tests: optimized malformed artifact refuses before read; unchanged directory passes; mode/UID/GID mutation refuses" + ], + "actual_existing_artifact_reaudit": "Passed; no directory metadata differences, same two changed files", + "candidate_image_unchanged": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "four_file_build_context_unchanged": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "registry_publication": false, + "native_changes": false, + "checker_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794", + "tests_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71", + "comparison_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89", + "verification_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92" +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json new file mode 100644 index 0000000..a5a42c8 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/local-candidate-verification.json @@ -0,0 +1,110 @@ +{ + "task_id": "INFD-WP-0009-T05", + "risk_record": "INFD-RISK-20261011-ZLIB-85091", + "state": "local-source-candidate-verified-unpublished-unapproved", + "base_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "candidate_saved_oci_config_digest": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "source_revision": "uncommitted-T05-local-preparation", + "source_context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "build_inputs": { + ".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a", + "Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15", + "zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + "official_downloads": { + "zlib-1.3.2-r1.apk": { + "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk", + "sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "bytes": 56210 + }, + "APKINDEX.tar.gz": { + "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz", + "sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5", + "bytes": 528370 + } + }, + "signature_verification": "Actual apk verify package+index returned OK against keys installed in exact763 base; no allow-untrusted", + "package_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "official_aports_commit": "0afa2da0e8c8051c6f8f64a7a388e5a259904245", + "final_files_changed": [ + "lib/apk/db/installed", + "usr/lib/libz.so.1.3.2" + ], + "base_layers_preserved": 9, + "effective_runtime_configuration_unchanged": true, + "raw_config_serialization_unchanged": false, + "serialization_caveat": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "app_files_unchanged": 36, + "policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", + "installed_purpose_variants_pass": 10, + "purpose_transport_synthetic": true, + "native_provider_test": false, + "compression_vectors_pass": 4, + "malformed_zlib_refusals": 3, + "crypto_jwt_waitress_smoke": true, + "source_negative_tests": 4, + "source_negative_mutations": 8, + "full_sbom_package_count": 44, + "baseline_full_scan_findings": { + "MEDIUM": 1, + "id": "CVE-2026-85091" + }, + "candidate_full_scan_allseverity_findings": 0, + "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 v0.74", + "scanner_db_metadata": { + "Version": 2, + "NextUpdate": "2026-10-11T18:59:50.889010572Z", + "UpdatedAt": "2026-10-10T18:59:50.889010923Z", + "DownloadedAt": "2026-10-10T23:32:32.380033131Z" + }, + "scanner_db_sha256": "03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917", + "scan_caveat": "Alpine3.24 absent EOL list warning; actual OS detector ran38OS+6Python. Zero findings is this DB snapshot, not unknown-future vulnerability assurance or estate risk grade.", + "suppression_or_severity_filter": false, + "evidence_file_sha256": { + "artifact-comparison.json": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89", + "base-runtime.json": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24", + "base-sbom.cdx.json": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50", + "base-trivy-full.json": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6", + "candidate-image-inspect.json": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de", + "candidate-runtime.json": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124", + "context-source.json": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828", + "download-receipt.json": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d", + "official-zlib-index-entry.txt": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a", + "official-zlib-package-info.txt": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a", + "sbom.cdx.json": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb", + "trivy-full.json": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9", + "verify_local_artifacts.py": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794", + "test_artifact_audit.py": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71" + }, + "local_saved_image_tar_sha256": "0142526048de5662b4afc1ff7b82b5bf4554642ff811e29f364082e5de9be075", + "local_saved_image_tar_owner_attachment": false, + "build_resource_bound": "legacy builder --network none,256MiB/oneCPU; runtime128MiB/oneCPU; scanner1GiB/oneCPU", + "native_runtime_or_database_or_customer_data_or_credentials_accessed": false, + "native_backup_or_rollout": false, + "owner_source_edits_or_push": false, + "registry_publication_executed": false, + "founder_release_approval": false, + "workflow_yaml_and_bash_syntax": "passed, exact SHA/fixedowner context and admittedexistingregistry capability; CIactualbuild not executed", + "local_refinements_retained": [ + "Initial build --cpus flag unavailable in buildx; switched to explicit existinglegacy builder boundedquota", + "APK preupgrade=false argument refused; corrected no-preupgrade flag", + "Filesystem check found apk.log metadata delta; no-logfile confines finaldiff to twofiles", + "One intermediate local build context accidentally included public scan cache/export artifacts1.529GB; corrected separate4file context and .dockerignore(finaltransfer589.8kB); no secrets/native data involved", + "Read-only cache copy tried inaccessible priorfanal; isolated DB-only copy exactSHA03cacb... used; no ownership/permission loosening" + ], + "directory_metadata_compared": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "artifact_audit_regression_tests": 3, + "artifact_audit_negative_cases": 4, + "initial_source_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66" +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json new file mode 100644 index 0000000..5c9ebd2 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/original-manifest.json @@ -0,0 +1,408 @@ +[ + { + "repo": "informed-decision", + "path": ".forgejo/workflows/zlib-overlay-image.yaml", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/.forgejo/workflows/zlib-overlay-image.yaml", + "original_sha256": null, + "staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/.dockerignore", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/.dockerignore", + "original_sha256": null, + "staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/APKINDEX.tar.gz", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/APKINDEX.tar.gz", + "original_sha256": null, + "staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/Containerfile", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/Containerfile", + "original_sha256": null, + "staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/pins.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/pins.json", + "original_sha256": null, + "staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5" + }, + { + "repo": "informed-decision", + "path": "deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "original_sha256": null, + "staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "original_sha256": null, + "staged_sha256": "4d0b0ed0b41f2098adfa2e626c641360855cd0e717bbd2d7a6c155cee2ae91ec" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/audit-refinement.json", + "original_sha256": null, + "staged_sha256": "020514b7514999699512fb338d89630e7eaf51a739e68bf77342eeefe8ad507f" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "original_sha256": null, + "staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "original_sha256": null, + "staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "original_sha256": null, + "staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "original_sha256": null, + "staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "original_sha256": null, + "staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "original_sha256": null, + "staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/archive-map.json", + "original_sha256": null, + "staged_sha256": "91384b270c0462223af1ff66e3ca75db5fce692c56c6bde6df435e6a2a079c5e" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/original-manifest.json", + "original_sha256": null, + "staged_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/.forgejo/workflows/zlib-overlay-image.yaml", + "original_sha256": null, + "staged_sha256": "789ef77c30ee55a2e4ef2b7edbe781bb2e92056ac11f5f3b9328ce0dfec38e72" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/.dockerignore", + "original_sha256": null, + "staged_sha256": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/APKINDEX.tar.gz", + "original_sha256": null, + "staged_sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/Containerfile", + "original_sha256": null, + "staged_sha256": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/pins.json", + "original_sha256": null, + "staged_sha256": "0bd2c79633030056a89ae7f055020e6398aa79d481587d4b41f0974b29dc77b5" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/deploy/zlib-overlay/zlib-1.3.2-r1.apk", + "original_sha256": null, + "staged_sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/README.md", + "original_sha256": null, + "staged_sha256": "cc53d16b5dc8375be0d5f63b1144f0a422477e3a5638c397a214275d7ea1d0cb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/artifact-comparison.json", + "original_sha256": null, + "staged_sha256": "8d84bfb20cc6c64c85b4b6fcb76d7e1113ebbfcadcd4d5c54ffb4121d73e4dfa" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-runtime.json", + "original_sha256": null, + "staged_sha256": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/base-trivy-full.json", + "original_sha256": null, + "staged_sha256": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-image-inspect.json", + "original_sha256": null, + "staged_sha256": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/candidate-runtime.json", + "original_sha256": null, + "staged_sha256": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/context-source.json", + "original_sha256": null, + "staged_sha256": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/download-receipt.json", + "original_sha256": null, + "staged_sha256": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "original_sha256": null, + "staged_sha256": "c82fa8aab33426fdd6f7730b627d226d3469b9d31c525bca7c28a52ab4847fc1" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "original_sha256": null, + "staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "original_sha256": null, + "staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "original_sha256": null, + "staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "original_sha256": null, + "staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "6706f62937a742a9c5cc00c42d6261d67d4f1e675b868e67db70dc0b5be03afa" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_build_inputs.py", + "original_sha256": null, + "staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/check_runtime.py", + "original_sha256": null, + "staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/compare_runtime.py", + "original_sha256": null, + "staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/tools/zlib_overlay/test_candidate.py", + "original_sha256": null, + "staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/initial-8d345bb2/owner-snapshot/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "original_sha256": null, + "staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json", + "original_sha256": null, + "staged_sha256": "9ed9bfebae3618936f6b916819949adfb23668fedeb350ae63b43cd2aa6a7d92" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt", + "original_sha256": null, + "staged_sha256": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt", + "original_sha256": null, + "staged_sha256": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json", + "original_sha256": null, + "staged_sha256": "a12877b149427713c12e67f2597bf330d32dd0b30464008c0f79fc593f05d894" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json", + "original_sha256": null, + "staged_sha256": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py", + "original_sha256": null, + "staged_sha256": "e9c5a628e40acc3ae241bb3f3bf9c2846c064601761a11aecce81ba4803c8f71" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json", + "original_sha256": null, + "staged_sha256": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9" + }, + { + "repo": "informed-decision", + "path": "docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py", + "original_sha256": null, + "staged_sha256": "53778a2c3c89aee4c1256ed7e5896db033d960c6345d490620e4f06d03268794" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/check_build_inputs.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_build_inputs.py", + "original_sha256": null, + "staged_sha256": "1bf0219765dbcf5f7e26495ac4d49f240affa21deeb9b06c65e275afd10d2e06" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/check_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/check_runtime.py", + "original_sha256": null, + "staged_sha256": "eb1fca9a43d3394d652f748cde2e8d28cbe646ad61c40f990c0b8878c522a3be" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/compare_runtime.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/compare_runtime.py", + "original_sha256": null, + "staged_sha256": "545f04844f90d028f5d8bb65fb16f3805ee5735ac687ec28303eb9dbb4195b0d" + }, + { + "repo": "informed-decision", + "path": "tools/zlib_overlay/test_candidate.py", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/tools/zlib_overlay/test_candidate.py", + "original_sha256": null, + "staged_sha256": "68677b91c34101776381abcabffcd983bf2452076f983f32599ab1f7ad177bb9" + }, + { + "repo": "informed-decision", + "path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "staged_path": "/tmp/infd-zlib-candidate-stage/informed-decision/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "original_sha256": "73fe52f0a188067d3e9c9d78584117b9cfa40ce417bb31530cbc2e9bbe858223", + "staged_sha256": "af785afbf188184b72563c10813663d44117df7cb7394ecb1b9a25cbdfea67a4" + } +] diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py new file mode 100644 index 0000000..332e2e8 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/test_artifact_audit.py @@ -0,0 +1,47 @@ +"""Synthetic artifact boundaries; never access owner/native databases.""" +from pathlib import Path +import io,json,subprocess,sys,tarfile,tempfile,unittest +CHECKER=Path(__file__).with_name('verify_local_artifacts.py') +def add(t,name,data=None,metadata=(0o755,0,0)): + m=tarfile.TarInfo(name);m.mode,m.uid,m.gid=metadata + if data is None:m.type=tarfile.DIRTYPE;t.addfile(m) + else:m.size=len(data);t.addfile(m,io.BytesIO(data)) +def archive(path,layers,ids): + with tarfile.open(path,'w') as t: + add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':[f'{i}.tar' for i in range(len(layers))]}]).encode()) + add(t,'config.json',json.dumps({'rootfs':{'diff_ids':ids},'config':{}}).encode()) + for i,data in enumerate(layers):add(t,f'{i}.tar',data) +def layer(metadata): + b=io.BytesIO() + with tarfile.open(fileobj=b,mode='w') as t:add(t,'usr',metadata=metadata) + return b.getvalue() +def fixture(root,metadata=(0o755,0,0)): + base=layer((0o755,0,0));candidate=layer(metadata) + archive(root/'base-image.tar',[base],['base']) + archive(root/'image.tar',[base,candidate,layer(metadata)],['base','overlay','cleanup']) + for name,version in [('base-sbom.cdx.json','1.3.2-r0'),('sbom.cdx.json','1.3.2-r1')]: + (root/name).write_text(json.dumps({'components':[{'name':'zlib','version':version,'purl':'pkg:apk/zlib'}]})) + for name,findings in [('base-trivy-full.json',[{'VulnerabilityID':'CVE-2026-85091','Severity':'MEDIUM'}]),('trivy-full.json',[])]: + (root/name).write_text(json.dumps({'Results':[{'Vulnerabilities':findings}]})) +class ArtifactAuditTests(unittest.TestCase): + def execute(self,root,optimize=False): + return subprocess.run([sys.executable,*(['-O'] if optimize else []),str(CHECKER),str(root)],capture_output=True,text=True) + def test_optimized_tampered_artifacts_refused_before_read(self): + with tempfile.TemporaryDirectory() as tmp: + root=Path(tmp);(root/'base-image.tar').write_bytes(b'tampered not an archive') + r=self.execute(root,True) + self.assertNotEqual(r.returncode,0);self.assertIn('REFUSED: optimized Python',r.stderr) + self.assertNotIn('ReadError',r.stderr);self.assertFalse((root/'artifact-comparison.json').exists()) + def test_matching_directory_metadata_passes(self): + with tempfile.TemporaryDirectory() as tmp: + root=Path(tmp);fixture(root);r=self.execute(root) + self.assertEqual(r.returncode,0,r.stderr) + proof=json.loads((root/'artifact-comparison.json').read_text()) + self.assertTrue(proof['directory_metadata_compared']);self.assertEqual(proof['directory_metadata_delta'],{}) + def test_directory_mode_uid_gid_drift_refuses(self): + for metadata in [(0o777,0,0),(0o755,10001,0),(0o755,0,10001)]: + with self.subTest(metadata=metadata),tempfile.TemporaryDirectory() as tmp: + root=Path(tmp);fixture(root,metadata);r=self.execute(root) + self.assertNotEqual(r.returncode,0);self.assertIn("{'usr'}",r.stderr) + self.assertFalse((root/'artifact-comparison.json').exists()) +if __name__=='__main__':unittest.main() diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py new file mode 100644 index 0000000..81654b4 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/intermediate-64509029/verify_local_artifacts.py @@ -0,0 +1,49 @@ +from pathlib import Path +import hashlib,io,json,tarfile,sys +if sys.flags.optimize: + raise SystemExit("REFUSED: optimized Python disables required artifact validation") +root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build') +def image(path): + with tarfile.open(path) as archive: + manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1 + configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes) + files={} + for name in manifest[0]['Layers']: + with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer: + for member in layer: + path=member.name.lstrip('./');p=Path(path) + if p.name=='.wh..wh..opq': + folder=p.parent.as_posix();files={key:value for key,value in files.items() if not key.startswith(folder+'/')};continue + if p.name.startswith('.wh.'): + removed=(p.parent/p.name[4:]).as_posix();files={key:value for key,value in files.items() if key!=removed and not key.startswith(removed+'/')};continue + if member.isfile(): + data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest()) + elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None) + elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname) + else:continue + files[path]=value + return config,hashlib.sha256(configbytes).hexdigest(),files +base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar') +assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids'] +changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)} +expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +assert set(changed)<=expected,set(changed) +a,b=base['config'].copy(),candidate['config'].copy() +labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{}) +a.pop('Image',None);b.pop('Image',None) +defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None} +for key,value in defaults.items(): + a.setdefault(key,value);b.setdefault(key,value) +assert a==b,(a,b) +components=[] +for name in ['base-sbom.cdx.json','sbom.cdx.json']: + data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')}) +sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)} +assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta +vulns=[] +for name in ['base-trivy-full.json','trivy-full.json']: + data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])]) +assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM' +assert not vulns[1] +proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False} +(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed))) diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json new file mode 100644 index 0000000..fba581b --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/local-candidate-verification.json @@ -0,0 +1,111 @@ +{ + "task_id": "INFD-WP-0009-T05", + "risk_record": "INFD-RISK-20261011-ZLIB-85091", + "state": "local-source-candidate-verified-unpublished-unapproved", + "base_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "candidate_docker_daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "candidate_saved_oci_config_digest": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "candidate_registry_digest": null, + "source_revision": "uncommitted-T05-local-preparation", + "source_context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "build_inputs": { + ".dockerignore": "ce3fa53cfe2c963c7fec4f2333a8af84a40740f144605a5aea795bcd6ac9eb8a", + "Containerfile": "5e4d9b39e37fed95d729503deb0e9c414ae63d2779b02306beaadc94675d4f15", + "zlib-1.3.2-r1.apk": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "APKINDEX.tar.gz": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5" + }, + "official_downloads": { + "zlib-1.3.2-r1.apk": { + "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/zlib-1.3.2-r1.apk", + "sha256": "63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47", + "bytes": 56210 + }, + "APKINDEX.tar.gz": { + "url": "https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/APKINDEX.tar.gz", + "sha256": "24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5", + "bytes": 528370 + } + }, + "signature_verification": "Actual apk verify package+index returned OK against keys installed in exact763 base; no allow-untrusted", + "package_delta": { + "zlib": [ + "1.3.2-r0", + "1.3.2-r1" + ] + }, + "official_aports_commit": "0afa2da0e8c8051c6f8f64a7a388e5a259904245", + "final_files_changed": [ + "lib/apk/db/installed", + "usr/lib/libz.so.1.3.2" + ], + "base_layers_preserved": 9, + "effective_runtime_configuration_unchanged": true, + "raw_config_serialization_unchanged": false, + "serialization_caveat": "Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.", + "app_files_unchanged": 36, + "policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", + "installed_purpose_variants_pass": 10, + "purpose_transport_synthetic": true, + "native_provider_test": false, + "compression_vectors_pass": 4, + "malformed_zlib_refusals": 3, + "crypto_jwt_waitress_smoke": true, + "source_negative_tests": 4, + "source_negative_mutations": 8, + "full_sbom_package_count": 44, + "baseline_full_scan_findings": { + "MEDIUM": 1, + "id": "CVE-2026-85091" + }, + "candidate_full_scan_allseverity_findings": 0, + "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 v0.74", + "scanner_db_metadata": { + "Version": 2, + "NextUpdate": "2026-10-11T18:59:50.889010572Z", + "UpdatedAt": "2026-10-10T18:59:50.889010923Z", + "DownloadedAt": "2026-10-10T23:32:32.380033131Z" + }, + "scanner_db_sha256": "03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917", + "scan_caveat": "Alpine3.24 absent EOL list warning; actual OS detector ran38OS+6Python. Zero findings is this DB snapshot, not unknown-future vulnerability assurance or estate risk grade.", + "suppression_or_severity_filter": false, + "evidence_file_sha256": { + "artifact-comparison.json": "689fa7cbd322cb31b215fd2e86e0be267c1398f9b71e5615446d5f7b82dcce89", + "base-runtime.json": "20aabb9f4846ab4fa6e28e0763d153188da151ee32293366a51b0fdf872a4d24", + "base-sbom.cdx.json": "bb40bcd500ec91ad16affe116e74357ab4090827dd930e2186dc99988403bc50", + "base-trivy-full.json": "1b683afb558fedcc20b921599eca536551296afecbc81ce062c359f1b26cfac6", + "candidate-image-inspect.json": "56466225f35cdf23c5540c0cc37c77424755ca42794e81f2c99ccf13840c34de", + "candidate-runtime.json": "d58e60bdc69458fe42af8248e02acd924b3b605c828877352a7d9a3953e90124", + "context-source.json": "cccf41cf766a037f31f9ab29ae57f6b34c00e0237c94a8a0ce61c9c78fd06828", + "download-receipt.json": "847fce8466807e88a54ea5e374c2ac49ffa25e208697e71e94d83a5cc185b40d", + "official-zlib-index-entry.txt": "63b6831755f33c4fe7c8d7dd49cf2a60251edfcd45e4555f2731941939cb8d0a", + "official-zlib-package-info.txt": "395e0ee97996853c6cf03f17dfe25b57d109b0432c6faabb585d78e6ac6f534a", + "sbom.cdx.json": "287a61e1aaf78b58c014726e9bcc1ddc2c46949ac0ee74d53fccae3007eac1bb", + "trivy-full.json": "fd37bc2d502a9f017f673486f0f960433fc0fc12dcd745e5ed8074e9c3b600d9", + "verify_local_artifacts.py": "d727f60edd004184c79903c20619643033fac68afbecfb1990cce855cdb924e3", + "test_artifact_audit.py": "12ba4ce8c082450241118d73139c59e06b3a337b152e3364918a5b2850f2dc47" + }, + "local_saved_image_tar_sha256": "0142526048de5662b4afc1ff7b82b5bf4554642ff811e29f364082e5de9be075", + "local_saved_image_tar_owner_attachment": false, + "build_resource_bound": "legacy builder --network none,256MiB/oneCPU; runtime128MiB/oneCPU; scanner1GiB/oneCPU", + "native_runtime_or_database_or_customer_data_or_credentials_accessed": false, + "native_backup_or_rollout": false, + "owner_source_edits_or_push": false, + "registry_publication_executed": false, + "founder_release_approval": false, + "workflow_yaml_and_bash_syntax": "passed, exact SHA/fixedowner context and admittedexistingregistry capability; CIactualbuild not executed", + "local_refinements_retained": [ + "Initial build --cpus flag unavailable in buildx; switched to explicit existinglegacy builder boundedquota", + "APK preupgrade=false argument refused; corrected no-preupgrade flag", + "Filesystem check found apk.log metadata delta; no-logfile confines finaldiff to twofiles", + "One intermediate local build context accidentally included public scan cache/export artifacts1.529GB; corrected separate4file context and .dockerignore(finaltransfer589.8kB); no secrets/native data involved", + "Read-only cache copy tried inaccessible priorfanal; isolated DB-only copy exactSHA03cacb... used; no ownership/permission loosening" + ], + "directory_metadata_compared": true, + "directory_count_base": 313, + "directory_count_candidate": 313, + "directory_metadata_delta": {}, + "artifact_audit_regression_tests": 5, + "artifact_audit_negative_cases": 4, + "initial_source_manifest_sha256": "8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66", + "whiteout_semantic_cases": 12 +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt b/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt new file mode 100644 index 0000000..5cc6c46 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-index-entry.txt @@ -0,0 +1,15 @@ +C:Q1T1JcjMIE+EuLTKQNs744mVjwVsY= +P:zlib +V:1.3.2-r1 +A:x86_64 +S:56210 +I:108376 +T:A compression/decompression Library +U:https://zlib.net/ +L:Zlib +o:zlib +m:Natanael Copa +t:1791318860 +c:0afa2da0e8c8051c6f8f64a7a388e5a259904245 +D:so:libc.musl-x86_64.so.1 +p:so:libz.so.1=1.3.2 diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt b/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt new file mode 100644 index 0000000..35e8543 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/official-zlib-package-info.txt @@ -0,0 +1,18 @@ +# Generated by abuild 3.17.0-r0 +# using fakeroot version 1.37.2 +pkgname = zlib +pkgver = 1.3.2-r1 +pkgdesc = A compression/decompression Library +url = https://zlib.net/ +builddate = 1791318860 +packager = Buildozer +size = 108376 +arch = x86_64 +origin = zlib +commit = 0afa2da0e8c8051c6f8f64a7a388e5a259904245 +maintainer = Natanael Copa +license = Zlib +# automatically detected: +provides = so:libz.so.1=1.3.2 +depend = so:libc.musl-x86_64.so.1 +datahash = 9839ce70203b5f89b54614de122f9086f58d09ad01cb95b3ba85049655f47d3b diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json new file mode 100644 index 0000000..3fc6402 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/proposal.json @@ -0,0 +1,26 @@ +{ + "proposal_id": "INFD-WP-0009-T05/zlib-85091-r1", + "state": "prepared-local-candidate-unpublished-unapproved", + "task_id": "INFD-WP-0009-T05", + "risk_record": "INFD-RISK-20261011-ZLIB-85091", + "candidate_local_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31", + "candidate_registry_digest": null, + "base_image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "source_context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "scope": "Only zlib1.3.2-r0\u2192r1 from signedofficialAlpine3.24/x86_64main package; no broaderAlpine/Python/base/app refresh", + "scan": "Actualfull44package sameDB base1MED\u2192candidate0allseverity,no suppressions", + "native_effect": "None prepared/applied; laterpublishedregistryproof and distinct exactfounderDeployment-only release proposal required. Current763 image/schema5/config/policy9d/identity/PVC/credentials/nativec96T04outcome and protectedjournals untouched.", + "next_gates": [ + "Rootsourceapply/review/commit and normaladmittedownerCIcandidatepublication(no borrowedcredential/newgrant)", + "Exact CI/sourceSHA registrydescriptor/layer/config/signature/pkgreadback + actualpublishedfullscan/SBOM/sourcecontext proof", + "Scopednewimagecandidate sourcevalues onlyafteractualdigest, freshmetadata/admission/diff/UID/capacity/sealedconfig/storage checks and exactdistinctinformeddecisionfounderapproval", + "Actualinstalledr1/hash/runtimepurpose/reliability/fullscan verification beforeT05complete; same-schema rollbackto763 preservescurrentDB" + ], + "rollback": "Futureimage-onlyrollbacktoexact763, keepcurrentDB/schema5/config/records; no snapshotrestore/helper/journalrewrite", + "manual_review_due": "2026-10-18", + "automatic_controller": false, + "cost_estimate_EUR": 0, + "cost_caveat": "Existinglocal/CI compute and~0.6MiBpublicsourcecontext, image/scan artifacts andattendedengineering unpriced; no estateincidentloss/autonomygrant", + "maker_only": true, + "human_native_release_approval": false +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json new file mode 100644 index 0000000..c37c6b8 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/sbom.cdx.json @@ -0,0 +1,2517 @@ +{ + "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json", + "bomFormat": "CycloneDX", + "specVersion": "1.7", + "serialNumber": "urn:uuid:d5bad06c-fbb6-43dc-ad11-350bac137879", + "version": 1, + "metadata": { + "timestamp": "2026-10-11T07:31:28+00:00", + "tools": { + "components": [ + { + "type": "application", + "manufacturer": { + "name": "Aqua Security Software Ltd." + }, + "group": "aquasecurity", + "name": "trivy", + "version": "0.74.0" + } + ] + }, + "component": { + "bom-ref": "826fbc25-7bf3-47dc-8757-1977ae81aac7", + "type": "container", + "name": "/artifact/image.tar", + "properties": [ + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:DiffID", + "value": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "name": "aquasecurity:trivy:ImageID", + "value": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f" + }, + { + "name": "aquasecurity:trivy:Labels:org.opencontainers.image.base.digest", + "value": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a" + }, + { + "name": "aquasecurity:trivy:Labels:org.opencontainers.image.revision", + "value": "uncommitted-T05-local-preparation" + }, + { + "name": "aquasecurity:trivy:Labels:social.coulomb.release.scope", + "value": "INFD-WP-0009-T05/zlib-85091-r1" + }, + { + "name": "aquasecurity:trivy:Labels:social.coulomb.source.context.sha256", + "value": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d" + }, + { + "name": "aquasecurity:trivy:Labels:social.coulomb.source.policy.sha256", + "value": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + { + "name": "aquasecurity:trivy:Reference", + "value": "informed-decision:zlib-r1-local-20261011" + }, + { + "name": "aquasecurity:trivy:RepoTag", + "value": "informed-decision:zlib-r1-local-20261011" + }, + { + "name": "aquasecurity:trivy:SchemaVersion", + "value": "2" + }, + { + "name": "aquasecurity:trivy:Size", + "value": "89032192" + } + ] + } + }, + "components": [ + { + "bom-ref": "e38bd52f-08ed-4477-902a-c1cdf68a9c1b", + "type": "operating-system", + "name": "alpine", + "version": "3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:Class", + "value": "os-pkgs" + }, + { + "name": "aquasecurity:trivy:Type", + "value": "alpine" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "type": "library", + "name": ".python-rundeps", + "version": "20260901.001029", + "hashes": [ + { + "alg": "SHA-1", + "content": "51d0c1e7d88a414345799f0309185c625013ef32" + } + ], + "purl": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": ".python-rundeps@20260901.001029" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-baselayout-data", + "version": "3.7.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "c6f9bded17d844b6f1b0bb5766d2c35c0d5c8508" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-baselayout-data@3.7.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-baselayout" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.7.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-baselayout", + "version": "3.7.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "f0fcfdc2f4da058af6473bc45c4eab62916225b2" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-baselayout@3.7.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-baselayout" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.7.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-keys", + "version": "2.6-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "d8d6b80e53c059a77e4915da78ba964f3ffea240" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-keys@2.6-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-keys" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2.6-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "alpine-release", + "version": "3.24.1-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "bc6912a25cdc7733e0035ed509eceaa4026946e3" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "alpine-release@3.24.1-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "alpine-base" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.24.1-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "apk-tools", + "version": "3.0.6-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "043333589798a1f52e09ae63f026c6c8fa676d34" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "apk-tools@3.0.6-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "apk-tools" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.0.6-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Sören Tempel " + }, + "name": "busybox-binsh", + "version": "1.37.0-r31", + "hashes": [ + { + "alg": "SHA-1", + "content": "5cbd14acc6f1804c5bac6c77dc2c492f010b0fc7" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "busybox-binsh@1.37.0-r31" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "busybox" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.37.0-r31" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Sören Tempel " + }, + "name": "busybox", + "version": "1.37.0-r31", + "hashes": [ + { + "alg": "SHA-1", + "content": "b5405ebc02f7dd8be95b6265c54b243d5456ab8f" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "busybox@1.37.0-r31" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "busybox" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.37.0-r31" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "ca-certificates-bundle", + "version": "20260611-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "c9534a03750bdfae341f10969016090fc11febbd" + } + ], + "licenses": [ + { + "license": { + "id": "MPL-2.0" + } + }, + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ca-certificates-bundle@20260611-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ca-certificates" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "20260611-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "ca-certificates", + "version": "20260611-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "8f2a04abeb54b331e2970a0a0dffb7bd6bdde567" + } + ], + "licenses": [ + { + "license": { + "id": "MPL-2.0" + } + }, + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ca-certificates@20260611-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ca-certificates" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "20260611-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "gdbm", + "version": "1.26-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "619493d8124fe49a8ee1d8f7a1372cf7e3977337" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-3.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "gdbm@1.26-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "gdbm" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.26-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "keyutils-libs", + "version": "1.6.3-r4", + "hashes": [ + { + "alg": "SHA-1", + "content": "b7331c96f077fc3522ee4361a441d1097204cd90" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-or-later" + } + }, + { + "license": { + "id": "LGPL-2.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "keyutils-libs@1.6.3-r4" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "keyutils" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.6.3-r4" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "krb5-conf", + "version": "1.0-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "40a11e0690a59e110367b62a80661024e9942a2d" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "krb5-conf@1.0-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "krb5-conf" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.0-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "krb5-libs", + "version": "1.22.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "ef02346e21b817ff379e4601e5b1fc9760e5e31a" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "krb5-libs@1.22.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "krb5" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.22.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libapk", + "version": "3.0.6-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "523a8f58104589f74f743d501c81bf6517155378" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libapk@3.0.6-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "apk-tools" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.0.6-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libbz2", + "version": "1.0.8-r6", + "hashes": [ + { + "alg": "SHA-1", + "content": "08566ba5c7af97c25474be8b24e8b48f0116b67d" + } + ], + "licenses": [ + { + "license": { + "name": "bzip-2-1.0.6" + } + } + ], + "purl": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libbz2@1.0.8-r6" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "bzip2" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.0.8-r6" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libcom_err", + "version": "1.47.4-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "4b9fb5899ea0b1c0cfbb2a2c5952704437d4ecef" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-or-later" + } + }, + { + "license": { + "id": "LGPL-2.0-or-later" + } + }, + { + "license": { + "id": "BSD-3-Clause" + } + }, + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libcom_err@1.47.4-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "e2fsprogs" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.47.4-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libcrypto3", + "version": "3.5.8-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "1b3b9fc0c136f4936932bcb2ec21499f0ae5dfd3" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "purl": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libcrypto3@3.5.8-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "openssl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.5.8-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libffi", + "version": "3.5.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "2f7b261f7fcecc4eebd8b330e7f6fb80713bfe3a" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libffi@3.5.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libffi" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.5.2-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Carlo Landmeter " + }, + "name": "libintl", + "version": "1.0-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "282d6642ccac87237e43a864159d73cf5abe7550" + } + ], + "licenses": [ + { + "license": { + "id": "LGPL-2.1-or-later" + } + } + ], + "purl": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libintl@1.0-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "gettext" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.0-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Milan P. Stanić " + }, + "name": "libncursesw", + "version": "6.6_p20260516-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "9f318e6e324d6827274829194cf6ac6afbaded12" + } + ], + "licenses": [ + { + "license": { + "name": "X-11" + } + } + ], + "purl": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libncursesw@6.6_p20260516-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ncurses" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "6.6_p20260516-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "name": "libnsl", + "version": "2.0.1-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "5194adbf26560b52be318481a7af294ab05fd795" + } + ], + "licenses": [ + { + "license": { + "id": "LGPL-2.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libnsl@2.0.1-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libnsl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2.0.1-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Milan P. Stanić " + }, + "name": "libpanelw", + "version": "6.6_p20260516-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "149bdc434232ed11fc5bb975ba519a07154a6f56" + } + ], + "licenses": [ + { + "license": { + "name": "X-11" + } + } + ], + "purl": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libpanelw@6.6_p20260516-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ncurses" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "6.6_p20260516-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libssl3", + "version": "3.5.8-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "5f9b1e55d821953d2e2b1db322dad70a3b5041ea" + } + ], + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "purl": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libssl3@3.5.8-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "openssl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.5.8-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libtirpc-conf", + "version": "1.3.5-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "0c17d9988dc986c90e22f79778df047eca9973ff" + } + ], + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libtirpc-conf@1.3.5-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libtirpc" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.5-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libtirpc", + "version": "1.3.5-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "c32865bd86a8b8829d152279cabbc5ac6d430eb2" + } + ], + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libtirpc@1.3.5-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libtirpc" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.5-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "libuuid", + "version": "2.42.3-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "8f041ef637ad75f381cc0c034f2afbbb0303264e" + } + ], + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libuuid@2.42.3-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "util-linux" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2.42.3-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Francesco Colista " + }, + "name": "libverto", + "version": "0.3.2-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "73233059338142e4ac6d8fb8bb0074e93da75dc1" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "libverto@0.3.2-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "libverto" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "0.3.2-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "musl-utils", + "version": "1.2.6-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "75ada3c48d63ec5d87c42fdf934a3fdd11298dc5" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + }, + { + "license": { + "id": "BSD-2-Clause" + } + }, + { + "license": { + "id": "GPL-2.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "musl-utils@1.2.6-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "musl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.2.6-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "musl", + "version": "1.2.6-r2", + "hashes": [ + { + "alg": "SHA-1", + "content": "0f7e5827e4e1a73631beda27b78431a8ba240e05" + } + ], + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "musl@1.2.6-r2" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "musl" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.2.6-r2" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Milan P. Stanić " + }, + "name": "ncurses-terminfo-base", + "version": "6.6_p20260516-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "9d551d828e9c8ee52c5801c1d6046828ebf15752" + } + ], + "licenses": [ + { + "license": { + "name": "X-11" + } + } + ], + "purl": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ncurses-terminfo-base@6.6_p20260516-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "ncurses" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "6.6_p20260516-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "qaqland " + }, + "name": "readline", + "version": "8.3.3-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "945b16e378bc00e44d89d4de8124bba7647fdf4d" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-3.0-or-later" + } + } + ], + "purl": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "readline@8.3.3-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "readline" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "8.3.3-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "scanelf", + "version": "1.3.9-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "013f903d0ba219673aebbdd04f74bb5ed82b01f0" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "scanelf@1.3.9-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "pax-utils" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.9-r1" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Jingyun Hua " + }, + "name": "sqlite-libs", + "version": "3.53.4-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "f7630ceb37c232b6609861aeab6cdb9cd120e6fa" + } + ], + "licenses": [ + { + "license": { + "id": "blessing" + } + } + ], + "purl": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "sqlite-libs@3.53.4-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "sqlite" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "3.53.4-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Sören Tempel " + }, + "name": "ssl_client", + "version": "1.37.0-r31", + "hashes": [ + { + "alg": "SHA-1", + "content": "c220f4a5125a313af733e98def94132bb1e9d40d" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-only" + } + } + ], + "purl": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "ssl_client@1.37.0-r31" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "busybox" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.37.0-r31" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "tzdata", + "version": "2026c-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "61f7544ecd8dd63eac23fe3e645702fda92ef02a" + } + ], + "licenses": [ + { + "license": { + "name": "Public-Domain" + } + } + ], + "purl": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "tzdata@2026c-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "tzdata" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "2026c-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "xz-libs", + "version": "5.8.3-r0", + "hashes": [ + { + "alg": "SHA-1", + "content": "4c92c5be0c5bef404e93c880eba9037a9b147347" + } + ], + "licenses": [ + { + "license": { + "id": "GPL-2.0-or-later" + } + }, + { + "license": { + "id": "0BSD" + } + }, + { + "license": { + "name": "Public-Domain" + } + }, + { + "license": { + "id": "LGPL-2.1-or-later" + } + } + ], + "purl": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "xz-libs@5.8.3-r0" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "xz" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "5.8.3-r0" + } + ] + }, + { + "bom-ref": "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1", + "type": "library", + "supplier": { + "name": "Natanael Copa " + }, + "name": "zlib", + "version": "1.3.2-r1", + "hashes": [ + { + "alg": "SHA-1", + "content": "4f525c8cc204f84b8b4ca40db3be389958f056c6" + } + ], + "licenses": [ + { + "license": { + "id": "Zlib" + } + } + ], + "purl": "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1", + "properties": [ + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:645872f9a17cb984e868cc31e749d9db7227a520a47e5d39cc5836f98eb2f731" + }, + { + "name": "aquasecurity:trivy:PkgID", + "value": "zlib@1.3.2-r1" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "alpine" + }, + { + "name": "aquasecurity:trivy:SrcName", + "value": "zlib" + }, + { + "name": "aquasecurity:trivy:SrcVersion", + "value": "1.3.2-r1" + } + ] + }, + { + "bom-ref": "pkg:pypi/cffi@2.1.1", + "type": "library", + "name": "cffi", + "version": "2.1.1", + "licenses": [ + { + "license": { + "id": "MIT-0" + } + } + ], + "purl": "pkg:pypi/cffi@2.1.1", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/cryptography@50.0.1", + "type": "library", + "name": "cryptography", + "version": "50.0.1", + "licenses": [ + { + "expression": "Apache-2.0 OR BSD-3-Clause" + } + ], + "purl": "pkg:pypi/cryptography@50.0.1", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/cryptography-50.0.1.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/informed-decision@0.2.0", + "type": "library", + "name": "informed-decision", + "version": "0.2.0", + "purl": "pkg:pypi/informed-decision@0.2.0", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/informed_decision-0.2.0.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/pycparser@3.0", + "type": "library", + "name": "pycparser", + "version": "3.0", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "purl": "pkg:pypi/pycparser@3.0", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/pycparser-3.0.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/pyjwt@2.15.1", + "type": "library", + "name": "PyJWT", + "version": "2.15.1", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "purl": "pkg:pypi/pyjwt@2.15.1", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/pyjwt-2.15.1.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + }, + { + "bom-ref": "pkg:pypi/waitress@3.0.2", + "type": "library", + "name": "waitress", + "version": "3.0.2", + "licenses": [ + { + "license": { + "id": "ZPL-2.1" + } + } + ], + "purl": "pkg:pypi/waitress@3.0.2", + "properties": [ + { + "name": "aquasecurity:trivy:FilePath", + "value": "opt/venv/lib/python3.12/site-packages/waitress-3.0.2.dist-info/METADATA" + }, + { + "name": "aquasecurity:trivy:LayerDiffID", + "value": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "name": "aquasecurity:trivy:LayerDigest", + "value": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87" + }, + { + "name": "aquasecurity:trivy:PkgType", + "value": "python-pkg" + } + ] + } + ], + "dependencies": [ + { + "ref": "826fbc25-7bf3-47dc-8757-1977ae81aac7", + "dependsOn": [ + "e38bd52f-08ed-4477-902a-c1cdf68a9c1b", + "pkg:pypi/cffi@2.1.1", + "pkg:pypi/cryptography@50.0.1", + "pkg:pypi/informed-decision@0.2.0", + "pkg:pypi/pycparser@3.0", + "pkg:pypi/pyjwt@2.15.1", + "pkg:pypi/waitress@3.0.2" + ] + }, + { + "ref": "e38bd52f-08ed-4477-902a-c1cdf68a9c1b", + "dependsOn": [ + "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64&distro=3.24.1", + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [] + }, + { + "ref": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=3.24.1", + "dependsOn": [ + "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64&distro=3.24.1" + ] + }, + { + "ref": "pkg:pypi/cffi@2.1.1", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/cryptography@50.0.1", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/informed-decision@0.2.0", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/pycparser@3.0", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/pyjwt@2.15.1", + "dependsOn": [] + }, + { + "ref": "pkg:pypi/waitress@3.0.2", + "dependsOn": [] + } + ], + "vulnerabilities": [] +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py b/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py new file mode 100644 index 0000000..8f64c91 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/test_artifact_audit.py @@ -0,0 +1,82 @@ +"""Synthetic artifact boundaries; never access owner/native databases.""" +from pathlib import Path +import io,json,subprocess,sys,tarfile,tempfile,unittest +CHECKER=Path(__file__).with_name('verify_local_artifacts.py') +def add(t,name,data=None,metadata=(0o755,0,0)): + m=tarfile.TarInfo(name);m.mode,m.uid,m.gid=metadata + if data is None:m.type=tarfile.DIRTYPE;t.addfile(m) + else:m.size=len(data);t.addfile(m,io.BytesIO(data)) +def archive(path,layers,ids): + with tarfile.open(path,'w') as t: + add(t,'manifest.json',json.dumps([{'Config':'config.json','Layers':[f'{i}.tar' for i in range(len(layers))]}]).encode()) + add(t,'config.json',json.dumps({'rootfs':{'diff_ids':ids},'config':{}}).encode()) + for i,data in enumerate(layers):add(t,f'{i}.tar',data) +def layer(metadata): + b=io.BytesIO() + with tarfile.open(fileobj=b,mode='w') as t:add(t,'usr',metadata=metadata) + return b.getvalue() +def fixture(root,metadata=(0o755,0,0)): + base=layer((0o755,0,0));candidate=layer(metadata) + archive(root/'base-image.tar',[base],['base']) + archive(root/'image.tar',[base,candidate,layer(metadata)],['base','overlay','cleanup']) + for name,version in [('base-sbom.cdx.json','1.3.2-r0'),('sbom.cdx.json','1.3.2-r1')]: + (root/name).write_text(json.dumps({'components':[{'name':'zlib','version':version,'purl':'pkg:apk/zlib'}]})) + for name,findings in [('base-trivy-full.json',[{'VulnerabilityID':'CVE-2026-85091','Severity':'MEDIUM'}]),('trivy-full.json',[])]: + (root/name).write_text(json.dumps({'Results':[{'Vulnerabilities':findings}]})) +class ArtifactAuditTests(unittest.TestCase): + def execute(self,root,optimize=False): + return subprocess.run([sys.executable,*(['-O'] if optimize else []),str(CHECKER),str(root)],capture_output=True,text=True) + def test_optimized_tampered_artifacts_refused_before_read(self): + with tempfile.TemporaryDirectory() as tmp: + root=Path(tmp);(root/'base-image.tar').write_bytes(b'tampered not an archive') + r=self.execute(root,True) + self.assertNotEqual(r.returncode,0);self.assertIn('REFUSED: optimized Python',r.stderr) + self.assertNotIn('ReadError',r.stderr);self.assertFalse((root/'artifact-comparison.json').exists()) + def test_matching_directory_metadata_passes(self): + with tempfile.TemporaryDirectory() as tmp: + root=Path(tmp);fixture(root);r=self.execute(root) + self.assertEqual(r.returncode,0,r.stderr) + proof=json.loads((root/'artifact-comparison.json').read_text()) + self.assertTrue(proof['directory_metadata_compared']);self.assertEqual(proof['directory_metadata_delta'],{}) + def test_directory_mode_uid_gid_drift_refuses(self): + for metadata in [(0o777,0,0),(0o755,10001,0),(0o755,0,10001)]: + with self.subTest(metadata=metadata),tempfile.TemporaryDirectory() as tmp: + root=Path(tmp);fixture(root,metadata);r=self.execute(root) + self.assertNotEqual(r.returncode,0);self.assertIn("{'usr'}",r.stderr) + self.assertFalse((root/'artifact-comparison.json').exists()) + def test_root_and_nested_whiteout_semantics(self): + # Extract only the archive reader definition: the full CLI proof is tested above. + import ast + tree=ast.parse(CHECKER.read_text());function=next(n for n in tree.body if isinstance(n,ast.FunctionDef) and n.name=='image') + namespace={'Path':Path,'tarfile':tarfile,'json':json,'hashlib':__import__('hashlib')} + exec(compile(ast.Module(body=[function],type_ignores=[]),'reader','exec'),namespace) + for marker,expected in [('.wh.usr',set()),('usr/.wh.child',{'usr'}),('usr/.wh..wh..opq',{'usr'}),('.wh..wh..opq',set())]: + with self.subTest(marker=marker),tempfile.TemporaryDirectory() as tmp: + before=io.BytesIO() + with tarfile.open(fileobj=before,mode='w') as t: + add(t,'usr');add(t,'usr/child');add(t,'usr/child/file',b'original') + after=io.BytesIO() + with tarfile.open(fileobj=after,mode='w') as t:add(t,'./'+marker,b'') + path=Path(tmp)/'image.tar';archive(path,[before.getvalue(),after.getvalue()],['base','overlay']) + _,_,files=namespace['image'](path) + self.assertEqual(set(files),expected) + def test_whiteouts_only_mask_lower_layers_in_either_order(self): + import ast + tree=ast.parse(CHECKER.read_text());function=next(n for n in tree.body if isinstance(n,ast.FunctionDef) and n.name=='image') + namespace={'Path':Path,'tarfile':tarfile,'json':json,'hashlib':__import__('hashlib')} + exec(compile(ast.Module(body=[function],type_ignores=[]),'reader','exec'),namespace) + cases=[('usr/.wh..wh..opq','usr/new',{'usr','usr/new'}),('.wh..wh..opq','new',{'new'}),('usr/.wh.child','usr/child',{'usr','usr/child'}),('.wh.usr','usr',{'usr'})] + for marker,new,expected in cases: + for marker_first in [True,False]: + with self.subTest(marker=marker,marker_first=marker_first),tempfile.TemporaryDirectory() as tmp: + before=io.BytesIO() + with tarfile.open(fileobj=before,mode='w') as t: + add(t,'usr');add(t,'usr/child');add(t,'usr/child/old',b'lower') + after=io.BytesIO() + with tarfile.open(fileobj=after,mode='w') as t: + entries=[(marker,b''),(new,b'new')] + if not marker_first:entries.reverse() + for name,data in entries:add(t,name,data) + path=Path(tmp)/'image.tar';archive(path,[before.getvalue(),after.getvalue()],['base','overlay']) + _,_,files=namespace['image'](path);self.assertEqual(set(files),expected) +if __name__=='__main__':unittest.main() diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json b/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json new file mode 100644 index 0000000..2206ce4 --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/trivy-full.json @@ -0,0 +1,2394 @@ +{ + "SchemaVersion": 2, + "Trivy": { + "Version": "0.74.0" + }, + "ReportID": "01a129df-705c-7447-93b1-af5b8eaa125c", + "CreatedAt": "2026-10-11T07:31:11.580284541Z", + "ArtifactID": "sha256:b504e33e63ad77e2e103c2924d2f16f73d279b0a1ddd6affac01422524b96eb3", + "ArtifactName": "/artifact/image.tar", + "ArtifactType": "container_image", + "Metadata": { + "Size": 89032192, + "OS": { + "Family": "alpine", + "Name": "3.24.1" + }, + "ImageID": "sha256:625d066416e901eaa2db5e18b96c37559b25dd91bdc3afb3d1ff5e916c7a8a3f", + "DiffIDs": [ + "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c", + "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd", + "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366", + "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe", + "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1", + "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c", + "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59", + "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02", + "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3", + "sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007", + "sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e" + ], + "RepoTags": [ + "informed-decision:zlib-r1-local-20261011" + ], + "Reference": "informed-decision:zlib-r1-local-20261011", + "ImageConfig": { + "architecture": "amd64", + "created": "2026-10-11T09:29:32.511197114+02:00", + "history": [ + { + "created": "2026-06-16T00:01:29.967161902Z", + "created_by": "ADD alpine-minirootfs-3.24.1-x86_64.tar.gz / # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-06-16T00:01:29.967161902Z", + "created_by": "CMD [\"/bin/sh\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV LANG=C.UTF-8", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "RUN /bin/sh -c set -eux; \tapk add --no-cache \t\tca-certificates \t\ttzdata \t; # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PYTHON_VERSION=3.12.14", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:10:30.672225972Z", + "created_by": "RUN /bin/sh -c set -eux; \t\tapk add --no-cache --virtual .build-deps \t\tbluez-dev \t\tbzip2-dev \t\tdpkg-dev dpkg \t\tfindutils \t\tg++ \t\tgcc \t\tgdbm-dev \t\tgnupg \t\tlibc-dev \t\tlibffi-dev \t\tlibnsl-dev \t\tlibtirpc-dev \t\tlinux-headers \t\tmake \t\tncurses-dev \t\topenssl-dev \t\tpax-utils \t\treadline-dev \t\tsqlite-dev \t\ttar \t\ttcl-dev \t\ttk \t\ttk-dev \t\tutil-linux-dev \t\txz \t\txz-dev \t\tzlib-dev \t; \t\twget -O python.tar.xz \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz\"; \techo \"$PYTHON_SHA256 *python.tar.xz\" | sha256sum -c -; \twget -O python.tar.xz.asc \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc\"; \tGNUPGHOME=\"$(mktemp -d)\"; export GNUPGHOME; \tgpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$GPG_KEY\"; \tgpg --batch --verify python.tar.xz.asc python.tar.xz; \tgpgconf --kill all; \trm -rf \"$GNUPGHOME\" python.tar.xz.asc; \tmkdir -p /usr/src/python; \ttar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; \trm python.tar.xz; \t\tcd /usr/src/python; \tgnuArch=\"$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)\"; \t./configure \t\t--build=\"$gnuArch\" \t\t--enable-loadable-sqlite-extensions \t\t--enable-option-checking=fatal \t\t--enable-shared \t\t$(test \"${gnuArch%%-*}\" != 'riscv64' \u0026\u0026 echo '--with-lto') \t\t--with-ensurepip \t; \tnproc=\"$(nproc)\"; \tEXTRA_CFLAGS=\"-DTHREAD_STACK_SIZE=0x100000\"; \tLDFLAGS=\"${LDFLAGS:-} -Wl,--strip-all\"; \tarch=\"$(apk --print-arch)\"; \tcase \"$arch\" in \t\tx86_64|aarch64) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer\"; \t\t\t;; \t\tx86) \t\t\t;; \t\t*) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer\"; \t\t\t;; \tesac; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-}\" \t; \trm python; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\\$\\$ORIGIN/../lib'\" \t\tpython \t; \tmake install; \t\tcd /; \trm -rf /usr/src/python; \t\tfind /usr/local -depth \t\t\\( \t\t\t\\( -type d -a \\( -name test -o -name tests -o -name idle_test \\) \\) \t\t\t-o \\( -type f -a \\( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \\) \\) \t\t\\) -exec rm -rf '{}' + \t; \t\tfind /usr/local -type f -executable -not \\( -name '*tkinter*' \\) -exec scanelf --needed --nobanner --format '%n#p' '{}' ';' \t\t| tr ',' '\\n' \t\t| sort -u \t\t| awk 'system(\"[ -e /usr/local/lib/\" $1 \" ]\") == 0 { next } { print \"so:\" $1 }' \t\t| xargs -rt apk add --no-network --virtual .python-rundeps \t; \tapk del --no-network .build-deps; \t\texport PYTHONDONTWRITEBYTECODE=1; \tpython3 --version; \tpip3 --version # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:10:30.782726003Z", + "created_by": "RUN /bin/sh -c set -eux; \tfor src in idle3 pip3 pydoc3 python3 python3-config; do \t\tdst=\"$(echo \"$src\" | tr -d 3)\"; \t\t[ -s \"/usr/local/bin/$src\" ]; \t\t[ ! -e \"/usr/local/bin/$dst\" ]; \t\tln -svT \"$src\" \"/usr/local/bin/$dst\"; \tdone # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:10:30.782726003Z", + "created_by": "CMD [\"python3\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-11T00:49:47.962156876+02:00", + "created_by": "ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-11T00:49:47.962156876+02:00", + "created_by": "RUN /bin/sh -c apk add --no-cache 'libuuid\u003e=2.42.3-r1' \u0026\u0026 addgroup -S -g 10001 informed \u0026\u0026 adduser -S -u 10001 -G informed -H informed # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:55.351944978+02:00", + "created_by": "COPY /opt/venv /opt/venv # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.462092072+02:00", + "created_by": "RUN /bin/sh -c rm -rf /usr/local/bin/pip* /usr/local/lib/python3.12/site-packages/pip* /usr/local/lib/python3.12/site-packages/setuptools* /usr/local/lib/python3.12/site-packages/pkg_resources /opt/venv/bin/pip* /opt/venv/lib/python3.12/site-packages/pip* /opt/venv/lib/python3.12/site-packages/setuptools* /opt/venv/lib/python3.12/site-packages/pkg_resources # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "WORKDIR /app", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "USER 10001:10001", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "EXPOSE [8080/tcp 8081/tcp]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "ENTRYPOINT [\"informed-decision-container\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-11T01:15:11.991443676Z", + "created_by": "/bin/sh -c #(nop) ARG SOURCE_REVISION", + "empty_layer": true + }, + { + "created": "2026-10-11T01:21:04.716126392Z", + "created_by": "/bin/sh -c #(nop) LABEL org.opencontainers.image.revision=3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168 org.opencontainers.image.base.digest=sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173 social.coulomb.source.policy.sha256=9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62 social.coulomb.release.scope=INFD-WP-0009-T04/purpose-overlay-v1", + "empty_layer": true + }, + { + "created": "2026-10-11T01:21:04.787527697Z", + "created_by": "/bin/sh -c #(nop) COPY file:2be9cb36e7253e15733673359cda8caa22986b6888822a008c1b360d909994e0 in /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py " + }, + { + "created": "2026-10-11T09:23:35.324082353+02:00", + "created_by": "/bin/sh -c #(nop) ARG SOURCE_REVISION=uncommitted-T05-local-preparation", + "empty_layer": true + }, + { + "created": "2026-10-11T09:23:36.10318027+02:00", + "created_by": "/bin/sh -c #(nop) ARG SOURCE_CONTEXT_SHA256", + "empty_layer": true + }, + { + "created": "2026-10-11T09:23:36.876646839+02:00", + "created_by": "/bin/sh -c #(nop) USER 0:0", + "empty_layer": true + }, + { + "created": "2026-10-11T07:23:37.652390037Z", + "created_by": "/bin/sh -c #(nop) COPY multi:e4d183fdf93ea6320911bb7398e4860a1b9b96fe0768cfd3d0260955517dd272 in /tmp/infd-zlib/x86_64/ " + }, + { + "created": "2026-10-11T09:29:30.865525337+02:00", + "created_by": "|2 SOURCE_CONTEXT_SHA256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d SOURCE_REVISION=uncommitted-T05-local-preparation /bin/sh -c echo '63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk' | sha256sum -c - \u0026\u0026 echo '24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 /tmp/infd-zlib/x86_64/APKINDEX.tar.gz' | sha256sum -c - \u0026\u0026 apk verify /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk /tmp/infd-zlib/x86_64/APKINDEX.tar.gz \u0026\u0026 apk upgrade --no-logfile --no-network --no-cache --no-preupgrade --repositories-file /dev/null --repository /tmp/infd-zlib zlib \u0026\u0026 apk info --exists 'zlib=1.3.2-r1' \u0026\u0026 rm -rf /tmp/infd-zlib" + }, + { + "created": "2026-10-11T09:29:31.735346534+02:00", + "created_by": "/bin/sh -c #(nop) USER 10001:10001", + "empty_layer": true + }, + { + "created": "2026-10-11T09:29:32.511197114+02:00", + "created_by": "/bin/sh -c #(nop) LABEL org.opencontainers.image.revision=uncommitted-T05-local-preparation org.opencontainers.image.base.digest=sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a social.coulomb.source.context.sha256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d social.coulomb.source.policy.sha256=9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62 social.coulomb.release.scope=INFD-WP-0009-T05/zlib-85091-r1", + "empty_layer": true + } + ], + "os": "linux", + "rootfs": { + "type": "layers", + "diff_ids": [ + "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c", + "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd", + "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366", + "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe", + "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1", + "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c", + "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59", + "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02", + "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3", + "sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007", + "sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e" + ] + }, + "config": { + "Entrypoint": [ + "informed-decision-container" + ], + "Env": [ + "PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "LANG=C.UTF-8", + "GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", + "PYTHON_VERSION=3.12.14", + "PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a", + "PYTHONDONTWRITEBYTECODE=1", + "PYTHONUNBUFFERED=1" + ], + "Labels": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "uncommitted-T05-local-preparation", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "User": "10001:10001", + "WorkingDir": "/app", + "ExposedPorts": { + "8080/tcp": {}, + "8081/tcp": {} + } + } + }, + "Layers": [ + { + "Size": 8697856, + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "Size": 1538048, + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "Size": 47150592, + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "Size": 5120, + "Digest": "sha256:ed62c91ccd94e36a928e96d704cfcf20861302590245cc12aa89a15a5d6be29b", + "DiffID": "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe" + }, + { + "Size": 131584, + "Digest": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86", + "DiffID": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "Size": 30705664, + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "Size": 12288, + "Digest": "sha256:16a3dba6b720d3059eab918cd3596f94145ac9cf4d456f925a21f0f72522863f", + "DiffID": "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59" + }, + { + "Size": 1536, + "Digest": "sha256:e73dd464fbff5607cc62a1b2b66b0eefe737dfad4db8e7b58a48cda7c12d94d3", + "DiffID": "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02" + }, + { + "Size": 15360, + "Digest": "sha256:cfee29c2f8119d2a39714ecbe5095a2dc1c986054f2e1fe0a6565163242417e3", + "DiffID": "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + }, + { + "Size": 588288, + "Digest": "sha256:aa48f13a5258c67abfc00447e2ca2490ee838e166e83bfe7a8b7bb2bf2ee2466", + "DiffID": "sha256:7d2d2d36795c42e5fe8826af00b9751f2d8c328005571c0ca46c1d8c06bd3007" + }, + { + "Size": 185856, + "Digest": "sha256:645872f9a17cb984e868cc31e749d9db7227a520a47e5d39cc5836f98eb2f731", + "DiffID": "sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e" + } + ] + }, + "Results": [ + { + "Target": "/artifact/image.tar (alpine 3.24.1)", + "Class": "os-pkgs", + "Type": "alpine", + "Packages": [ + { + "ID": ".python-rundeps@20260901.001029", + "Name": ".python-rundeps", + "Identifier": { + "PURL": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch\u0026distro=3.24.1", + "UID": "62fa84f88695c077" + }, + "Version": "20260901.001029", + "Arch": "noarch", + "DependsOn": [ + "gdbm@1.26-r0", + "libbz2@1.0.8-r6", + "libcrypto3@3.5.8-r0", + "libffi@3.5.2-r1", + "libncursesw@6.6_p20260516-r0", + "libnsl@2.0.1-r2", + "libpanelw@6.6_p20260516-r0", + "libssl3@3.5.8-r0", + "libtirpc@1.3.5-r1", + "libuuid@2.42.3-r1", + "musl@1.2.6-r2", + "readline@8.3.3-r1", + "sqlite-libs@3.53.4-r0", + "xz-libs@5.8.3-r0", + "zlib@1.3.2-r1" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:51d0c1e7d88a414345799f0309185c625013ef32", + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-baselayout@3.7.2-r1", + "Name": "alpine-baselayout", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "1b9c543300f8073e" + }, + "Version": "3.7.2-r1", + "Arch": "x86_64", + "SrcName": "alpine-baselayout", + "SrcVersion": "3.7.2-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "alpine-baselayout-data@3.7.2-r1", + "busybox-binsh@1.37.0-r31" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:f0fcfdc2f4da058af6473bc45c4eab62916225b2", + "InstalledFiles": [ + "etc/motd", + "etc/crontabs/root", + "etc/modprobe.d/aliases.conf", + "etc/modprobe.d/blacklist.conf", + "etc/modprobe.d/i386.conf", + "etc/profile.d/20locale.sh", + "etc/profile.d/README", + "etc/profile.d/color_prompt.sh.disabled", + "usr/lib/sysctl.d/00-alpine.conf", + "var/lock", + "var/run", + "var/spool/mail", + "var/spool/cron/crontabs" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-baselayout-data@3.7.2-r1", + "Name": "alpine-baselayout-data", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "fcc3cd90122d8aa7" + }, + "Version": "3.7.2-r1", + "Arch": "x86_64", + "SrcName": "alpine-baselayout", + "SrcVersion": "3.7.2-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c6f9bded17d844b6f1b0bb5766d2c35c0d5c8508", + "InstalledFiles": [ + "etc/fstab", + "etc/group", + "etc/hostname", + "etc/hosts", + "etc/inittab", + "etc/modules", + "etc/mtab", + "etc/nsswitch.conf", + "etc/passwd", + "etc/profile", + "etc/protocols", + "etc/services", + "etc/shadow", + "etc/shells", + "etc/sysctl.conf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-keys@2.6-r0", + "Name": "alpine-keys", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "cb1f6c8fa74713e0" + }, + "Version": "2.6-r0", + "Arch": "x86_64", + "SrcName": "alpine-keys", + "SrcVersion": "2.6-r0", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:d8d6b80e53c059a77e4915da78ba964f3ffea240", + "InstalledFiles": [ + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", + "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", + "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", + "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", + "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", + "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", + "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", + "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", + "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", + "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", + "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", + "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", + "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-release@3.24.1-r0", + "Name": "alpine-release", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "6cfad6f36e1f31aa" + }, + "Version": "3.24.1-r0", + "Arch": "x86_64", + "SrcName": "alpine-base", + "SrcVersion": "3.24.1-r0", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "alpine-keys@2.6-r0" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:bc6912a25cdc7733e0035ed509eceaa4026946e3", + "InstalledFiles": [ + "etc/alpine-release", + "etc/issue", + "etc/os-release", + "etc/secfixes.d/alpine", + "usr/lib/os-release" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "apk-tools@3.0.6-r0", + "Name": "apk-tools", + "Identifier": { + "PURL": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "b37730591f24ae44" + }, + "Version": "3.0.6-r0", + "Arch": "x86_64", + "SrcName": "apk-tools", + "SrcVersion": "3.0.6-r0", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "ca-certificates-bundle@20260611-r0", + "libapk@3.0.6-r0", + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2", + "zlib@1.3.2-r1" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:043333589798a1f52e09ae63f026c6c8fa676d34", + "InstalledFiles": [ + "sbin/apk" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "busybox@1.37.0-r31", + "Name": "busybox", + "Identifier": { + "PURL": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "771020c43c8440bf" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:b5405ebc02f7dd8be95b6265c54b243d5456ab8f", + "InstalledFiles": [ + "bin/busybox", + "etc/securetty", + "etc/busybox-paths.d/busybox", + "etc/logrotate.d/acpid", + "etc/network/if-up.d/dad", + "etc/udhcpc/udhcpc.conf", + "usr/share/udhcpc/default.script" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "busybox-binsh@1.37.0-r31", + "Name": "busybox-binsh", + "Identifier": { + "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "1ec8a3d5d2b63297" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "busybox@1.37.0-r31" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:5cbd14acc6f1804c5bac6c77dc2c492f010b0fc7", + "InstalledFiles": [ + "bin/sh" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ca-certificates@20260611-r0", + "Name": "ca-certificates", + "Identifier": { + "PURL": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "2a3c316ee83c6198" + }, + "Version": "20260611-r0", + "Arch": "x86_64", + "SrcName": "ca-certificates", + "SrcVersion": "20260611-r0", + "Licenses": [ + "MPL-2.0", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "busybox-binsh@1.37.0-r31", + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + "Digest": "sha1:8f2a04abeb54b331e2970a0a0dffb7bd6bdde567", + "InstalledFiles": [ + "etc/ca-certificates.conf", + "etc/apk/protected_paths.d/ca-certificates.list", + "etc/ca-certificates/update.d/certhash", + "usr/bin/c_rehash", + "usr/sbin/update-ca-certificates", + "usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", + "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", + "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", + "usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", + "usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", + "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", + "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", + "usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", + "usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", + "usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", + "usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", + "usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", + "usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", + "usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", + "usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", + "usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", + "usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", + "usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", + "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", + "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", + "usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", + "usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", + "usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", + "usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", + "usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/Izenpe.com.crt", + "usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", + "usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", + "usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", + "usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", + "usr/share/ca-certificates/mozilla/OISTE_Server_Root_ECC_G1.crt", + "usr/share/ca-certificates/mozilla/OISTE_Server_Root_RSA_G1.crt", + "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", + "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", + "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", + "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", + "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", + "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", + "usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", + "usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", + "usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", + "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", + "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", + "usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", + "usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", + "usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", + "usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", + "usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt", + "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", + "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", + "usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", + "usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", + "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", + "usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", + "usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", + "usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", + "usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", + "usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", + "usr/share/ca-certificates/mozilla/e-Szigno_TLS_Root_CA_2023.crt", + "usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", + "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", + "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", + "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", + "usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", + "usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ca-certificates-bundle@20260611-r0", + "Name": "ca-certificates-bundle", + "Identifier": { + "PURL": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "20337c2ea28bef28" + }, + "Version": "20260611-r0", + "Arch": "x86_64", + "SrcName": "ca-certificates", + "SrcVersion": "20260611-r0", + "Licenses": [ + "MPL-2.0", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c9534a03750bdfae341f10969016090fc11febbd", + "InstalledFiles": [ + "etc/ssl/cert.pem", + "etc/ssl/certs/ca-certificates.crt", + "etc/ssl1.1/cert.pem", + "etc/ssl1.1/certs" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "gdbm@1.26-r0", + "Name": "gdbm", + "Identifier": { + "PURL": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "5eb1a3f86262ca77" + }, + "Version": "1.26-r0", + "Arch": "x86_64", + "SrcName": "gdbm", + "SrcVersion": "1.26-r0", + "Licenses": [ + "GPL-3.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:619493d8124fe49a8ee1d8f7a1372cf7e3977337", + "InstalledFiles": [ + "usr/lib/libgdbm.so.6", + "usr/lib/libgdbm.so.6.0.0", + "usr/lib/libgdbm_compat.so.4", + "usr/lib/libgdbm_compat.so.4.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "keyutils-libs@1.6.3-r4", + "Name": "keyutils-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64\u0026distro=3.24.1", + "UID": "a1a29120eb342032" + }, + "Version": "1.6.3-r4", + "Arch": "x86_64", + "SrcName": "keyutils", + "SrcVersion": "1.6.3-r4", + "Licenses": [ + "GPL-2.0-or-later", + "LGPL-2.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:b7331c96f077fc3522ee4361a441d1097204cd90", + "InstalledFiles": [ + "usr/lib/libkeyutils.so.1", + "usr/lib/libkeyutils.so.1.10" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "krb5-conf@1.0-r2", + "Name": "krb5-conf", + "Identifier": { + "PURL": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "e7cf94ba8b6dbc33" + }, + "Version": "1.0-r2", + "Arch": "x86_64", + "SrcName": "krb5-conf", + "SrcVersion": "1.0-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:40a11e0690a59e110367b62a80661024e9942a2d", + "InstalledFiles": [ + "etc/krb5.conf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "krb5-libs@1.22.2-r1", + "Name": "krb5-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "958f8b4a4f087dac" + }, + "Version": "1.22.2-r1", + "Arch": "x86_64", + "SrcName": "krb5", + "SrcVersion": "1.22.2-r1", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "keyutils-libs@1.6.3-r4", + "krb5-conf@1.0-r2", + "libcom_err@1.47.4-r0", + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "libverto@0.3.2-r2", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:ef02346e21b817ff379e4601e5b1fc9760e5e31a", + "InstalledFiles": [ + "usr/lib/libgssapi_krb5.so.2", + "usr/lib/libgssapi_krb5.so.2.2", + "usr/lib/libgssrpc.so.4", + "usr/lib/libgssrpc.so.4.2", + "usr/lib/libk5crypto.so.3", + "usr/lib/libk5crypto.so.3.1", + "usr/lib/libkadm5clnt_mit.so.12", + "usr/lib/libkadm5clnt_mit.so.12.0", + "usr/lib/libkadm5srv_mit.so.12", + "usr/lib/libkadm5srv_mit.so.12.0", + "usr/lib/libkdb5.so.10", + "usr/lib/libkdb5.so.10.0", + "usr/lib/libkrad.so.0", + "usr/lib/libkrad.so.0.0", + "usr/lib/libkrb5.so.3", + "usr/lib/libkrb5.so.3.3", + "usr/lib/libkrb5support.so.0", + "usr/lib/libkrb5support.so.0.1", + "usr/lib/krb5/plugins/kdb/db2.so", + "usr/lib/krb5/plugins/preauth/otp.so", + "usr/lib/krb5/plugins/preauth/spake.so", + "usr/lib/krb5/plugins/preauth/test.so", + "usr/lib/krb5/plugins/tls/k5tls.so" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libapk@3.0.6-r0", + "Name": "libapk", + "Identifier": { + "PURL": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "779641db16cf6477" + }, + "Version": "3.0.6-r0", + "Arch": "x86_64", + "SrcName": "apk-tools", + "SrcVersion": "3.0.6-r0", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "musl@1.2.6-r2", + "zlib@1.3.2-r1" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:523a8f58104589f74f743d501c81bf6517155378", + "InstalledFiles": [ + "usr/lib/libapk.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libbz2@1.0.8-r6", + "Name": "libbz2", + "Identifier": { + "PURL": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64\u0026distro=3.24.1", + "UID": "48e17539404e2d56" + }, + "Version": "1.0.8-r6", + "Arch": "x86_64", + "SrcName": "bzip2", + "SrcVersion": "1.0.8-r6", + "Licenses": [ + "bzip-2-1.0.6" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:08566ba5c7af97c25474be8b24e8b48f0116b67d", + "InstalledFiles": [ + "usr/lib/libbz2.so.1", + "usr/lib/libbz2.so.1.0.8" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libcom_err@1.47.4-r0", + "Name": "libcom_err", + "Identifier": { + "PURL": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "3fc35a3f66d192af" + }, + "Version": "1.47.4-r0", + "Arch": "x86_64", + "SrcName": "e2fsprogs", + "SrcVersion": "1.47.4-r0", + "Licenses": [ + "GPL-2.0-or-later", + "LGPL-2.0-or-later", + "BSD-3-Clause", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:4b9fb5899ea0b1c0cfbb2a2c5952704437d4ecef", + "InstalledFiles": [ + "usr/lib/libcom_err.so.2", + "usr/lib/libcom_err.so.2.1" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libcrypto3@3.5.8-r0", + "Name": "libcrypto3", + "Identifier": { + "PURL": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "4299bba2ba9c96aa" + }, + "Version": "3.5.8-r0", + "Arch": "x86_64", + "SrcName": "openssl", + "SrcVersion": "3.5.8-r0", + "Licenses": [ + "Apache-2.0" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:1b3b9fc0c136f4936932bcb2ec21499f0ae5dfd3", + "InstalledFiles": [ + "etc/ssl/ct_log_list.cnf", + "etc/ssl/ct_log_list.cnf.dist", + "etc/ssl/openssl.cnf", + "etc/ssl/openssl.cnf.dist", + "usr/lib/libcrypto.so.3", + "usr/lib/engines-3/afalg.so", + "usr/lib/engines-3/capi.so", + "usr/lib/engines-3/loader_attic.so", + "usr/lib/engines-3/padlock.so", + "usr/lib/ossl-modules/legacy.so" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libffi@3.5.2-r1", + "Name": "libffi", + "Identifier": { + "PURL": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "d3eaa921287b1ccd" + }, + "Version": "3.5.2-r1", + "Arch": "x86_64", + "SrcName": "libffi", + "SrcVersion": "3.5.2-r1", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:2f7b261f7fcecc4eebd8b330e7f6fb80713bfe3a", + "InstalledFiles": [ + "usr/lib/libffi.so.8", + "usr/lib/libffi.so.8.2.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libintl@1.0-r0", + "Name": "libintl", + "Identifier": { + "PURL": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "25c18808d8fc87e0" + }, + "Version": "1.0-r0", + "Arch": "x86_64", + "SrcName": "gettext", + "SrcVersion": "1.0-r0", + "Licenses": [ + "LGPL-2.1-or-later" + ], + "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:282d6642ccac87237e43a864159d73cf5abe7550", + "InstalledFiles": [ + "usr/lib/libintl.so.8", + "usr/lib/libintl.so.8.4.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libncursesw@6.6_p20260516-r0", + "Name": "libncursesw", + "Identifier": { + "PURL": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e8939f45e2191bcc" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "DependsOn": [ + "musl@1.2.6-r2", + "ncurses-terminfo-base@6.6_p20260516-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:9f318e6e324d6827274829194cf6ac6afbaded12", + "InstalledFiles": [ + "usr/lib/libncursesw.so.6", + "usr/lib/libncursesw.so.6.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libnsl@2.0.1-r2", + "Name": "libnsl", + "Identifier": { + "PURL": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "3d893c60d41da67b" + }, + "Version": "2.0.1-r2", + "Arch": "x86_64", + "SrcName": "libnsl", + "SrcVersion": "2.0.1-r2", + "Licenses": [ + "LGPL-2.0-or-later" + ], + "DependsOn": [ + "libintl@1.0-r0", + "libtirpc@1.3.5-r1", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:5194adbf26560b52be318481a7af294ab05fd795", + "InstalledFiles": [ + "usr/lib/libnsl.so.3", + "usr/lib/libnsl.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libpanelw@6.6_p20260516-r0", + "Name": "libpanelw", + "Identifier": { + "PURL": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "ef1ad9bb256b373" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "DependsOn": [ + "libncursesw@6.6_p20260516-r0", + "musl@1.2.6-r2", + "ncurses-terminfo-base@6.6_p20260516-r0" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:149bdc434232ed11fc5bb975ba519a07154a6f56", + "InstalledFiles": [ + "usr/lib/libpanelw.so.6", + "usr/lib/libpanelw.so.6.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libssl3@3.5.8-r0", + "Name": "libssl3", + "Identifier": { + "PURL": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "f290ab59b88b1c4a" + }, + "Version": "3.5.8-r0", + "Arch": "x86_64", + "SrcName": "openssl", + "SrcVersion": "3.5.8-r0", + "Licenses": [ + "Apache-2.0" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:5f9b1e55d821953d2e2b1db322dad70a3b5041ea", + "InstalledFiles": [ + "usr/lib/libssl.so.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libtirpc@1.3.5-r1", + "Name": "libtirpc", + "Identifier": { + "PURL": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "471c8d955ca03be5" + }, + "Version": "1.3.5-r1", + "Arch": "x86_64", + "SrcName": "libtirpc", + "SrcVersion": "1.3.5-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "krb5-libs@1.22.2-r1", + "libtirpc-conf@1.3.5-r1", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:c32865bd86a8b8829d152279cabbc5ac6d430eb2", + "InstalledFiles": [ + "usr/lib/libtirpc.so.3", + "usr/lib/libtirpc.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libtirpc-conf@1.3.5-r1", + "Name": "libtirpc-conf", + "Identifier": { + "PURL": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "3437392c14aad33f" + }, + "Version": "1.3.5-r1", + "Arch": "x86_64", + "SrcName": "libtirpc", + "SrcVersion": "1.3.5-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:0c17d9988dc986c90e22f79778df047eca9973ff", + "InstalledFiles": [ + "etc/bindresvport.blacklist", + "etc/netconfig" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libuuid@2.42.3-r1", + "Name": "libuuid", + "Identifier": { + "PURL": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "c444e9cdd1bdda40" + }, + "Version": "2.42.3-r1", + "Arch": "x86_64", + "SrcName": "util-linux", + "SrcVersion": "2.42.3-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86", + "DiffID": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + "Digest": "sha1:8f041ef637ad75f381cc0c034f2afbbb0303264e", + "InstalledFiles": [ + "usr/lib/libuuid.so.1", + "usr/lib/libuuid.so.1.3.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libverto@0.3.2-r2", + "Name": "libverto", + "Identifier": { + "PURL": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "9df4321a283a6cf6" + }, + "Version": "0.3.2-r2", + "Arch": "x86_64", + "SrcName": "libverto", + "SrcVersion": "0.3.2-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:73233059338142e4ac6d8fb8bb0074e93da75dc1", + "InstalledFiles": [ + "usr/lib/libverto.so.1", + "usr/lib/libverto.so.1.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "musl@1.2.6-r2", + "Name": "musl", + "Identifier": { + "PURL": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "1f8cb44befe503d4" + }, + "Version": "1.2.6-r2", + "Arch": "x86_64", + "SrcName": "musl", + "SrcVersion": "1.2.6-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:0f7e5827e4e1a73631beda27b78431a8ba240e05", + "InstalledFiles": [ + "lib/ld-musl-x86_64.so.1", + "lib/libc.musl-x86_64.so.1" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "musl-utils@1.2.6-r2", + "Name": "musl-utils", + "Identifier": { + "PURL": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "4497482ec1d943e1" + }, + "Version": "1.2.6-r2", + "Arch": "x86_64", + "SrcName": "musl", + "SrcVersion": "1.2.6-r2", + "Licenses": [ + "MIT", + "BSD-2-Clause", + "GPL-2.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2", + "scanelf@1.3.9-r1" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:75ada3c48d63ec5d87c42fdf934a3fdd11298dc5", + "InstalledFiles": [ + "sbin/ldconfig", + "usr/bin/getconf", + "usr/bin/getent", + "usr/bin/iconv", + "usr/bin/ldd" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ncurses-terminfo-base@6.6_p20260516-r0", + "Name": "ncurses-terminfo-base", + "Identifier": { + "PURL": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e7fac5c6a6e9ae8" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:9d551d828e9c8ee52c5801c1d6046828ebf15752", + "InstalledFiles": [ + "etc/terminfo/a/alacritty", + "etc/terminfo/a/ansi", + "etc/terminfo/d/dumb", + "etc/terminfo/g/gnome", + "etc/terminfo/g/gnome-256color", + "etc/terminfo/k/konsole", + "etc/terminfo/k/konsole-256color", + "etc/terminfo/k/konsole-linux", + "etc/terminfo/l/linux", + "etc/terminfo/p/putty", + "etc/terminfo/p/putty-256color", + "etc/terminfo/r/rxvt", + "etc/terminfo/r/rxvt-256color", + "etc/terminfo/s/screen", + "etc/terminfo/s/screen-256color", + "etc/terminfo/s/st-0.6", + "etc/terminfo/s/st-0.7", + "etc/terminfo/s/st-0.8", + "etc/terminfo/s/st-0.8.5", + "etc/terminfo/s/st-16color", + "etc/terminfo/s/st-256color", + "etc/terminfo/s/st-direct", + "etc/terminfo/s/sun", + "etc/terminfo/t/terminator", + "etc/terminfo/t/terminology", + "etc/terminfo/t/terminology-0.6.1", + "etc/terminfo/t/terminology-1.0.0", + "etc/terminfo/t/terminology-1.8.1", + "etc/terminfo/t/tmux", + "etc/terminfo/t/tmux-256color", + "etc/terminfo/v/vt100", + "etc/terminfo/v/vt102", + "etc/terminfo/v/vt200", + "etc/terminfo/v/vt220", + "etc/terminfo/v/vt52", + "etc/terminfo/v/vte", + "etc/terminfo/v/vte-256color", + "etc/terminfo/x/xterm", + "etc/terminfo/x/xterm-256color", + "etc/terminfo/x/xterm-color", + "etc/terminfo/x/xterm-xfree86" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "readline@8.3.3-r1", + "Name": "readline", + "Identifier": { + "PURL": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "f50058781c93e1f2" + }, + "Version": "8.3.3-r1", + "Arch": "x86_64", + "SrcName": "readline", + "SrcVersion": "8.3.3-r1", + "Licenses": [ + "GPL-3.0-or-later" + ], + "Maintainer": "qaqland \u003cqaq@qaq.land\u003e", + "DependsOn": [ + "libncursesw@6.6_p20260516-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:945b16e378bc00e44d89d4de8124bba7647fdf4d", + "InstalledFiles": [ + "etc/inputrc", + "usr/lib/libreadline.so.8", + "usr/lib/libreadline.so.8.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "scanelf@1.3.9-r1", + "Name": "scanelf", + "Identifier": { + "PURL": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "936394657a1626fb" + }, + "Version": "1.3.9-r1", + "Arch": "x86_64", + "SrcName": "pax-utils", + "SrcVersion": "1.3.9-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:013f903d0ba219673aebbdd04f74bb5ed82b01f0", + "InstalledFiles": [ + "usr/bin/scanelf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "sqlite-libs@3.53.4-r0", + "Name": "sqlite-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "8b10aee2ccc192de" + }, + "Version": "3.53.4-r0", + "Arch": "x86_64", + "SrcName": "sqlite", + "SrcVersion": "3.53.4-r0", + "Licenses": [ + "blessing" + ], + "Maintainer": "Jingyun Hua \u003chuajingyun@loongson.cn\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:f7630ceb37c232b6609861aeab6cdb9cd120e6fa", + "InstalledFiles": [ + "usr/lib/libsqlite3.so.0", + "usr/lib/libsqlite3.so.3.53.4" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ssl_client@1.37.0-r31", + "Name": "ssl_client", + "Identifier": { + "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "d42e31f15a4ce47a" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4", + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c220f4a5125a313af733e98def94132bb1e9d40d", + "InstalledFiles": [ + "usr/bin/ssl_client" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "tzdata@2026c-r0", + "Name": "tzdata", + "Identifier": { + "PURL": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "52c6b50eff629f9d" + }, + "Version": "2026c-r0", + "Arch": "x86_64", + "SrcName": "tzdata", + "SrcVersion": "2026c-r0", + "Licenses": [ + "Public-Domain" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "Digest": "sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb", + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + "Digest": "sha1:61f7544ecd8dd63eac23fe3e645702fda92ef02a", + "InstalledFiles": [ + "usr/share/zoneinfo/CET", + "usr/share/zoneinfo/CST6CDT", + "usr/share/zoneinfo/Cuba", + "usr/share/zoneinfo/EET", + "usr/share/zoneinfo/EST", + "usr/share/zoneinfo/EST5EDT", + "usr/share/zoneinfo/Egypt", + "usr/share/zoneinfo/Eire", + "usr/share/zoneinfo/Factory", + "usr/share/zoneinfo/GB", + "usr/share/zoneinfo/GB-Eire", + "usr/share/zoneinfo/GMT", + "usr/share/zoneinfo/GMT+0", + "usr/share/zoneinfo/GMT-0", + "usr/share/zoneinfo/GMT0", + "usr/share/zoneinfo/Greenwich", + "usr/share/zoneinfo/HST", + "usr/share/zoneinfo/Hongkong", + "usr/share/zoneinfo/Iceland", + "usr/share/zoneinfo/Iran", + "usr/share/zoneinfo/Israel", + "usr/share/zoneinfo/Jamaica", + "usr/share/zoneinfo/Japan", + "usr/share/zoneinfo/Kwajalein", + "usr/share/zoneinfo/Libya", + "usr/share/zoneinfo/MET", + "usr/share/zoneinfo/MST", + "usr/share/zoneinfo/MST7MDT", + "usr/share/zoneinfo/NZ", + "usr/share/zoneinfo/NZ-CHAT", + "usr/share/zoneinfo/Navajo", + "usr/share/zoneinfo/PRC", + "usr/share/zoneinfo/PST8PDT", + "usr/share/zoneinfo/Poland", + "usr/share/zoneinfo/Portugal", + "usr/share/zoneinfo/ROC", + "usr/share/zoneinfo/ROK", + "usr/share/zoneinfo/Singapore", + "usr/share/zoneinfo/Turkey", + "usr/share/zoneinfo/UCT", + "usr/share/zoneinfo/UTC", + "usr/share/zoneinfo/Universal", + "usr/share/zoneinfo/W-SU", + "usr/share/zoneinfo/WET", + "usr/share/zoneinfo/Zulu", + "usr/share/zoneinfo/iso3166.tab", + "usr/share/zoneinfo/leap-seconds.list", + "usr/share/zoneinfo/posixrules", + "usr/share/zoneinfo/zone.tab", + "usr/share/zoneinfo/zone1970.tab", + "usr/share/zoneinfo/Africa/Abidjan", + "usr/share/zoneinfo/Africa/Accra", + "usr/share/zoneinfo/Africa/Addis_Ababa", + "usr/share/zoneinfo/Africa/Algiers", + "usr/share/zoneinfo/Africa/Asmara", + "usr/share/zoneinfo/Africa/Asmera", + "usr/share/zoneinfo/Africa/Bamako", + "usr/share/zoneinfo/Africa/Bangui", + "usr/share/zoneinfo/Africa/Banjul", + "usr/share/zoneinfo/Africa/Bissau", + "usr/share/zoneinfo/Africa/Blantyre", + "usr/share/zoneinfo/Africa/Brazzaville", + "usr/share/zoneinfo/Africa/Bujumbura", + "usr/share/zoneinfo/Africa/Cairo", + "usr/share/zoneinfo/Africa/Casablanca", + "usr/share/zoneinfo/Africa/Ceuta", + "usr/share/zoneinfo/Africa/Conakry", + "usr/share/zoneinfo/Africa/Dakar", + "usr/share/zoneinfo/Africa/Dar_es_Salaam", + "usr/share/zoneinfo/Africa/Djibouti", + "usr/share/zoneinfo/Africa/Douala", + "usr/share/zoneinfo/Africa/El_Aaiun", + "usr/share/zoneinfo/Africa/Freetown", + "usr/share/zoneinfo/Africa/Gaborone", + "usr/share/zoneinfo/Africa/Harare", + "usr/share/zoneinfo/Africa/Johannesburg", + "usr/share/zoneinfo/Africa/Juba", + "usr/share/zoneinfo/Africa/Kampala", + "usr/share/zoneinfo/Africa/Khartoum", + "usr/share/zoneinfo/Africa/Kigali", + "usr/share/zoneinfo/Africa/Kinshasa", + "usr/share/zoneinfo/Africa/Lagos", + "usr/share/zoneinfo/Africa/Libreville", + "usr/share/zoneinfo/Africa/Lome", + "usr/share/zoneinfo/Africa/Luanda", + "usr/share/zoneinfo/Africa/Lubumbashi", + "usr/share/zoneinfo/Africa/Lusaka", + "usr/share/zoneinfo/Africa/Malabo", + "usr/share/zoneinfo/Africa/Maputo", + "usr/share/zoneinfo/Africa/Maseru", + "usr/share/zoneinfo/Africa/Mbabane", + "usr/share/zoneinfo/Africa/Mogadishu", + "usr/share/zoneinfo/Africa/Monrovia", + "usr/share/zoneinfo/Africa/Nairobi", + "usr/share/zoneinfo/Africa/Ndjamena", + "usr/share/zoneinfo/Africa/Niamey", + "usr/share/zoneinfo/Africa/Nouakchott", + "usr/share/zoneinfo/Africa/Ouagadougou", + "usr/share/zoneinfo/Africa/Porto-Novo", + "usr/share/zoneinfo/Africa/Sao_Tome", + "usr/share/zoneinfo/Africa/Timbuktu", + "usr/share/zoneinfo/Africa/Tripoli", + "usr/share/zoneinfo/Africa/Tunis", + "usr/share/zoneinfo/Africa/Windhoek", + "usr/share/zoneinfo/America/Adak", + "usr/share/zoneinfo/America/Anchorage", + "usr/share/zoneinfo/America/Anguilla", + "usr/share/zoneinfo/America/Antigua", + "usr/share/zoneinfo/America/Araguaina", + "usr/share/zoneinfo/America/Aruba", + "usr/share/zoneinfo/America/Asuncion", + "usr/share/zoneinfo/America/Atikokan", + "usr/share/zoneinfo/America/Atka", + "usr/share/zoneinfo/America/Bahia", + "usr/share/zoneinfo/America/Bahia_Banderas", + "usr/share/zoneinfo/America/Barbados", + "usr/share/zoneinfo/America/Belem", + "usr/share/zoneinfo/America/Belize", + "usr/share/zoneinfo/America/Blanc-Sablon", + "usr/share/zoneinfo/America/Boa_Vista", + "usr/share/zoneinfo/America/Bogota", + "usr/share/zoneinfo/America/Boise", + "usr/share/zoneinfo/America/Buenos_Aires", + "usr/share/zoneinfo/America/Cambridge_Bay", + "usr/share/zoneinfo/America/Campo_Grande", + "usr/share/zoneinfo/America/Cancun", + "usr/share/zoneinfo/America/Caracas", + "usr/share/zoneinfo/America/Catamarca", + "usr/share/zoneinfo/America/Cayenne", + "usr/share/zoneinfo/America/Cayman", + "usr/share/zoneinfo/America/Chicago", + "usr/share/zoneinfo/America/Chihuahua", + "usr/share/zoneinfo/America/Ciudad_Juarez", + "usr/share/zoneinfo/America/Coral_Harbour", + "usr/share/zoneinfo/America/Cordoba", + "usr/share/zoneinfo/America/Costa_Rica", + "usr/share/zoneinfo/America/Coyhaique", + "usr/share/zoneinfo/America/Creston", + "usr/share/zoneinfo/America/Cuiaba", + "usr/share/zoneinfo/America/Curacao", + "usr/share/zoneinfo/America/Danmarkshavn", + "usr/share/zoneinfo/America/Dawson", + "usr/share/zoneinfo/America/Dawson_Creek", + "usr/share/zoneinfo/America/Denver", + "usr/share/zoneinfo/America/Detroit", + "usr/share/zoneinfo/America/Dominica", + "usr/share/zoneinfo/America/Edmonton", + "usr/share/zoneinfo/America/Eirunepe", + "usr/share/zoneinfo/America/El_Salvador", + "usr/share/zoneinfo/America/Ensenada", + "usr/share/zoneinfo/America/Fort_Nelson", + "usr/share/zoneinfo/America/Fort_Wayne", + "usr/share/zoneinfo/America/Fortaleza", + "usr/share/zoneinfo/America/Glace_Bay", + "usr/share/zoneinfo/America/Godthab", + "usr/share/zoneinfo/America/Goose_Bay", + "usr/share/zoneinfo/America/Grand_Turk", + "usr/share/zoneinfo/America/Grenada", + "usr/share/zoneinfo/America/Guadeloupe", + "usr/share/zoneinfo/America/Guatemala", + "usr/share/zoneinfo/America/Guayaquil", + "usr/share/zoneinfo/America/Guyana", + "usr/share/zoneinfo/America/Halifax", + "usr/share/zoneinfo/America/Havana", + "usr/share/zoneinfo/America/Hermosillo", + "usr/share/zoneinfo/America/Indianapolis", + "usr/share/zoneinfo/America/Inuvik", + "usr/share/zoneinfo/America/Iqaluit", + "usr/share/zoneinfo/America/Jamaica", + "usr/share/zoneinfo/America/Jujuy", + "usr/share/zoneinfo/America/Juneau", + "usr/share/zoneinfo/America/Knox_IN", + "usr/share/zoneinfo/America/Kralendijk", + "usr/share/zoneinfo/America/La_Paz", + "usr/share/zoneinfo/America/Lima", + "usr/share/zoneinfo/America/Los_Angeles", + "usr/share/zoneinfo/America/Louisville", + "usr/share/zoneinfo/America/Lower_Princes", + "usr/share/zoneinfo/America/Maceio", + "usr/share/zoneinfo/America/Managua", + "usr/share/zoneinfo/America/Manaus", + "usr/share/zoneinfo/America/Marigot", + "usr/share/zoneinfo/America/Martinique", + "usr/share/zoneinfo/America/Matamoros", + "usr/share/zoneinfo/America/Mazatlan", + "usr/share/zoneinfo/America/Mendoza", + "usr/share/zoneinfo/America/Menominee", + "usr/share/zoneinfo/America/Merida", + "usr/share/zoneinfo/America/Metlakatla", + "usr/share/zoneinfo/America/Mexico_City", + "usr/share/zoneinfo/America/Miquelon", + "usr/share/zoneinfo/America/Moncton", + "usr/share/zoneinfo/America/Monterrey", + "usr/share/zoneinfo/America/Montevideo", + "usr/share/zoneinfo/America/Montreal", + "usr/share/zoneinfo/America/Montserrat", + "usr/share/zoneinfo/America/Nassau", + "usr/share/zoneinfo/America/New_York", + "usr/share/zoneinfo/America/Nipigon", + "usr/share/zoneinfo/America/Nome", + "usr/share/zoneinfo/America/Noronha", + "usr/share/zoneinfo/America/Nuuk", + "usr/share/zoneinfo/America/Ojinaga", + "usr/share/zoneinfo/America/Panama", + "usr/share/zoneinfo/America/Pangnirtung", + "usr/share/zoneinfo/America/Paramaribo", + "usr/share/zoneinfo/America/Phoenix", + "usr/share/zoneinfo/America/Port-au-Prince", + "usr/share/zoneinfo/America/Port_of_Spain", + "usr/share/zoneinfo/America/Porto_Acre", + "usr/share/zoneinfo/America/Porto_Velho", + "usr/share/zoneinfo/America/Puerto_Rico", + "usr/share/zoneinfo/America/Punta_Arenas", + "usr/share/zoneinfo/America/Rainy_River", + "usr/share/zoneinfo/America/Rankin_Inlet", + "usr/share/zoneinfo/America/Recife", + "usr/share/zoneinfo/America/Regina", + "usr/share/zoneinfo/America/Resolute", + "usr/share/zoneinfo/America/Rio_Branco", + "usr/share/zoneinfo/America/Rosario", + "usr/share/zoneinfo/America/Santa_Isabel", + "usr/share/zoneinfo/America/Santarem", + "usr/share/zoneinfo/America/Santiago", + "usr/share/zoneinfo/America/Santo_Domingo", + "usr/share/zoneinfo/America/Sao_Paulo", + "usr/share/zoneinfo/America/Scoresbysund", + "usr/share/zoneinfo/America/Shiprock", + "usr/share/zoneinfo/America/Sitka", + "usr/share/zoneinfo/America/St_Barthelemy", + "usr/share/zoneinfo/America/St_Johns", + "usr/share/zoneinfo/America/St_Kitts", + "usr/share/zoneinfo/America/St_Lucia", + "usr/share/zoneinfo/America/St_Thomas", + "usr/share/zoneinfo/America/St_Vincent", + "usr/share/zoneinfo/America/Swift_Current", + "usr/share/zoneinfo/America/Tegucigalpa", + "usr/share/zoneinfo/America/Thule", + "usr/share/zoneinfo/America/Thunder_Bay", + "usr/share/zoneinfo/America/Tijuana", + "usr/share/zoneinfo/America/Toronto", + "usr/share/zoneinfo/America/Tortola", + "usr/share/zoneinfo/America/Vancouver", + "usr/share/zoneinfo/America/Virgin", + "usr/share/zoneinfo/America/Whitehorse", + "usr/share/zoneinfo/America/Winnipeg", + "usr/share/zoneinfo/America/Yakutat", + "usr/share/zoneinfo/America/Yellowknife", + "usr/share/zoneinfo/America/Argentina/Buenos_Aires", + "usr/share/zoneinfo/America/Argentina/Catamarca", + "usr/share/zoneinfo/America/Argentina/ComodRivadavia", + "usr/share/zoneinfo/America/Argentina/Cordoba", + "usr/share/zoneinfo/America/Argentina/Jujuy", + "usr/share/zoneinfo/America/Argentina/La_Rioja", + "usr/share/zoneinfo/America/Argentina/Mendoza", + "usr/share/zoneinfo/America/Argentina/Rio_Gallegos", + "usr/share/zoneinfo/America/Argentina/Salta", + "usr/share/zoneinfo/America/Argentina/San_Juan", + "usr/share/zoneinfo/America/Argentina/San_Luis", + "usr/share/zoneinfo/America/Argentina/Tucuman", + "usr/share/zoneinfo/America/Argentina/Ushuaia", + "usr/share/zoneinfo/America/Indiana/Indianapolis", + "usr/share/zoneinfo/America/Indiana/Knox", + "usr/share/zoneinfo/America/Indiana/Marengo", + "usr/share/zoneinfo/America/Indiana/Petersburg", + "usr/share/zoneinfo/America/Indiana/Tell_City", + "usr/share/zoneinfo/America/Indiana/Vevay", + "usr/share/zoneinfo/America/Indiana/Vincennes", + "usr/share/zoneinfo/America/Indiana/Winamac", + "usr/share/zoneinfo/America/Kentucky/Louisville", + "usr/share/zoneinfo/America/Kentucky/Monticello", + "usr/share/zoneinfo/America/North_Dakota/Beulah", + "usr/share/zoneinfo/America/North_Dakota/Center", + "usr/share/zoneinfo/America/North_Dakota/New_Salem", + "usr/share/zoneinfo/Antarctica/Casey", + "usr/share/zoneinfo/Antarctica/Davis", + "usr/share/zoneinfo/Antarctica/DumontDUrville", + "usr/share/zoneinfo/Antarctica/Macquarie", + "usr/share/zoneinfo/Antarctica/Mawson", + "usr/share/zoneinfo/Antarctica/McMurdo", + "usr/share/zoneinfo/Antarctica/Palmer", + "usr/share/zoneinfo/Antarctica/Rothera", + "usr/share/zoneinfo/Antarctica/South_Pole", + "usr/share/zoneinfo/Antarctica/Syowa", + "usr/share/zoneinfo/Antarctica/Troll", + "usr/share/zoneinfo/Antarctica/Vostok", + "usr/share/zoneinfo/Arctic/Longyearbyen", + "usr/share/zoneinfo/Asia/Aden", + "usr/share/zoneinfo/Asia/Almaty", + "usr/share/zoneinfo/Asia/Amman", + "usr/share/zoneinfo/Asia/Anadyr", + "usr/share/zoneinfo/Asia/Aqtau", + "usr/share/zoneinfo/Asia/Aqtobe", + "usr/share/zoneinfo/Asia/Ashgabat", + "usr/share/zoneinfo/Asia/Ashkhabad", + "usr/share/zoneinfo/Asia/Atyrau", + "usr/share/zoneinfo/Asia/Baghdad", + "usr/share/zoneinfo/Asia/Bahrain", + "usr/share/zoneinfo/Asia/Baku", + "usr/share/zoneinfo/Asia/Bangkok", + "usr/share/zoneinfo/Asia/Barnaul", + "usr/share/zoneinfo/Asia/Beirut", + "usr/share/zoneinfo/Asia/Bishkek", + "usr/share/zoneinfo/Asia/Brunei", + "usr/share/zoneinfo/Asia/Calcutta", + "usr/share/zoneinfo/Asia/Chita", + "usr/share/zoneinfo/Asia/Choibalsan", + "usr/share/zoneinfo/Asia/Chongqing", + "usr/share/zoneinfo/Asia/Chungking", + "usr/share/zoneinfo/Asia/Colombo", + "usr/share/zoneinfo/Asia/Dacca", + "usr/share/zoneinfo/Asia/Damascus", + "usr/share/zoneinfo/Asia/Dhaka", + "usr/share/zoneinfo/Asia/Dili", + "usr/share/zoneinfo/Asia/Dubai", + "usr/share/zoneinfo/Asia/Dushanbe", + "usr/share/zoneinfo/Asia/Famagusta", + "usr/share/zoneinfo/Asia/Gaza", + "usr/share/zoneinfo/Asia/Harbin", + "usr/share/zoneinfo/Asia/Hebron", + "usr/share/zoneinfo/Asia/Ho_Chi_Minh", + "usr/share/zoneinfo/Asia/Hong_Kong", + "usr/share/zoneinfo/Asia/Hovd", + "usr/share/zoneinfo/Asia/Irkutsk", + "usr/share/zoneinfo/Asia/Istanbul", + "usr/share/zoneinfo/Asia/Jakarta", + "usr/share/zoneinfo/Asia/Jayapura", + "usr/share/zoneinfo/Asia/Jerusalem", + "usr/share/zoneinfo/Asia/Kabul", + "usr/share/zoneinfo/Asia/Kamchatka", + "usr/share/zoneinfo/Asia/Karachi", + "usr/share/zoneinfo/Asia/Kashgar", + "usr/share/zoneinfo/Asia/Kathmandu", + "usr/share/zoneinfo/Asia/Katmandu", + "usr/share/zoneinfo/Asia/Khandyga", + "usr/share/zoneinfo/Asia/Kolkata", + "usr/share/zoneinfo/Asia/Krasnoyarsk", + "usr/share/zoneinfo/Asia/Kuala_Lumpur", + "usr/share/zoneinfo/Asia/Kuching", + "usr/share/zoneinfo/Asia/Kuwait", + "usr/share/zoneinfo/Asia/Macao", + "usr/share/zoneinfo/Asia/Macau", + "usr/share/zoneinfo/Asia/Magadan", + "usr/share/zoneinfo/Asia/Makassar", + "usr/share/zoneinfo/Asia/Manila", + "usr/share/zoneinfo/Asia/Muscat", + "usr/share/zoneinfo/Asia/Nicosia", + "usr/share/zoneinfo/Asia/Novokuznetsk", + "usr/share/zoneinfo/Asia/Novosibirsk", + "usr/share/zoneinfo/Asia/Omsk", + "usr/share/zoneinfo/Asia/Oral", + "usr/share/zoneinfo/Asia/Phnom_Penh", + "usr/share/zoneinfo/Asia/Pontianak", + "usr/share/zoneinfo/Asia/Pyongyang", + "usr/share/zoneinfo/Asia/Qatar", + "usr/share/zoneinfo/Asia/Qostanay", + "usr/share/zoneinfo/Asia/Qyzylorda", + "usr/share/zoneinfo/Asia/Rangoon", + "usr/share/zoneinfo/Asia/Riyadh", + "usr/share/zoneinfo/Asia/Saigon", + "usr/share/zoneinfo/Asia/Sakhalin", + "usr/share/zoneinfo/Asia/Samarkand", + "usr/share/zoneinfo/Asia/Seoul", + "usr/share/zoneinfo/Asia/Shanghai", + "usr/share/zoneinfo/Asia/Singapore", + "usr/share/zoneinfo/Asia/Srednekolymsk", + "usr/share/zoneinfo/Asia/Taipei", + "usr/share/zoneinfo/Asia/Tashkent", + "usr/share/zoneinfo/Asia/Tbilisi", + "usr/share/zoneinfo/Asia/Tehran", + "usr/share/zoneinfo/Asia/Tel_Aviv", + "usr/share/zoneinfo/Asia/Thimbu", + "usr/share/zoneinfo/Asia/Thimphu", + "usr/share/zoneinfo/Asia/Tokyo", + "usr/share/zoneinfo/Asia/Tomsk", + "usr/share/zoneinfo/Asia/Ujung_Pandang", + "usr/share/zoneinfo/Asia/Ulaanbaatar", + "usr/share/zoneinfo/Asia/Ulan_Bator", + "usr/share/zoneinfo/Asia/Urumqi", + "usr/share/zoneinfo/Asia/Ust-Nera", + "usr/share/zoneinfo/Asia/Vientiane", + "usr/share/zoneinfo/Asia/Vladivostok", + "usr/share/zoneinfo/Asia/Yakutsk", + "usr/share/zoneinfo/Asia/Yangon", + "usr/share/zoneinfo/Asia/Yekaterinburg", + "usr/share/zoneinfo/Asia/Yerevan", + "usr/share/zoneinfo/Atlantic/Azores", + "usr/share/zoneinfo/Atlantic/Bermuda", + "usr/share/zoneinfo/Atlantic/Canary", + "usr/share/zoneinfo/Atlantic/Cape_Verde", + "usr/share/zoneinfo/Atlantic/Faeroe", + "usr/share/zoneinfo/Atlantic/Faroe", + "usr/share/zoneinfo/Atlantic/Jan_Mayen", + "usr/share/zoneinfo/Atlantic/Madeira", + "usr/share/zoneinfo/Atlantic/Reykjavik", + "usr/share/zoneinfo/Atlantic/South_Georgia", + "usr/share/zoneinfo/Atlantic/St_Helena", + "usr/share/zoneinfo/Atlantic/Stanley", + "usr/share/zoneinfo/Australia/ACT", + "usr/share/zoneinfo/Australia/Adelaide", + "usr/share/zoneinfo/Australia/Brisbane", + "usr/share/zoneinfo/Australia/Broken_Hill", + "usr/share/zoneinfo/Australia/Canberra", + "usr/share/zoneinfo/Australia/Currie", + "usr/share/zoneinfo/Australia/Darwin", + "usr/share/zoneinfo/Australia/Eucla", + "usr/share/zoneinfo/Australia/Hobart", + "usr/share/zoneinfo/Australia/LHI", + "usr/share/zoneinfo/Australia/Lindeman", + "usr/share/zoneinfo/Australia/Lord_Howe", + "usr/share/zoneinfo/Australia/Melbourne", + "usr/share/zoneinfo/Australia/NSW", + "usr/share/zoneinfo/Australia/North", + "usr/share/zoneinfo/Australia/Perth", + "usr/share/zoneinfo/Australia/Queensland", + "usr/share/zoneinfo/Australia/South", + "usr/share/zoneinfo/Australia/Sydney", + "usr/share/zoneinfo/Australia/Tasmania", + "usr/share/zoneinfo/Australia/Victoria", + "usr/share/zoneinfo/Australia/West", + "usr/share/zoneinfo/Australia/Yancowinna", + "usr/share/zoneinfo/Brazil/Acre", + "usr/share/zoneinfo/Brazil/DeNoronha", + "usr/share/zoneinfo/Brazil/East", + "usr/share/zoneinfo/Brazil/West", + "usr/share/zoneinfo/Canada/Atlantic", + "usr/share/zoneinfo/Canada/Central", + "usr/share/zoneinfo/Canada/Eastern", + "usr/share/zoneinfo/Canada/Mountain", + "usr/share/zoneinfo/Canada/Newfoundland", + "usr/share/zoneinfo/Canada/Pacific", + "usr/share/zoneinfo/Canada/Saskatchewan", + "usr/share/zoneinfo/Canada/Yukon", + "usr/share/zoneinfo/Chile/Continental", + "usr/share/zoneinfo/Chile/EasterIsland", + "usr/share/zoneinfo/Etc/GMT", + "usr/share/zoneinfo/Etc/GMT+0", + "usr/share/zoneinfo/Etc/GMT+1", + "usr/share/zoneinfo/Etc/GMT+10", + "usr/share/zoneinfo/Etc/GMT+11", + "usr/share/zoneinfo/Etc/GMT+12", + "usr/share/zoneinfo/Etc/GMT+2", + "usr/share/zoneinfo/Etc/GMT+3", + "usr/share/zoneinfo/Etc/GMT+4", + "usr/share/zoneinfo/Etc/GMT+5", + "usr/share/zoneinfo/Etc/GMT+6", + "usr/share/zoneinfo/Etc/GMT+7", + "usr/share/zoneinfo/Etc/GMT+8", + "usr/share/zoneinfo/Etc/GMT+9", + "usr/share/zoneinfo/Etc/GMT-0", + "usr/share/zoneinfo/Etc/GMT-1", + "usr/share/zoneinfo/Etc/GMT-10", + "usr/share/zoneinfo/Etc/GMT-11", + "usr/share/zoneinfo/Etc/GMT-12", + "usr/share/zoneinfo/Etc/GMT-13", + "usr/share/zoneinfo/Etc/GMT-14", + "usr/share/zoneinfo/Etc/GMT-2", + "usr/share/zoneinfo/Etc/GMT-3", + "usr/share/zoneinfo/Etc/GMT-4", + "usr/share/zoneinfo/Etc/GMT-5", + "usr/share/zoneinfo/Etc/GMT-6", + "usr/share/zoneinfo/Etc/GMT-7", + "usr/share/zoneinfo/Etc/GMT-8", + "usr/share/zoneinfo/Etc/GMT-9", + "usr/share/zoneinfo/Etc/GMT0", + "usr/share/zoneinfo/Etc/Greenwich", + "usr/share/zoneinfo/Etc/UCT", + "usr/share/zoneinfo/Etc/UTC", + "usr/share/zoneinfo/Etc/Universal", + "usr/share/zoneinfo/Etc/Zulu", + "usr/share/zoneinfo/Europe/Amsterdam", + "usr/share/zoneinfo/Europe/Andorra", + "usr/share/zoneinfo/Europe/Astrakhan", + "usr/share/zoneinfo/Europe/Athens", + "usr/share/zoneinfo/Europe/Belfast", + "usr/share/zoneinfo/Europe/Belgrade", + "usr/share/zoneinfo/Europe/Berlin", + "usr/share/zoneinfo/Europe/Bratislava", + "usr/share/zoneinfo/Europe/Brussels", + "usr/share/zoneinfo/Europe/Bucharest", + "usr/share/zoneinfo/Europe/Budapest", + "usr/share/zoneinfo/Europe/Busingen", + "usr/share/zoneinfo/Europe/Chisinau", + "usr/share/zoneinfo/Europe/Copenhagen", + "usr/share/zoneinfo/Europe/Dublin", + "usr/share/zoneinfo/Europe/Gibraltar", + "usr/share/zoneinfo/Europe/Guernsey", + "usr/share/zoneinfo/Europe/Helsinki", + "usr/share/zoneinfo/Europe/Isle_of_Man", + "usr/share/zoneinfo/Europe/Istanbul", + "usr/share/zoneinfo/Europe/Jersey", + "usr/share/zoneinfo/Europe/Kaliningrad", + "usr/share/zoneinfo/Europe/Kiev", + "usr/share/zoneinfo/Europe/Kirov", + "usr/share/zoneinfo/Europe/Kyiv", + "usr/share/zoneinfo/Europe/Lisbon", + "usr/share/zoneinfo/Europe/Ljubljana", + "usr/share/zoneinfo/Europe/London", + "usr/share/zoneinfo/Europe/Luxembourg", + "usr/share/zoneinfo/Europe/Madrid", + "usr/share/zoneinfo/Europe/Malta", + "usr/share/zoneinfo/Europe/Mariehamn", + "usr/share/zoneinfo/Europe/Minsk", + "usr/share/zoneinfo/Europe/Monaco", + "usr/share/zoneinfo/Europe/Moscow", + "usr/share/zoneinfo/Europe/Nicosia", + "usr/share/zoneinfo/Europe/Oslo", + "usr/share/zoneinfo/Europe/Paris", + "usr/share/zoneinfo/Europe/Podgorica", + "usr/share/zoneinfo/Europe/Prague", + "usr/share/zoneinfo/Europe/Riga", + "usr/share/zoneinfo/Europe/Rome", + "usr/share/zoneinfo/Europe/Samara", + "usr/share/zoneinfo/Europe/San_Marino", + "usr/share/zoneinfo/Europe/Sarajevo", + "usr/share/zoneinfo/Europe/Saratov", + "usr/share/zoneinfo/Europe/Simferopol", + "usr/share/zoneinfo/Europe/Skopje", + "usr/share/zoneinfo/Europe/Sofia", + "usr/share/zoneinfo/Europe/Stockholm", + "usr/share/zoneinfo/Europe/Tallinn", + "usr/share/zoneinfo/Europe/Tirane", + "usr/share/zoneinfo/Europe/Tiraspol", + "usr/share/zoneinfo/Europe/Ulyanovsk", + "usr/share/zoneinfo/Europe/Uzhgorod", + "usr/share/zoneinfo/Europe/Vaduz", + "usr/share/zoneinfo/Europe/Vatican", + "usr/share/zoneinfo/Europe/Vienna", + "usr/share/zoneinfo/Europe/Vilnius", + "usr/share/zoneinfo/Europe/Volgograd", + "usr/share/zoneinfo/Europe/Warsaw", + "usr/share/zoneinfo/Europe/Zagreb", + "usr/share/zoneinfo/Europe/Zaporozhye", + "usr/share/zoneinfo/Europe/Zurich", + "usr/share/zoneinfo/Indian/Antananarivo", + "usr/share/zoneinfo/Indian/Chagos", + "usr/share/zoneinfo/Indian/Christmas", + "usr/share/zoneinfo/Indian/Cocos", + "usr/share/zoneinfo/Indian/Comoro", + "usr/share/zoneinfo/Indian/Kerguelen", + "usr/share/zoneinfo/Indian/Mahe", + "usr/share/zoneinfo/Indian/Maldives", + "usr/share/zoneinfo/Indian/Mauritius", + "usr/share/zoneinfo/Indian/Mayotte", + "usr/share/zoneinfo/Indian/Reunion", + "usr/share/zoneinfo/Mexico/BajaNorte", + "usr/share/zoneinfo/Mexico/BajaSur", + "usr/share/zoneinfo/Mexico/General", + "usr/share/zoneinfo/Pacific/Apia", + "usr/share/zoneinfo/Pacific/Auckland", + "usr/share/zoneinfo/Pacific/Bougainville", + "usr/share/zoneinfo/Pacific/Chatham", + "usr/share/zoneinfo/Pacific/Chuuk", + "usr/share/zoneinfo/Pacific/Easter", + "usr/share/zoneinfo/Pacific/Efate", + "usr/share/zoneinfo/Pacific/Enderbury", + "usr/share/zoneinfo/Pacific/Fakaofo", + "usr/share/zoneinfo/Pacific/Fiji", + "usr/share/zoneinfo/Pacific/Funafuti", + "usr/share/zoneinfo/Pacific/Galapagos", + "usr/share/zoneinfo/Pacific/Gambier", + "usr/share/zoneinfo/Pacific/Guadalcanal", + "usr/share/zoneinfo/Pacific/Guam", + "usr/share/zoneinfo/Pacific/Honolulu", + "usr/share/zoneinfo/Pacific/Johnston", + "usr/share/zoneinfo/Pacific/Kanton", + "usr/share/zoneinfo/Pacific/Kiritimati", + "usr/share/zoneinfo/Pacific/Kosrae", + "usr/share/zoneinfo/Pacific/Kwajalein", + "usr/share/zoneinfo/Pacific/Majuro", + "usr/share/zoneinfo/Pacific/Marquesas", + "usr/share/zoneinfo/Pacific/Midway", + "usr/share/zoneinfo/Pacific/Nauru", + "usr/share/zoneinfo/Pacific/Niue", + "usr/share/zoneinfo/Pacific/Norfolk", + "usr/share/zoneinfo/Pacific/Noumea", + "usr/share/zoneinfo/Pacific/Pago_Pago", + "usr/share/zoneinfo/Pacific/Palau", + "usr/share/zoneinfo/Pacific/Pitcairn", + "usr/share/zoneinfo/Pacific/Pohnpei", + "usr/share/zoneinfo/Pacific/Ponape", + "usr/share/zoneinfo/Pacific/Port_Moresby", + "usr/share/zoneinfo/Pacific/Rarotonga", + "usr/share/zoneinfo/Pacific/Saipan", + "usr/share/zoneinfo/Pacific/Samoa", + "usr/share/zoneinfo/Pacific/Tahiti", + "usr/share/zoneinfo/Pacific/Tarawa", + "usr/share/zoneinfo/Pacific/Tongatapu", + "usr/share/zoneinfo/Pacific/Truk", + "usr/share/zoneinfo/Pacific/Wake", + "usr/share/zoneinfo/Pacific/Wallis", + "usr/share/zoneinfo/Pacific/Yap", + "usr/share/zoneinfo/US/Alaska", + "usr/share/zoneinfo/US/Aleutian", + "usr/share/zoneinfo/US/Arizona", + "usr/share/zoneinfo/US/Central", + "usr/share/zoneinfo/US/East-Indiana", + "usr/share/zoneinfo/US/Eastern", + "usr/share/zoneinfo/US/Hawaii", + "usr/share/zoneinfo/US/Indiana-Starke", + "usr/share/zoneinfo/US/Michigan", + "usr/share/zoneinfo/US/Mountain", + "usr/share/zoneinfo/US/Pacific", + "usr/share/zoneinfo/US/Samoa" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "xz-libs@5.8.3-r0", + "Name": "xz-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "1ae658a5f132a091" + }, + "Version": "5.8.3-r0", + "Arch": "x86_64", + "SrcName": "xz", + "SrcVersion": "5.8.3-r0", + "Licenses": [ + "GPL-2.0-or-later", + "0BSD", + "Public-Domain", + "LGPL-2.1-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235", + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:4c92c5be0c5bef404e93c880eba9037a9b147347", + "InstalledFiles": [ + "usr/lib/liblzma.so.5", + "usr/lib/liblzma.so.5.8.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "zlib@1.3.2-r1", + "Name": "zlib", + "Identifier": { + "PURL": "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "1c01476a88d60a66" + }, + "Version": "1.3.2-r1", + "Arch": "x86_64", + "SrcName": "zlib", + "SrcVersion": "1.3.2-r1", + "Licenses": [ + "Zlib" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "Digest": "sha256:645872f9a17cb984e868cc31e749d9db7227a520a47e5d39cc5836f98eb2f731", + "DiffID": "sha256:264cd36fa61846dbe59ce642a36e8d738c415368e666ed0b6c680dc856e1202e" + }, + "Digest": "sha1:4f525c8cc204f84b8b4ca40db3be389958f056c6", + "InstalledFiles": [ + "usr/lib/libz.so.1", + "usr/lib/libz.so.1.3.2" + ], + "AnalyzedBy": "apk" + } + ] + }, + { + "Target": "Python", + "Class": "lang-pkgs", + "Type": "python-pkg", + "Packages": [ + { + "Name": "PyJWT", + "Identifier": { + "PURL": "pkg:pypi/pyjwt@2.15.1", + "UID": "d3f5f9a421b8abc9" + }, + "Version": "2.15.1", + "Licenses": [ + "MIT" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/pyjwt-2.15.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "cffi", + "Identifier": { + "PURL": "pkg:pypi/cffi@2.1.1", + "UID": "21042e2f37e33c05" + }, + "Version": "2.1.1", + "Licenses": [ + "MIT-0" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "cryptography", + "Identifier": { + "PURL": "pkg:pypi/cryptography@50.0.1", + "UID": "dcb3df6383fe2a60" + }, + "Version": "50.0.1", + "Licenses": [ + "Apache-2.0 OR BSD-3-Clause" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/cryptography-50.0.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "informed-decision", + "Identifier": { + "PURL": "pkg:pypi/informed-decision@0.2.0", + "UID": "7989f2afae8ff568" + }, + "Version": "0.2.0", + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/informed_decision-0.2.0.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "pycparser", + "Identifier": { + "PURL": "pkg:pypi/pycparser@3.0", + "UID": "e5a4d03f15a695ff" + }, + "Version": "3.0", + "Licenses": [ + "BSD-3-Clause" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/pycparser-3.0.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "waitress", + "Identifier": { + "PURL": "pkg:pypi/waitress@3.0.2", + "UID": "806e218e1c1e85f" + }, + "Version": "3.0.2", + "Licenses": [ + "ZPL-2.1" + ], + "Layer": { + "Digest": "sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87", + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/waitress-3.0.2.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + } + ] + } + ] +} diff --git a/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py b/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py new file mode 100644 index 0000000..76e9bca --- /dev/null +++ b/docs/evidence/2026-10-11-zlib-remediation-candidate/verify_local_artifacts.py @@ -0,0 +1,56 @@ +from pathlib import Path +import hashlib,io,json,tarfile,sys +if sys.flags.optimize: + raise SystemExit("REFUSED: optimized Python disables required artifact validation") +root=Path(sys.argv[1]) if len(sys.argv)==2 else Path('/tmp/infd-zlib-remediation-build') +def image(path): + with tarfile.open(path) as archive: + manifest=json.load(archive.extractfile('manifest.json'));assert len(manifest)==1 + configbytes=archive.extractfile(manifest[0]['Config']).read();config=json.loads(configbytes) + files={} + for name in manifest[0]['Layers']: + additions={};removed=[];opaque=[] + with tarfile.open(fileobj=archive.extractfile(name),mode='r|*') as layer: + for member in layer: + path=member.name + while path.startswith('./'):path=path[2:] + path=path.lstrip('/');p=Path(path) + if p.name=='.wh..wh..opq': + parent=p.parent.as_posix();opaque.append('' if parent=='.' else parent+'/');continue + if p.name.startswith('.wh.'): + removed.append((p.parent/p.name[4:]).as_posix());continue + if member.isfile(): + data=layer.extractfile(member).read();value=('file',member.mode,member.uid,member.gid,hashlib.sha256(data).hexdigest()) + elif member.isdir():value=('directory',member.mode,member.uid,member.gid,None) + elif member.issym() or member.islnk():value=('link',member.mode,member.uid,member.gid,member.linkname) + else:continue + additions[path]=value + # OCI whiteouts mask lower-layer entries only; same-layer additions survive + # independently of where the marker appeared in the layer tar stream. + files={key:value for key,value in files.items() if not any(key.startswith(prefix) for prefix in opaque) and not any(key==target or key.startswith(target+'/') for target in removed)} + files.update(additions) + return config,hashlib.sha256(configbytes).hexdigest(),files +base,baseid,bfiles=image(root/'base-image.tar');candidate,candidateid,cfiles=image(root/'image.tar') +assert candidate['rootfs']['diff_ids'][:-2]==base['rootfs']['diff_ids'] +changed={name:{'before':bfiles.get(name),'after':cfiles.get(name)} for name in sorted(set(bfiles)|set(cfiles)) if bfiles.get(name)!=cfiles.get(name)} +expected={'usr/lib/libz.so.1.3.2','lib/apk/db/installed'} +assert set(changed)<=expected,set(changed) +a,b=base['config'].copy(),candidate['config'].copy() +labels_a=a.pop('Labels',{});labels_b=b.pop('Labels',{}) +a.pop('Image',None);b.pop('Image',None) +defaults={'Hostname':'','Domainname':'','AttachStdin':False,'AttachStdout':False,'AttachStderr':False,'Tty':False,'OpenStdin':False,'StdinOnce':False,'Cmd':None,'Volumes':None,'OnBuild':None} +for key,value in defaults.items(): + a.setdefault(key,value);b.setdefault(key,value) +assert a==b,(a,b) +components=[] +for name in ['base-sbom.cdx.json','sbom.cdx.json']: + data=json.loads((root/name).read_text());components.append({c['name']:c['version'] for c in data['components'] if c.get('purl')}) +sbom_delta={name:[components[0].get(name),components[1].get(name)] for name in set(components[0])|set(components[1]) if components[0].get(name)!=components[1].get(name)} +assert sbom_delta=={'zlib':['1.3.2-r0','1.3.2-r1']},sbom_delta +vulns=[] +for name in ['base-trivy-full.json','trivy-full.json']: + data=json.loads((root/name).read_text());vulns.append([v for r in data.get('Results',[]) for v in r.get('Vulnerabilities',[])]) +assert len(vulns[0])==1 and vulns[0][0]['VulnerabilityID']=='CVE-2026-85091' and vulns[0][0]['Severity']=='MEDIUM' +assert not vulns[1] +proof={'base_image_config_id':'sha256:'+baseid,'candidate_local_image_config_id':'sha256:'+candidateid,'candidate_registry_digest':None,'base_layers_preserved':len(base['rootfs']['diff_ids']),'new_layers':2,'effective_runtime_config_identical':True,'raw_config_bytes_identical':False,'serialization_note':'Legacy base explicitly serialized empty/false/null defaults; candidate Docker-save config omits equivalent known defaults. Exact closed default normalization only; runtime fields unchanged.','labels_before':labels_a,'labels_after':labels_b,'final_changed_files':changed,'directory_metadata_compared':True,'directory_count_base':sum(v[0]=='directory' for v in bfiles.values()),'directory_count_candidate':sum(v[0]=='directory' for v in cfiles.values()),'directory_metadata_delta':{k:v for k,v in changed.items() if (v['before'] and v['before'][0]=='directory') or (v['after'] and v['after'][0]=='directory')},'sbom_package_count_base':len(components[0]),'sbom_package_count_candidate':len(components[1]),'sbom_only_delta':sbom_delta,'full_scan_baseline_findings':1,'full_scan_candidate_allseverity_findings':0,'db_snapshot_same':True,'native_workload_changed':False} +(root/'artifact-comparison.json').write_text(json.dumps(proof,indent=2)+'\n');print(json.dumps({key:proof[key] for key in ['candidate_local_image_config_id','base_layers_preserved','effective_runtime_config_identical','sbom_only_delta','full_scan_candidate_allseverity_findings']}));print(json.dumps(list(changed))) diff --git a/docs/reviews/2026-10-11-zlib-candidate-product-owner-complete-ack.md b/docs/reviews/2026-10-11-zlib-candidate-product-owner-complete-ack.md new file mode 100644 index 0000000..0b4cf42 --- /dev/null +++ b/docs/reviews/2026-10-11-zlib-candidate-product-owner-complete-ack.md @@ -0,0 +1,61 @@ +# Exact74 zlib candidate final Product acknowledgment + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact local T05 source preparation after lower-layer whiteout correction +manifest_sha256: 724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec +comment: >- + Same completed T08 preparation trial, with work-record refinement prepared + before this formal final acknowledgment. Initial5f334/intermediate8bc6 and + changes-requested85ffd remain exact historical reviews and evidence. + This is source technical agreement only, not publication/native go, + founder acceptance, scored new success or T05 completion. +``` + +All74 final staged hashes independently verify. Actual66-to74 changes remain +within artifact-audit source/tests/receipts/docs plus historical archive additions; +Containerfile/workflow/signed APK/index/pins/buildcontext, image78bfdcc/config625d, +package/runtime/backend/app/identity/policy, scanner DB/full scan/SBOM and WP +source scope remain unchanged from original preparation. Initial and intermediate +candidate source archives retain their exact manifest/bytes. + +The checker separately collects current layer additions and lower-layer whiteout +removals/opaque prefixes. It filters only previous-layer state and merges the +current layer additions afterward, preserving them in either archive order. +This corrects the concrete Product finding: nested/root opacity and explicit +ancestor removal no longer delete new same-layer files. Five audit tests pass, +including12 whiteout cases for root/nested removal/opacity and reversed-order +replacements, optimized malformed before-read refusal and directory mode/UID/GID +refusals. The three original Product counterexamples are independently rerun +against frozen74 checker and all preserve new same-layer files. +[OCI layer specification](https://github.com/opencontainers/image-spec/blob/main/layer.md) +requires this lower-layer boundary and order-independent opacity handling. + +Independent reread of existing actual local saved-image archives passes with +corrected reconstruction:313directories in each image, zero directory metadata +delta, exact final changes only libz/APK installed DB, nine base layers preserved, +effective runtime equality, only zlibr0 to r1 SBOM delta, and retained scan +base1MED/candidate0 at same database. No rebuild, container execution, scanner +repeat or native data/provider operation occurred in this review. Earlier source +checks of APK trust/bytes/backend/purpose remain applicable because their +artifacts/code are unchanged. Signature execution evidence remains retained maker +apk verify against exact763 trusted keys; no fresh Product crypto execution +claimed. Zero findings is bounded to that retained database snapshot, with +Alpine detector/EOL-list limitations; no estate risk grade or future guarantee. + +Initial Product5f334 and intermediate8bc6 acknowledgments are historical, with +the latter subsequently refined after the explicit85ffd finding. The finding +and all its counterexample bytes remain under +`docs/evidence/2026-10-11-zlib-candidate-product-complete-review/changes-requested-85ffd628/`. +This exact74 acknowledgment resolves that finding without rewriting it as prior +success. No new privileged trial or human approval is inferred from refinements. + +T05 remains progress, WP0009 active, manual follow-up due2026-10-18. Root exact +source review/commit, existing admitted owner CI candidate publication, actual +registry provenance/package/context and full published scan/SBOM proof precede +separate exact native founder release acceptance; installedr1/runtime/full-rescan +proof precedes T05 closure. Current763/nativec96 T04 result, DB/config/PVC/identity, +approved R2 helper/journal and INFD-IN-0010 unpromoted state remain untouched. +No owner checkout writes, publication, credential access or native commands. diff --git a/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md b/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md new file mode 100644 index 0000000..c100415 --- /dev/null +++ b/docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md @@ -0,0 +1,55 @@ +# Exact amended zlib candidate Product confirmation + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact amended local T05 source candidate preparation only +manifest_sha256: 64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8 +comment: >- + Same completed T08 preparation trial: work-record refinement was prepared + before this formal exact acknowledgment. Initial Product agreement/manifest + 5f334 remains historical, including its bounded audit validation. This final + confirmation covers the guard refinement, not publication/native approval, + a second scored success or T05 completion. +``` + +All58 final staged hashes verify; all27 initial candidate snapshots match +immutable manifest8d345bb2. Actual initial-to-current diff changes only four +existing paths: artifact checker, its comparison and local-validation receipts, +and README. New audit tests/refinement record and original source archive are +additions. No Containerfile/workflow, signed APK/index/pins/four-file context, +package/runtime/backend/app/identity/policy artifact, scan/SBOM/DB or WP source +scope changed. Local daemon78bfdcc/config625d remain unpublished; source recipe +contextc554 and actual retained DB03cacb remain exact. Original four-source-test +and Product five negative-probe findings remain applicable, not needlessly rerun. + +The artifact checker now refuses optimized Python before any archive/JSON read, +so assertions cannot silently disappear. Directory mode/UID/GID metadata is +included in final layer reconstruction and diff enforcement. Three new source +tests pass: malformed archive under -O refuses explicitly before reads; identical +directory metadata passes; each mode/UID/GID mutation refuses without a report. +These fixtures are isolated synthetic source tests. Independent reread of actual +existing local saved-image archives confirms equal directory counts and no +directory metadata delta; the same two final changed files are libz and APK DB, +nine base layers remain prefix and effective runtime config/SBOM/scan match. +No new image build, container launch, scan, customer/native data or provider call +was performed by this review. + +Initial Product review and validation retain their exact bytes under +`docs/evidence/2026-10-11-zlib-candidate-product-final-review/initial-5f334757/`; +original current review file remains the initial agreement, with this separate +final acknowledgment carrying the refinement. Signature trust conclusions stay +bounded to pinned signed artifacts/unchanged trust metadata, actual retained +maker apk verify and enforced recipe; this acknowledgment does not claim fresh +cryptographic execution. Zero findings remains specific to retained sameDB scan, +not an estate risk grade or future safety assurance. + +T05 remains progress, WP0009 active and manual follow-up due2026-10-18. Root +source review/commit and admitted owner CI candidate publication, exact actual +published registry provenance/package/full scan/SBOM, separate fresh native +founder release acceptance and installedr1/runtime/full-rescan proof remain +required. Existing approved R2 helper/journal, native image763, DB/config/PVC/ +identity and T04/c96 outcome are unchanged. INFD-IN-0010 remains unpromoted and +unimplemented. This technical acknowledgment grants no native action, human +acceptance, credential capability or publication execution. diff --git a/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md b/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md new file mode 100644 index 0000000..461d4d1 --- /dev/null +++ b/docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md @@ -0,0 +1,74 @@ +# Bounded zlib candidate Product owner review + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact local zlib-only source candidate technical preparation +manifest_sha256: 8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66 +comment: >- + Informed-decision intent requires human binding and preserved evidence; this + candidate changes only a native compression dependency while preserving + application authorization/presentation behavior. T08 review work record was + completed first. This is technical source agreement, not native go, publication + receipt, founder acceptance or T05 completion. +``` + +All27 staged hashes and retained evidence-file hashes independently verify. +Independent saved-image archive readback confirms all nine exact763 base diff_ids +as prefix, equal effective runtime configuration with only explicitly normalized +empty/false/null defaults, and final filesystem changes exactly +`usr/lib/libz.so.1.3.2` and `lib/apk/db/installed`. Modes/owners remain equivalent. +Application36 files, policy9d7, trust keys, APK world, Python dependencies, OpenSSL +and UID/GID10001 remain equal. Root build identity returns to10001:10001. +No service values, namespace, DB, customer data, config, PVC, schema, audience, +policy pins, protected helper or existing release journal is changed. + +Package/index bytes match pinned official HTTPS download hashes. Both signed +archives name alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub, already present +in unchanged baseline trust metadata. Retained actual maker apk verify success +against exact763 installed keys is the execution evidence; this review separately +checks archive signatures' metadata, bytes and trust identity, without claiming +a new signature-verification execution. Containerfile requires digest checks and +`apk verify` success before offline named-package upgrade; no allow-untrusted or +keys-dir override. Existing trusted keys are not replaced. +[Official apk verify documentation](https://github.com/alpinelinux/apk-tools/blob/master/doc/apk-verify.8.scd) +defines integrity/signature checking and nonzero failure. +Upgrade selects only zlib from retained local signed index, disables network, +preupgrade and logging, and removes temporary public artifacts. + +Both full CycloneDX/Trivy artifacts independently show44 packages and only +zlib1.3.2-r0 to1.3.2-r1 version delta. Full baseline has one MEDIUM +CVE-2026-85091; candidate has zero findings at the retained same database +03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917. +No severity suppression is inferred or permitted. Alpine3.24 EOL-list warning +and actual38 OS/6 Python detector coverage remain disclosed. This is bounded +scan improvement at that snapshot, not estate risk grading or future safety. +Local daemon image78bfdcc and saved OCI config625d are distinct disclosed +representations; neither is a published registry digest or native image proof. + +Four existing source tests pass, covering eight mutations; five additional Product +mutations of app source, trust keys, APK world, network and provider/data flags +refuse. Independent archive/SBOM/scan readback agrees with maker artifact receipt. +Retained four compression vectors/three malformed refusals/crypto/JWT/waitress +and ten installed purpose variants are local synthetic checks, not live PDP +or customer/native-data testing. No new container or native execution by reviewer. + +Workflow publishes only a source-bound candidate through existing admitted owner +registry capability after root source review/commit: exact40hex source revision, +fixed owner archive, four input hashes/contextc554, exact763 base, no-network +bounded build, unchanged runtime comparison and purpose checks before push. +It has no kubectl, Argo, DB/admin, namespace or runtime deployment action. +The workflow is unexecuted; source review does not attest CI credentials, actual +publication or published artifact equivalence. Root must retain actual CI/source +revision and registry descriptor/layer/config/package/signature/context readback, +then full published scan/SBOM and scoped candidate release preparation. Only +distinct exact informed-decision founder native approval followed by installedr1, +runtime/purpose and full-rescan proof can close T05. Future image-only rollback +to763 preserves latest DB; no historical snapshot restore. + +T05 remains progress, WP0009 active, manual follow-up due2026-10-18; no automatic +controller is implied. T04/c96 accepted outcome and original uncertain journals +remain historical and immutable. INFD-IN-0010 is unchanged and unpromoted. +No new native authority, owner checkout write, credential/login, deployment or +customer-data access occurred in this review. diff --git a/docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md b/docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md new file mode 100644 index 0000000..bad854b --- /dev/null +++ b/docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md @@ -0,0 +1,37 @@ +# Exact66 zlib audit whiteout Product finding + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: changes_requested +work_item: INFD-WP-ADHOC-2026-10-11-T08 +scope: exact66 local candidate artifact-audit source refinement +manifest_sha256: 3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0 +comment: >- + Same completed T08; work record prepared before this formal finding. + No actual candidate-image failure or new scored/native trial. Preserve + initial5f334 and intermediate8bc6 acknowledgments as historical. +``` + +All66 staged hashes independently verify. Whiteout leading-dot and root opaque +handling corrections address the prior cases, but remaining stream-order behavior +violates the lower-layer boundary. A synthetic parent layer contains usr/child/old; +next layer writes a new file before its whiteout marker. Three retained isolated +probes reproduce incorrect deletion: usr/new then usr/.wh..wh..opq, root new then +.wh..wh..opq, and usr/child/new then usr/.wh.child. Actual parsed sets lose the +same-layer new file in every case. Frozen checker/manifest and reproducible +probe/receipt are retained under docs/evidence/2026-10-11-zlib-candidate-product-whiteout-review/. + +[OCI layer specification](https://github.com/opencontainers/image-spec/blob/main/layer.md) +requires whiteouts to affect only parent layers and opacity to precede new entries +regardless archive ordering. Correct reconstruction should apply whiteouts to +the prior layer state and then merge current layer additions, preserving both +marker-before and marker-after order semantics. Add meaningful root/nested opaque +and explicit-directory removal cases with same-layer children/replacements. +The existing four no-new-sibling cases cannot establish this boundary. + +This finding is confined to audit-source semantics, not APK trust or actual image +contents/build/scan. Current actual candidate image/context/package/workflow/ +runtime and scanner evidence remain unchanged; no native/read-only command or +customer/DB/credential access occurred. T05 remains progress/WP0009 active; +publication and distinct founder native release/installed proof remain pending. +A corrected exact frozen packet needs final technical confirmation. diff --git a/tools/zlib_overlay/check_build_inputs.py b/tools/zlib_overlay/check_build_inputs.py new file mode 100644 index 0000000..523de0f --- /dev/null +++ b/tools/zlib_overlay/check_build_inputs.py @@ -0,0 +1,19 @@ +"""Exact public input verification only; signature verification remains mandatory in build.""" +import hashlib,json,sys +from pathlib import Path + +def verify(root): + pins=json.loads((root/'pins.json').read_text()) + if set(pins['files'])!={'.dockerignore','Containerfile','zlib-1.3.2-r1.apk','APKINDEX.tar.gz'}:raise ValueError('unclosed inputs') + if pins['base_image']!='forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a':raise ValueError('base pin changed') + for name,digest in pins['files'].items(): + p=root/name + if p.is_symlink() or not p.is_file() or p.stat().st_size>1024*1024:raise ValueError('regular bounded source required') + if hashlib.sha256(p.read_bytes()).hexdigest()!=digest:raise ValueError('changed bytes') + digest=hashlib.sha256(json.dumps(pins['files'],sort_keys=True,separators=(',',':')).encode()).hexdigest() + if digest!=pins['context_sha256']:raise ValueError('context mismatch') + return {'context_sha256':digest,'input_files':4} + +if __name__=='__main__': + try:print(json.dumps(verify(Path(sys.argv[1])))) + except Exception:raise SystemExit('exact build inputs refused') from None diff --git a/tools/zlib_overlay/check_runtime.py b/tools/zlib_overlay/check_runtime.py new file mode 100644 index 0000000..b8eae32 --- /dev/null +++ b/tools/zlib_overlay/check_runtime.py @@ -0,0 +1,29 @@ +"""Package/backend/source metadata only; never opens a database or provider.""" +import ctypes, gzip, hashlib, importlib.metadata, json, os +from pathlib import Path +import ssl, stat, zlib, sys +if sys.flags.optimize:raise RuntimeError("optimized smoke interpreter refused") + +def digest(path):return hashlib.sha256(Path(path).read_bytes()).hexdigest() +packages={} +for entry in Path('/lib/apk/db/installed').read_text().split('\n\n'): + fields=dict(line.split(':',1) for line in entry.splitlines() if ':' in line) + if 'P' in fields:packages[fields['P']]=fields['V'] +module=Path('/opt/venv/lib/python3.12/site-packages/informed_decision/policy.py');info=module.lstat() +app=module.parent +appfiles={str(p.relative_to(app)):digest(p) for p in sorted(app.rglob('*')) if p.is_file() and '__pycache__' not in p.parts} +keys={p.name:digest(p) for p in sorted(Path('/etc/apk/keys').glob('*.pub'))} +vectors=[b'',b'hello zlib',bytes(range(256))*16384,b'a'*1048576] +for value in vectors: + assert zlib.decompress(zlib.compress(value))==value + assert gzip.decompress(gzip.compress(value,mtime=0))==value +failures=0 +for bad in [b'notzlib',zlib.compress(b'fixture')[:-2],b'\x00'*16]: + try:zlib.decompress(bad) + except zlib.error:failures+=1 + else:raise AssertionError('malformed compression accepted') +from cryptography.hazmat.primitives.ciphers.aead import AESGCM +import jwt, waitress +key=bytes(range(32));nonce=b'123456789012';aes=AESGCM(key);cipher=aes.encrypt(nonce,b'synthetic',b'fixture');assert aes.decrypt(nonce,cipher,b'fixture')==b'synthetic' +signed=jwt.encode({'sub':'synthetic'},'synthetic-test-key-only-32bytes!!!!',algorithm='HS256');assert jwt.decode(signed,'synthetic-test-key-only-32bytes!!!!',algorithms=['HS256'])['sub']=='synthetic' +print(json.dumps({'uid':os.getuid(),'gid':os.getgid(),'policy_sha256':digest(module),'policy_mode':oct(stat.S_IMODE(info.st_mode)),'policy_uid':info.st_uid,'app_file_sha256':appfiles,'apk_packages':packages,'apk_world_sha256':digest('/etc/apk/world'),'apk_keys_sha256':keys,'python_dependencies':{d.metadata['Name']:d.version for d in importlib.metadata.distributions()},'zlib_runtime_version':zlib.ZLIB_RUNTIME_VERSION,'zlib_compile_version':zlib.ZLIB_VERSION,'libz_sha256':digest('/usr/lib/libz.so.1.3.2'),'compression_vectors_pass':len(vectors),'malformed_zlib_refusals':failures,'crypto_jwt_waitress_smoke':True,'openssl':ssl.OPENSSL_VERSION,'network_accessed':False,'database_opened':False,'provider_or_customer_data_used':False})) diff --git a/tools/zlib_overlay/compare_runtime.py b/tools/zlib_overlay/compare_runtime.py new file mode 100644 index 0000000..d2da70a --- /dev/null +++ b/tools/zlib_overlay/compare_runtime.py @@ -0,0 +1,16 @@ +"""Metadata only; no database, provider or native action.""" +import json,sys + +def compare(a,b): + for field in ('app_file_sha256','policy_sha256','policy_uid','policy_mode','uid','gid','apk_world_sha256','apk_keys_sha256','python_dependencies','openssl'): + if a[field]!=b[field]:raise ValueError('unrelated delta: '+field) + changed={name:[a['apk_packages'].get(name),b['apk_packages'].get(name)] for name in set(a['apk_packages'])|set(b['apk_packages']) if a['apk_packages'].get(name)!=b['apk_packages'].get(name)} + if changed!={'zlib':['1.3.2-r0','1.3.2-r1']}:raise ValueError('not exact zlib-only delta') + if b['policy_sha256']!='9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62' or b['uid']!=10001 or b['gid']!=10001 or b['policy_uid']!=0 or b['policy_mode']!='0o644':raise ValueError('purpose/identity differs') + if b['compression_vectors_pass']!=4 or b['malformed_zlib_refusals']!=3 or b['crypto_jwt_waitress_smoke'] is not True:raise ValueError('backend smoke differs') + if b['database_opened'] is not False or b['network_accessed'] is not False or b['provider_or_customer_data_used'] is not False:raise ValueError('unbounded smoke scope') + return {'zlib_only_delta':True,'app_files_identical':len(b['app_file_sha256']),'no_database_or_provider':True} + +if __name__=='__main__': + try:print(json.dumps(compare(json.loads(sys.argv[1]),json.loads(sys.argv[2])))) + except Exception:raise SystemExit('bounded runtime comparison refused') from None diff --git a/tools/zlib_overlay/test_candidate.py b/tools/zlib_overlay/test_candidate.py new file mode 100644 index 0000000..ae5a917 --- /dev/null +++ b/tools/zlib_overlay/test_candidate.py @@ -0,0 +1,32 @@ +import copy,importlib.util,json,tempfile,unittest,shutil +from pathlib import Path +ROOT=Path(__file__).parent +spec=importlib.util.spec_from_file_location('compare',ROOT/'compare_runtime.py');cmp=importlib.util.module_from_spec(spec);spec.loader.exec_module(cmp) +spec=importlib.util.spec_from_file_location('inputs',ROOT/'check_build_inputs.py');inputs=importlib.util.module_from_spec(spec);spec.loader.exec_module(inputs) +CASE=ROOT.parents[1]/'docs/evidence/2026-10-11-zlib-remediation-candidate' +class NarrowCandidate(unittest.TestCase): + def test_actual_single_package_delta(self): + a=json.loads((CASE/'base-runtime.json').read_text());b=json.loads((CASE/'candidate-runtime.json').read_text());self.assertTrue(cmp.compare(a,b)['zlib_only_delta']) + def test_unrelated_package_policy_identity_backend_database_python_refuse(self): + a=json.loads((CASE/'base-runtime.json').read_text());original=json.loads((CASE/'candidate-runtime.json').read_text()) + for field in ('package','policy','uid','backend','database','python'): + b=copy.deepcopy(original) + if field=='package':b['apk_packages']['musl']='different' + elif field=='policy':b['policy_sha256']='0'*64 + elif field=='uid':b['uid']=0 + elif field=='backend':b['malformed_zlib_refusals']=0 + elif field=='database':b['database_opened']=True + else:b['python_dependencies']['PyJWT']='different' + with self.subTest(field=field),self.assertRaises(ValueError):cmp.compare(a,b) + def test_mutated_package_or_index_refuse(self): + source=ROOT.parents[1]/'deploy/zlib-overlay' + for name in ('zlib-1.3.2-r1.apk','APKINDEX.tar.gz'): + with tempfile.TemporaryDirectory() as directory: + root=Path(directory)/'context';shutil.copytree(source,root);p=root/name;p.write_bytes(p.read_bytes()+b'changed') + with self.assertRaises(ValueError):inputs.verify(root) + def test_closed_recipe(self): + source=ROOT.parents[1]/'deploy/zlib-overlay';self.assertEqual(inputs.verify(source)['input_files'],4) + text=(source/'Containerfile').read_text() + for fragment in ('--no-preupgrade','--no-logfile','--no-network','--repositories-file /dev/null','--repository /tmp/infd-zlib zlib'):self.assertIn(fragment,text) + self.assertNotIn('--allow-untrusted',text) +if __name__=='__main__':unittest.main() diff --git a/workplans/ADHOC-2026-10-11.md b/workplans/ADHOC-2026-10-11.md index 00f47ae..e61fb50 100644 --- a/workplans/ADHOC-2026-10-11.md +++ b/workplans/ADHOC-2026-10-11.md @@ -228,3 +228,78 @@ handling correction; no implementation, native action or authority grant. This work-record preparation precedes the formal actual-outcome review entry. Review: docs/reviews/2026-10-11-purpose-native-outcome-product-owner-acceptance.md. Evidence: docs/evidence/2026-10-11-purpose-native-acceptance/. + + +## Independently review bounded zlib-only T05 source candidate + +```task +id: INFD-WP-ADHOC-2026-10-11-T08 +status: done +priority: medium +``` + +Completed informed-decision Product source review of exact27-path candidate +manifest8d345bb2bde3efce4d0cc99dfc2f883a64f79c42d2cd4abb288229a995e9ad66. +All staged/evidence hashes verify. Independently reread local saved base/candidate +image archives, effective runtime config, nine base layer prefix, two final file +changes and both full scan/SBOM artifacts. Only zlib1.3.2-r0 to r1 differs; +44 packages/base1MED to candidate0 at retained same scanner database. +Signed APK/index named key matches unchanged base trust metadata; enforced +apk verify against existing keys retained, no allow-untrusted or truststore override. +Four existing source tests pass (eight refusal mutations), plus five independent +appfile/trustkeys/world/network/provider metadata mutations refuse. +Purpose/backend checks remain local and synthetic, not actual PDP or data proof. +Technical source preparation agreement only: local image78bfdcc is unpublished, +T05 remains progress/WP0009 active; CI exact published provenance/scan/SBOM and +new native founder approval/installed proof are still required. Current763/native +DB/config/PVC/identity/approved R2 helper and journal remain unchanged; INFD-IN-0010 +is unpromoted/unimplemented. No native actions, credentials or owner source writes. +This completed work record is prepared before the formal review entry. +Review: docs/reviews/2026-10-11-zlib-candidate-product-owner-review.md. +Evidence: docs/evidence/2026-10-11-zlib-candidate-product-review/. + + +**Exact amended confirmation, same completed T08 preparation trial:** verified +final58-path candidate manifest64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8 +and immutable archived initial27 hashes. Only artifact-audit source/receipts/docs +change; recipe/workflow/four build inputs/image78bfdcc/config625d/runtime/scan/DB +remain identical. New3 artifact tests pass (optimized malformed input refused +before reads; matching directories pass; directory mode/UID/GID drift refuse). +Independent actual saved-image reread proves all directory metadata unchanged, +with the same two final file changes. Initial Product manifest5f334/ack/validation +are retained as historical source agreement, not new scored native success. +This work-record refinement precedes final formal acknowledgment. No publication, +native operation, credentials or owner edits. T05progress/WP0009active remains. +Confirmation: docs/reviews/2026-10-11-zlib-candidate-product-owner-final-ack.md. + + +**Exact66 whiteout follow-through, same completed T08 preparation:** independently +verified manifest3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0 +and all66 hashes. New source correction preserves leading whiteout dots/root +parent handling, but three Product synthetic probes find same-layer new files +incorrectly removed by subsequent nested/root opaque or explicit descendant +whiteouts. OCI requires whiteouts affect only lower layers and preserve same-layer +additions regardless archive order. Completed source assessment changes_requested +before formal entry: apply whiteouts only previous layers then merge current +layer additions, with both archive orders covered. No actual candidate failure +or image/sourcecontext/scan change is inferred. Initial5f334 and intermediate +8bc6 reviews/evidence remain historical, not rewritten; same T08/no new trial. +No owner edits, native operation, publication or credentials. +Review: docs/reviews/2026-10-11-zlib-candidate-product-whiteout-review.md. + + +**Exact74 final acknowledgment, same completed T08:** all74 candidate hashes +verify for manifest724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec. +Checker now collects additions separately, applies whiteouts only lower-layer +state and merges additions afterward. Five audit tests pass, including12 whiteout +semantic cases/both marker orders. All three original Product counterexamples +now preserve same-layer files. Independent actual saved-image re-audit proves +313directories unchanged and same two changed files/nine base prefix/runtime/ +SBOM/scan. Image78/contextc554/recipe/workflow/package/trust/DB unchanged. +Initial5f334, intermediate8bc6 and changes-requested85ffd source reviews/evidence +remain exact historical bytes, not revised prior success or a new scored trial. +Completed refinement record precedes final formal exact74 technical agreement. +No owner edits, native operation, publication or credentials; T05progress and +WP0009active remain. Distinct published/installed proof and founder approval +remain pending. +Final review: docs/reviews/2026-10-11-zlib-candidate-product-owner-complete-ack.md. diff --git a/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md b/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md index b74eb97..e16ecce 100644 --- a/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md +++ b/workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md @@ -160,7 +160,7 @@ and docs/evidence/2026-10-11-purpose-native-acceptance/. ```task id: INFD-WP-0009-T05 -status: todo +status: progress priority: medium state_hub_task_id: "1743596f-8558-5a6b-afef-4dd5c1e9c0ae" ``` @@ -176,3 +176,13 @@ Preserve the original detection, pending founder disposition and remediation evidence. Close only after actual installed-package proof and full rescan. Evidence: `docs/evidence/2026-10-11-purpose-image-release/inherited-vulnerability-follow-through.json`. + +2026-10-11 — T05 bounded zlib-only source candidate preparation: +Exactcurrent763base andsignedofficialr1/packageindex buildoffline. Actual44package +fullscan sameDB baseline1MEDCVE85091→localcandidate0allseverity. Finalfilesystem +deltaonlylibz+APKdb;36appfiles/policy9d/world/keys/Python/runtime unchanged. +Localcandidate is unpublished/unapproved;4sourcenegative tests+actualbackend +and10purpose checks pass. Source/evidence:docs/evidence/2026-10-11-zlib-remediation-candidate/. +T05progress/planactive:actualownerCIpublishedprovenance/fullscan/SBOM,distinctnative +founderreleaseapproval andactualinstalledr1/runtime/fullrescan still required. +NoT04/nativec96/helper/journal/DB/ConfigMap/PVC/identity/policy changes.