coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
informed-decision/docs/evidence/2026-10-11-purpose-image-release/intake.json
tegwick e0359bcb6c Prepare purpose image release with bounded custody protocol and owner reviews 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
2026-10-11 03:54:35 +02:00

261 lines
203 KiB
JSON
Raw Blame History

{
"kind": "informed-decision.memo-intake",
"version": 1,
"idempotency_key": "infd-20261011-purpose-overlay-r1-v1",
"memo_class": "decision-record",
"review_group": "net-kingdom-admins",
"drafted_by": "custodian-codex",
"approval_intent": {
"action": "administer",
"principal": "informed-decision",
"purpose": "Approve exact image-only purpose overlay release plus protected native evidence backup/restore gates and explicit inherited fixable-medium owner follow-through; no unrelated grant.",
"target": {
"id": "INFD-WP-0009-T04/purpose-overlay-v1",
"type": "runtime-change",
"system": "railiance01"
}
},
"memo": {
"id": "infd-20261011-purpose-overlay-r1",
"version": 1,
"question": "Approve this exact Informed Decision purpose-only image release on railiance01, including protected native backup/restore gates and explicit temporary acceptance of the inherited fixable MEDIUM zlib finding with owner remediation follow-through?",
"requested_act": "approve",
"binding_level": "organizational",
"brief": "Actual owner CI published763c from3e4bcb26; unchanged8base layers plus one policy.py, installedUID10001 and10purpose checks pass. Full44package scan0HIGH/CRITICAL,1fixable inheritedMEDIUM zlib, identical actualbase scan. Only Deploymentimage changes; manualArgo prune=false, runtime6c/schema5/PVC/identity/policies unchanged. Before ANY admin/Store, readonly schema5/integrity/count gate; protected backup/restore, sealedDeployment+actualCM/PVC identities and unoptimizedpreflight required, not executed. Live owner riskrecord/T05 dueOct18; Recreate briefly interrupts service. No priorconfigapproval reused.",
"binding": {
"principal": {
"id": "pending-human-session",
"kind": "person",
"display_name": "Founder review"
},
"target": {
"kind": "environment",
"id": "realm:kubernetes/railiance01/informed-decision",
"label": "Informed Decision image-only purpose hardening on railiance01",
"environment": "production"
},
"terms": "Only attached exact INFD-WP-0009-T04/purpose-overlay-v1 trialinfd-purpose-20261011-r1: protected consistent snapshots/off-cluster custody/offline restore plus exact owner-source pin/manual Deployment-only image release763c, prune=false. ADMINISTER activationAPPROVED only upon actualdisposition, execute by2026-10-12T23:59:59Z afterfresh sealedCM/PVC/Deploymentpreflight+pre-openreadonlyschema5+restoregates; rollbackprior7f5 retaining latestschema5DB. Explicit inheritedfixableMEDIUM permitted with INFD-WP-0009-T05 ownerreviewdue2026-10-18. No credential/policy/grant change, humanbinding, wholeAppsync or autonomygrant."
},
"step_kind": "approve",
"packet": [
{
"item_id": "decision-packet-md",
"label": "decision-packet.md",
"hash": "sha256:23da78cf998a32af0481e68567db94bb40781cc18f147461f779d40ebd329fd1"
},
{
"item_id": "proposal-json",
"label": "proposal.json",
"hash": "sha256:a59bcddc6c79e3ba8265a95b4b68facda2683abda8e47e5bb48ce402b9e1fa82"
},
{
"item_id": "candidate-admission-json",
"label": "candidate-admission.json",
"hash": "sha256:92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55"
},
{
"item_id": "rollback-admission-json",
"label": "rollback-admission.json",
"hash": "sha256:22f830736ee56f6ed9b62f47d243e4e24a1b68263b261e78e2f1cfcb85adbd50"
},
{
"item_id": "candidate-deployment-json",
"label": "candidate-deployment.json",
"hash": "sha256:722a8e2dc52bec217bf960e23b2fddfc7ac27d343ac8743790e3183db81a6a0e"
},
{
"item_id": "rollback-deployment-json",
"label": "rollback-deployment.json",
"hash": "sha256:39b3f43bb84ef4921cc3a1fbcdc444610741ed8809149d8f8f17ed805f262121"
},
{
"item_id": "published-verification-json",
"label": "published-verification.json",
"hash": "sha256:8a676c38f89f9ca762b8ebe945b5acb90d47a4cb350692687abb985bbb2d8ae2"
},
{
"item_id": "registry-proof-json",
"label": "registry-proof.json",
"hash": "sha256:5aa2c1f780c47f62fa9b59da9543d82c07afa02b1d946e6144b8a042ef86f213"
},
{
"item_id": "security-summary-json",
"label": "security-summary.json",
"hash": "sha256:0ee56400dc703f7c9968c2a0a3ea0390d8362f8d0bbf8002a2bd7fa58f19cb44"
},
{
"item_id": "trivy-full-json",
"label": "trivy-full.json",
"hash": "sha256:f38a8f7e6c419eed9154d7762f932b9deb6680a622247b08196b7458b893434e"
},
{
"item_id": "sqlite-readonly-py",
"label": "sqlite_readonly.py",
"hash": "sha256:eef53dd233eee74c17f20823bd7f5787c60cad79ac648021c9479643c6ce9e38"
},
{
"item_id": "sealed-native-dependencies-json",
"label": "sealed-native-dependencies.json",
"hash": "sha256:042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369"
},
{
"item_id": "native-backup-restore-protocol-md",
"label": "native-backup-restore-protocol.md",
"hash": "sha256:2f8d4894c2861b34977ec020593b7515a8ee35a43ce2e6aef2d96a6d34a94ddc"
},
{
"item_id": "inherited-vulnerability-follow-through-json",
"label": "inherited-vulnerability-follow-through.json",
"hash": "sha256:e8da413bf985ef2cb66c71a093ba7fc0636ab884f428e40a18b40ccff8e3b101"
},
{
"item_id": "native-preflight-json",
"label": "native-preflight.json",
"hash": "sha256:eb5f41aefb97666bb0c1279617e95a7c05017a609415624daee724c48b90d262"
},
{
"item_id": "sealed-live-deployment-json",
"label": "sealed-live-deployment.json",
"hash": "sha256:d18d27063d06f535ae884ea01f96747fe301685518ab94b1cba072a1e1519362"
},
{
"item_id": "change-guard-py",
"label": "change_guard.py",
"hash": "sha256:f348e449c49f4d9e49af9e82e01764e7197837fd3df9d756f5891d9b8d9b38be"
},
{
"item_id": "preflight-py",
"label": "preflight.py",
"hash": "sha256:6b4c65f708238c9a9d17fd065876c7a00e1f1745926f990a1dd5e667298340cd"
},
{
"item_id": "preflight-inputs-json",
"label": "preflight-inputs.json",
"hash": "sha256:756e72da9ec36572242421bea8b6d2285394e334f991db5e90e9b409563b5f06"
},
{
"item_id": "fresh-preflight-validation-json",
"label": "fresh-preflight-validation.json",
"hash": "sha256:2ec324aa8e3f97753b3ed87bca80820feb5e542dc0a4799aa848ec77ea92feb7"
}
],
"highlights": [
{
"id": "native-custody-rollout-and-known-medium",
"item_id": "decision-packet-md",
"note": "Protected real-data snapshot/restore and a brief Recreate restart require this separate native approval. Actual scan has one fixable inherited MEDIUM, not zero CVEs; exact owner follow-through due2026-10-18 is manual, with no automatic controller. Rollback preserves latestschema5DB and allnew/uncertain evidence. Synthetic transport tests are not native PDP authority proof. Admin can migrate oldschemas: readonlyschema5/integrity/count check must precede every native/offline Store/admin open. ActualCM/PVC UID/custody drift and optimizedPython stop the operation.",
"required_ack": true,
"severity": "warning",
"locator": {
"kind": "section",
"heading": "Requested decision"
}
}
],
"sealed": false,
"approval_id": null,
"approval_binding_digest": null
},
"packet": [
{
"item_id": "decision-packet-md",
"media_type": "text/markdown",
"content": "# Informed Decision purpose overlay release\n\n## Requested decision\n\nApprove the exact purpose-only image rollout and protected real-data backup/restore protocol for the existing Informed Decision service on railiance01. This request is separate from the already approved config-only repair. Only the existing Deployment image changes through the owner's manual Argo workflow, with prune disabled. Runtime ConfigMap `informed-decision-runtime-6c221878d051`, schema5, PVC, credentials, audience, policies, registries, access, replica1 and Recreate strategy remain fixed. Execute by 2026-10-12T23:59:59Z, after refreshed sealed-source/UID/configuration checks and backup/restore gates. Expiry stops authorization for an unstarted release; it does not install a controller or automatically roll back an already released image.\n\n## Artifact and known finding\n\nActual owner CI task11484/run3 published immutable image `sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a` from source `3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168`. Anonymous registry verification preserves all eight base compressed blobs/rootfs layers and adds only policy.py with exact source hash and mode0644. Legacy-builder media-type/default config serialization differences are recorded; the runtime semantics remain unchanged. Pulled published image executes as UID10001/GID10001 and passes ten installed checks: two supported binding forms, eight advisory/malformed refusals. Tests use synthetic transport and do not claim new native PDP authorization proof. The two failed CI attempts remain in the same trial history.\n\nActual unfiltered pinned scanner/DB evidence covers44packages: zero HIGH/CRITICAL, **one fixable MEDIUM**, CVE-2026-85091, zlib1.3.2-r0 fixed in1.3.2-r1. Actual current-base scan has the identical finding. Approving this packet explicitly permits this inherited finding during this narrow purpose release; it is not a RiskNexus estate risk grade or zero-CVE claim. Owner record INFD-RISK-20261011-ZLIB-85091 and live task INFD-WP-0009-T05 require separate base refresh and native approval, reviewed by2026-10-18. That review date is manual follow-through, with no auto-controller claim. Scanner notes Alpine3.24 absent EOL list; OS vulnerability detection ran against38OSpackages. Unknown vulnerabilities remain outside snapshot knowledge.\n\n## Native baseline and gates\n\nOriginal read-only capture01:25:38Z: existing Deployment UIDa588e10a, Ready1, image7f5c, unchanged runtime6c; native admission preserves the full configuration plus exactly the proposed image. Clientdiff returns1. Requests3460/4000mCPU86%, memory9472Mi59%; refresh before release. Existing Argo Application UID499868f2 is manual, target7db8485, Healthy with pre-existing OutOfSync status. Do not treat a scoped Deployment release as full-app reconciliation. Preserve its tracking-id; no unrelated resource sync/prune/adoption.\n\nThe refined read-only helper binds original source/helper/render/baseline hashes and actual immutable ConfigMap/PVC UIDs, runtime-data checksum and bound volume identity, explicitly refuses optimized interpreters, checks exact fresh live UID/configuration and admission, and writes a separate execution receipt outside this sealed packet. Failed initial raw Kustomize metadata check is retained: direct kubectl apply would drop Argo tracking-id. The reviewed selected Deployment explicitly retains that existing ID, matching Argo ownership. Any unrelated drift, different UID, altered admission, unavailable protected backup capacity, uncertain backup, restore mismatch or unhealthy baseline stops the release.\n\n## Protected backup and release\n\nBefore **any** native source or offline-restored Store/admin open, use the attached stdlib SQLite mode=ro/query_only checker to require schema5, integrity=ok and count-only baseline. The admin automatically migrates oldschemas, so a post-open report alone cannot prove no migration. Refuse other schemas before admin. Then use the existing owner admin's SQLite backup API, not a raw copy of the live database/WAL. Protect directories0700/files0600, owned by10001. Retain independently protected off-cluster snapshot custody and only count/hash receipts. No database contents, caller tokens, requester Secret or runtime credential files enter Git, State Hub, logs or this packet. Native backup and offline real-data restore have not yet occurred. Use an isolated private disposable copy, networknone and no runtime config/token mounts, run the pre-open checker and exact offline `--entrypoint informed-decision-admin inspect --db /restore/review.sqlite` after it passes, comparing frozen snapshot counts without service startup, then clean only the disposable restored copy. Retain the original snapshot. The attached protocol binds case-specific paths and fail-closed capacity/custody checks.\n\nRefresh a consistent online snapshot immediately before image-only cutover. This protocol does not assert traffic/dispatcher quiescence. Current and candidate share schema5 and unchanged store code; rollback retains the latest live database and all new/uncertain evidence. Stop the old writer before the new one with existing Recreate and single-writer lock. Do not restore an older snapshot over later writes, discard unresolved external effects, scale other workloads, change policies/identity/custody, or create human dispositions to make checks green.\n\nPin the existing Application to the exact owner commit containing the approved candidate source hashes, and manually sync only Deployment/informed-decision with prune=false. Verify actualimage/module/mode/UID, health/readiness and installed purpose refusals on the real placement; explicitly distinguish synthetic-transport checks from actual provider evidence. Existing native binding/lifecycle behavior must remain available. If unhealthy or verification fails, return Application source to7db8485 and scoped-sync prior same-schema image7f5c, preserving current evidence database; retain failed outcomes. Any data recovery beyond this same-schema image rollback is a separate founder decision.\n\n## Alternatives and estimates\n\nProceed with this narrow release plus explicit inherited-medium follow-through, or defer and prepare a separate base/dependency refresh before any release. No additional recurring hosting is proposed: estimated incremental infrastructure EUR0, with private storage and attended engineering/recovery time unpriced. Risks include a brief Recreate interruption, private backup custody errors, caller refusal when advisory responses were improperly treated as binding, and the disclosed inherited finding. This decision does not promote agent autonomy or grant unrelated work.\n\n## Independent review refinements\n\nThe initial36path/20document packet at manifest7c6738b3 and submissionac41c8ae is preserved in source preparation evidence, with the failed/conditional review. Independent Platform review identified admin auto-migration, optimization bypass, and actual same-name ConfigMap/PVC replacement gaps. The amended packet adds pre-open stdlib read-only schema/integrity/count gates, explicit local/remote optimization refusal, and independently sealed actual native config/PVC custody checks. These are refinements in the same proposal/trial, with no original or amended founder approval claimed.\n"
},
{
"item_id": "proposal-json",
"media_type": "application/json",
"content": "{\n \"proposal_id\": \"INFD-WP-0009-T04/purpose-overlay-v1\",\n \"trial_id\": \"infd-purpose-20261011-r1\",\n \"state\": \"prepared-unapproved\",\n \"target\": \"realm:kubernetes/railiance01/informed-decision\",\n \"authority\": \"ADMINISTER; activation APPROVED only upon exact founder disposition\",\n \"candidate_image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"published_source_revision\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"prior_image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"prior_argo_revision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\",\n \"native_object\": {\n \"apiVersion\": \"apps/v1\",\n \"kind\": \"Deployment\",\n \"namespace\": \"informed-decision\",\n \"name\": \"informed-decision\",\n \"uid\": \"a588e10a-90d2-4883-975e-6dd8b8feca92\"\n },\n \"argo_application_uid\": \"499868f2-eabc-4df4-ae31-b89ce58d750d\",\n \"source_gate\": \"Exact committed owner source must contain the two approved candidate file hashes in preflight-inputs.json; source preparation is not native approval\",\n \"sync_scope\": [\n \"apps:Deployment:informed-decision\"\n ],\n \"prune\": false,\n \"automated_sync\": false,\n \"runtime_configmap\": \"informed-decision-runtime-6c221878d051\",\n \"schema\": 5,\n \"requested_operations\": [\n \"Protected SQLite-consistent native backup and independently protected off-cluster custody\",\n \"Offline restore/integrity/count comparison on a private disposable volume with exact candidate, no runtime tokens/config/network\",\n \"Refresh a consistent pre-cutover snapshot, retain private copies and count-only/hash receipts\",\n \"Pin existing manual Argo Application to exact approved owner source and manually sync only existing Deployment image\",\n \"Verify health/readiness/image/module/installed fail-closed purpose checks and retained schema/count evidence; recover to prior same-schema image if needed\"\n ],\n \"execute_by\": \"2026-10-12T23:59:59Z\",\n \"temporary_vulnerability_review_due\": \"2026-10-18\",\n \"known_scan_findings\": \"0HIGH/CRITICAL,1fixable inheritedMEDIUM zlib, actual currentbase+candidate findings identical\",\n \"vulnerability_record\": \"INFD-RISK-20261011-ZLIB-85091 / INFD-WP-0009-T05\",\n \"cost_estimate_EUR\": 0,\n \"cost_limits\": \"No new recurring infrastructure; private backup storage and attended engineering/recovery time unpriced, not an autopilot cost grant\",\n \"risk_estimates\": [\n \"Brief Recreate service interruption; no concurrent new writer/surge\",\n \"Private evidence snapshot custody and disposal errors; no snapshots/tokens in public evidence\",\n \"Candidate purpose refusal may expose callers relying on advisory results as binding\",\n \"Inherited known fixable MEDIUM remains until separately approved owner remediation\",\n \"Existing Argo OutOfSync baseline is retained; no whole-app sync or unrelated repairs permitted\"\n ],\n \"rollback\": \"Manual Argo source pin back to7db8485 and scoped Deployment-only sync to7f5c image; retain current schema5 database and all post-cutover evidence, never restore older snapshot over live writes\",\n \"native_executed\": false,\n \"human_approval\": false,\n \"refinement_of_manifest\": \"7c6738b39ea8e54e61c8ed625e94ad0b2755e672e1576efcdf84a1d665ac3300\",\n \"mandatory_pre_open_gate\": \"stdlibSQLite mode=ro/query_only: schema5+integrity+count baseline before ANY Store/admin on native source or restoredcopy; refuseoldschemas without migration\",\n \"optimized_interpreters\": \"local+remote explicitlyrefused beforeassert gates\",\n \"native_dependency_gate\": \"sealed actualCM UID/immutable/canonicaldatahash+PVC UID/fullspec/Bound/volumeName, no rawCMdata orSecret reads\",\n \"live_counts\": \"Frozen snapshot/clone exactcounter equality; postcutover/rollback livecounterchanges may reflect legitimate concurrentcommits/state transitions, latestDB alwaysretained\"\n}\n"
},
{
"item_id": "candidate-admission-json",
"media_type": "application/json",
"content": "{\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"policy\": {\n \"origin\": \"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\n \"package\": \"informed-decision.compact-sitting\",\n \"version\": \"v13\",\n \"package_digest\": \"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\n \"pod_name\": \"flex-auth-informed-decision-sitting\"\n },\n \"keycape_egress_ips\": [\n \"92.205.62.239\"\n ],\n \"storage_class\": \"local-path\",\n \"ordinary_approval_ids\": [\n \"2ce76d7f-01c3-4b63-8476-8d1230679769\",\n \"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\n \"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"\n ],\n \"lifecycle_policy\": {\n \"package\": \"informed-decision.lifecycle\",\n \"version\": \"v2\",\n \"package_digest\": \"sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c\",\n \"origin\": \"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\n \"pod_name\": \"flex-auth-informed-decision-lifecycle\"\n },\n \"lifecycle_delivery\": true,\n \"intake_attributes\": true,\n \"intake_delivery\": {\n \"hub_origin\": \"http://state-hub.state-hub.svc.cluster.local:8000\"\n },\n \"workload_api\": {\n \"registries_configmap\": \"informed-decision-workload-registry\",\n \"peers\": [\n {\n \"namespace\": \"state-hub\",\n \"app\": \"state-hub\"\n }\n ],\n \"api_egress\": [\n {\n \"ip\": \"10.43.0.1\",\n \"port\": 443\n },\n {\n \"ip\": \"92.205.62.239\",\n \"port\": 6443\n }\n ],\n \"intake\": true,\n \"lifecycle\": true\n }\n}\n"
},
{
"item_id": "rollback-admission-json",
"media_type": "application/json",
"content": "{\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"policy\": {\n \"origin\": \"http://flex-auth-informed-decision-sitting.flex-auth.svc.cluster.local:8080\",\n \"package\": \"informed-decision.compact-sitting\",\n \"version\": \"v13\",\n \"package_digest\": \"sha256:31be5985c0c1e6b0c3a039ed7310d1e94daf523a94f6d926e6e8d759d3711873\",\n \"pod_name\": \"flex-auth-informed-decision-sitting\"\n },\n \"keycape_egress_ips\": [\n \"92.205.62.239\"\n ],\n \"storage_class\": \"local-path\",\n \"ordinary_approval_ids\": [\n \"2ce76d7f-01c3-4b63-8476-8d1230679769\",\n \"c2af4bcf-15b4-4305-aac1-acc7e4dcb099\",\n \"dc22666a-d5d7-46bc-9490-ebe9fe09dc38\"\n ],\n \"lifecycle_policy\": {\n \"package\": \"informed-decision.lifecycle\",\n \"version\": \"v2\",\n \"package_digest\": \"sha256:da01e045fc108adec6b489e5d51f7e57366793016c5a64776963780a6aae457c\",\n \"origin\": \"http://flex-auth-informed-decision-lifecycle.flex-auth.svc.cluster.local:8080\",\n \"pod_name\": \"flex-auth-informed-decision-lifecycle\"\n },\n \"lifecycle_delivery\": true,\n \"intake_attributes\": true,\n \"intake_delivery\": {\n \"hub_origin\": \"http://state-hub.state-hub.svc.cluster.local:8000\"\n },\n \"workload_api\": {\n \"registries_configmap\": \"informed-decision-workload-registry\",\n \"peers\": [\n {\n \"namespace\": \"state-hub\",\n \"app\": \"state-hub\"\n }\n ],\n \"api_egress\": [\n {\n \"ip\": \"10.43.0.1\",\n \"port\": 443\n },\n {\n \"ip\": \"92.205.62.239\",\n \"port\": 6443\n }\n ],\n \"intake\": true,\n \"lifecycle\": true\n }\n}\n"
},
{
"item_id": "candidate-deployment-json",
"media_type": "application/json",
"content": "{\n \"apiVersion\": \"apps/v1\",\n \"kind\": \"Deployment\",\n \"metadata\": {\n \"annotations\": {\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\",\n \"argocd.argoproj.io/tracking-id\": \"informed-decision:apps/Deployment:informed-decision/informed-decision\"\n },\n \"name\": \"informed-decision\",\n \"namespace\": \"informed-decision\"\n },\n \"spec\": {\n \"progressDeadlineSeconds\": 600,\n \"replicas\": 1,\n \"selector\": {\n \"matchLabels\": {\n \"app.kubernetes.io/name\": \"informed-decision\"\n }\n },\n \"strategy\": {\n \"type\": \"Recreate\"\n },\n \"template\": {\n \"metadata\": {\n \"annotations\": {\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\"\n },\n \"labels\": {\n \"app.kubernetes.io/component\": \"review\",\n \"app.kubernetes.io/name\": \"informed-decision\"\n }\n },\n \"spec\": {\n \"automountServiceAccountToken\": false,\n \"containers\": [\n {\n \"env\": [\n {\n \"name\": \"INFD_KEYCAPE_ISSUER\",\n \"value\": \"https://kc.coulomb.social\"\n },\n {\n \"name\": \"INFD_CONTAINER_CONFIG\",\n \"value\": \"/configuration/runtime.json\"\n }\n ],\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"livenessProbe\": {\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\"\n },\n \"periodSeconds\": 10,\n \"timeoutSeconds\": 2\n },\n \"name\": \"informed-decision\",\n \"ports\": [\n {\n \"containerPort\": 8080,\n \"name\": \"http\"\n },\n {\n \"containerPort\": 8081,\n \"name\": \"workload\"\n }\n ],\n \"readinessProbe\": {\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\"\n },\n \"periodSeconds\": 10,\n \"timeoutSeconds\": 2\n },\n \"resources\": {\n \"limits\": {\n \"cpu\": \"500m\",\n \"memory\": \"256Mi\"\n },\n \"requests\": {\n \"cpu\": \"5m\",\n \"memory\": \"64Mi\"\n }\n },\n \"securityContext\": {\n \"allowPrivilegeEscalation\": false,\n \"capabilities\": {\n \"drop\": [\n \"ALL\"\n ]\n },\n \"readOnlyRootFilesystem\": true\n },\n \"startupProbe\": {\n \"failureThreshold\": 12,\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\"\n },\n \"periodSeconds\": 10,\n \"timeoutSeconds\": 2\n },\n \"volumeMounts\": [\n {\n \"mountPath\": \"/data\",\n \"name\": \"data\"\n },\n {\n \"mountPath\": \"/run/informed-decision\",\n \"name\": \"runtime\"\n },\n {\n \"mountPath\": \"/tmp\",\n \"name\": \"tmp\"\n },\n {\n \"mountPath\": \"/configuration\",\n \"name\": \"configuration\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/policy\",\n \"name\": \"caller\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/audit\",\n \"name\": \"audit\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/kubernetes\",\n \"name\": \"kubernetes-api\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/workload-registry\",\n \"name\": \"workload-registry\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/requester\",\n \"name\": \"sitting-requester\",\n \"readOnly\": true\n }\n ]\n }\n ],\n \"securityContext\": {\n \"fsGroup\": 10001,\n \"fsGroupChangePolicy\": \"OnRootMismatch\",\n \"runAsGroup\": 10001,\n \"runAsNonRoot\": true,\n \"runAsUser\": 10001,\n \"seccompProfile\": {\n \"type\": \"RuntimeDefault\"\n }\n },\n \"serviceAccountName\": \"review\",\n \"terminationGracePeriodSeconds\": 45,\n \"volumes\": [\n {\n \"name\": \"data\",\n \"persistentVolumeClaim\": {\n \"claimName\": \"informed-decision-data\"\n }\n },\n {\n \"emptyDir\": {\n \"medium\": \"Memory\",\n \"sizeLimit\": \"16Mi\"\n },\n \"name\": \"runtime\"\n },\n {\n \"emptyDir\": {\n \"medium\": \"Memory\",\n \"sizeLimit\": \"16Mi\"\n },\n \"name\": \"tmp\"\n },\n {\n \"configMap\": {\n \"defaultMode\": 292,\n \"name\": \"informed-decision-runtime-6c221878d051\"\n },\n \"name\": \"configuration\"\n },\n {\n \"name\": \"caller\",\n \"projected\": {\n \"defaultMode\": 288,\n \"sources\": [\n {\n \"serviceAccountToken\": {\n \"audience\": \"flex-auth\",\n \"expirationSeconds\": 3600,\n \"path\": \"token\"\n }\n }\n ]\n }\n },\n {\n \"name\": \"audit\",\n \"secret\": {\n \"defaultMode\": 288,\n \"items\": [\n {\n \"key\": \"token\",\n \"path\": \"token\"\n }\n ],\n \"secretName\": \"informed-decision-audit\"\n }\n },\n {\n \"name\": \"kubernetes-api\",\n \"projected\": {\n \"defaultMode\": 288,\n \"sources\": [\n {\n \"serviceAccountToken\": {\n \"expirationSeconds\": 600,\n \"path\": \"token\"\n }\n },\n {\n \"configMap\": {\n \"items\": [\n {\n \"key\": \"ca.crt\",\n \"path\": \"ca.crt\"\n }\n ],\n \"name\": \"kube-root-ca.crt\"\n }\n }\n ]\n }\n },\n {\n \"configMap\": {\n \"defaultMode\": 292,\n \"name\": \"informed-decision-workload-registry\"\n },\n \"name\": \"workload-registry\"\n },\n {\n \"name\": \"sitting-requester\",\n \"secret\": {\n \"defaultMode\": 288,\n \"items\": [\n {\n \"key\": \"client-secret\",\n \"path\": \"client-secret\"\n }\n ],\n \"optional\": false,\n \"secretName\": \"informed-decision-sitting-requester\"\n }\n }\n ]\n }\n }\n }\n}\n"
},
{
"item_id": "rollback-deployment-json",
"media_type": "application/json",
"content": "{\n \"apiVersion\": \"apps/v1\",\n \"kind\": \"Deployment\",\n \"metadata\": {\n \"annotations\": {\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\",\n \"argocd.argoproj.io/tracking-id\": \"informed-decision:apps/Deployment:informed-decision/informed-decision\"\n },\n \"name\": \"informed-decision\",\n \"namespace\": \"informed-decision\"\n },\n \"spec\": {\n \"progressDeadlineSeconds\": 600,\n \"replicas\": 1,\n \"selector\": {\n \"matchLabels\": {\n \"app.kubernetes.io/name\": \"informed-decision\"\n }\n },\n \"strategy\": {\n \"type\": \"Recreate\"\n },\n \"template\": {\n \"metadata\": {\n \"annotations\": {\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\"\n },\n \"labels\": {\n \"app.kubernetes.io/component\": \"review\",\n \"app.kubernetes.io/name\": \"informed-decision\"\n }\n },\n \"spec\": {\n \"automountServiceAccountToken\": false,\n \"containers\": [\n {\n \"env\": [\n {\n \"name\": \"INFD_KEYCAPE_ISSUER\",\n \"value\": \"https://kc.coulomb.social\"\n },\n {\n \"name\": \"INFD_CONTAINER_CONFIG\",\n \"value\": \"/configuration/runtime.json\"\n }\n ],\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"livenessProbe\": {\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\"\n },\n \"periodSeconds\": 10,\n \"timeoutSeconds\": 2\n },\n \"name\": \"informed-decision\",\n \"ports\": [\n {\n \"containerPort\": 8080,\n \"name\": \"http\"\n },\n {\n \"containerPort\": 8081,\n \"name\": \"workload\"\n }\n ],\n \"readinessProbe\": {\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\"\n },\n \"periodSeconds\": 10,\n \"timeoutSeconds\": 2\n },\n \"resources\": {\n \"limits\": {\n \"cpu\": \"500m\",\n \"memory\": \"256Mi\"\n },\n \"requests\": {\n \"cpu\": \"5m\",\n \"memory\": \"64Mi\"\n }\n },\n \"securityContext\": {\n \"allowPrivilegeEscalation\": false,\n \"capabilities\": {\n \"drop\": [\n \"ALL\"\n ]\n },\n \"readOnlyRootFilesystem\": true\n },\n \"startupProbe\": {\n \"failureThreshold\": 12,\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\"\n },\n \"periodSeconds\": 10,\n \"timeoutSeconds\": 2\n },\n \"volumeMounts\": [\n {\n \"mountPath\": \"/data\",\n \"name\": \"data\"\n },\n {\n \"mountPath\": \"/run/informed-decision\",\n \"name\": \"runtime\"\n },\n {\n \"mountPath\": \"/tmp\",\n \"name\": \"tmp\"\n },\n {\n \"mountPath\": \"/configuration\",\n \"name\": \"configuration\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/policy\",\n \"name\": \"caller\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/audit\",\n \"name\": \"audit\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/kubernetes\",\n \"name\": \"kubernetes-api\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/workload-registry\",\n \"name\": \"workload-registry\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/requester\",\n \"name\": \"sitting-requester\",\n \"readOnly\": true\n }\n ]\n }\n ],\n \"securityContext\": {\n \"fsGroup\": 10001,\n \"fsGroupChangePolicy\": \"OnRootMismatch\",\n \"runAsGroup\": 10001,\n \"runAsNonRoot\": true,\n \"runAsUser\": 10001,\n \"seccompProfile\": {\n \"type\": \"RuntimeDefault\"\n }\n },\n \"serviceAccountName\": \"review\",\n \"terminationGracePeriodSeconds\": 45,\n \"volumes\": [\n {\n \"name\": \"data\",\n \"persistentVolumeClaim\": {\n \"claimName\": \"informed-decision-data\"\n }\n },\n {\n \"emptyDir\": {\n \"medium\": \"Memory\",\n \"sizeLimit\": \"16Mi\"\n },\n \"name\": \"runtime\"\n },\n {\n \"emptyDir\": {\n \"medium\": \"Memory\",\n \"sizeLimit\": \"16Mi\"\n },\n \"name\": \"tmp\"\n },\n {\n \"configMap\": {\n \"defaultMode\": 292,\n \"name\": \"informed-decision-runtime-6c221878d051\"\n },\n \"name\": \"configuration\"\n },\n {\n \"name\": \"caller\",\n \"projected\": {\n \"defaultMode\": 288,\n \"sources\": [\n {\n \"serviceAccountToken\": {\n \"audience\": \"flex-auth\",\n \"expirationSeconds\": 3600,\n \"path\": \"token\"\n }\n }\n ]\n }\n },\n {\n \"name\": \"audit\",\n \"secret\": {\n \"defaultMode\": 288,\n \"items\": [\n {\n \"key\": \"token\",\n \"path\": \"token\"\n }\n ],\n \"secretName\": \"informed-decision-audit\"\n }\n },\n {\n \"name\": \"kubernetes-api\",\n \"projected\": {\n \"defaultMode\": 288,\n \"sources\": [\n {\n \"serviceAccountToken\": {\n \"expirationSeconds\": 600,\n \"path\": \"token\"\n }\n },\n {\n \"configMap\": {\n \"items\": [\n {\n \"key\": \"ca.crt\",\n \"path\": \"ca.crt\"\n }\n ],\n \"name\": \"kube-root-ca.crt\"\n }\n }\n ]\n }\n },\n {\n \"configMap\": {\n \"defaultMode\": 292,\n \"name\": \"informed-decision-workload-registry\"\n },\n \"name\": \"workload-registry\"\n },\n {\n \"name\": \"sitting-requester\",\n \"secret\": {\n \"defaultMode\": 288,\n \"items\": [\n {\n \"key\": \"client-secret\",\n \"path\": \"client-secret\"\n }\n ],\n \"optional\": false,\n \"secretName\": \"informed-decision-sitting-requester\"\n }\n }\n ]\n }\n }\n }\n}\n"
},
{
"item_id": "published-verification-json",
"media_type": "application/json",
"content": "{\n \"proposal\": \"INFD-WP-0009-T04/purpose-overlay-v1\",\n \"observed_at\": \"2026-10-11T01:24:01.985128+00:00\",\n \"native_owner_publication_job\": {\n \"id\": 11484,\n \"name\": \"publish-candidate\",\n \"head_branch\": \"main\",\n \"head_sha\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"run_number\": 3,\n \"event\": \"push\",\n \"display_title\": \"Prepare readable overlay context with the admitted legacy builder\",\n \"status\": \"success\",\n \"workflow_id\": \"purpose-overlay-image.yaml\",\n \"url\": \"https://forgejo.coulomb.social/coulomb/informed-decision/actions/runs/3\",\n \"created_at\": \"2026-10-11T01:20:59Z\",\n \"updated_at\": \"2026-10-11T01:21:08Z\",\n \"run_started_at\": \"2026-10-11T01:20:59Z\"\n },\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"source_revision\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"policy_sha256\": \"9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62\",\n \"registry_proof_sha256\": \"5aa2c1f780c47f62fa9b59da9543d82c07afa02b1d946e6144b8a042ef86f213\",\n \"source_render_change_only\": \"Deployment/informed-decision spec.template.spec.containers[0].image\",\n \"runtime_configmap_unchanged\": \"informed-decision-runtime-6c221878d051\",\n \"installed_image_execution\": {\n \"immutable_registry_artifact_pulled_anonymously\": true,\n \"UID\": 10001,\n \"GID\": 10001,\n \"policy_file_UID\": 0,\n \"policy_file_mode\": \"0644\",\n \"purpose_variants\": 10,\n \"binding_forms_allowed\": 2,\n \"advisory_or_malformed_refused\": 8,\n \"network\": \"none\",\n \"read_only\": true,\n \"synthetic_transport\": true,\n \"native_PDP_test\": false\n },\n \"scan_summary_sha256\": \"0ee56400dc703f7c9968c2a0a3ea0390d8362f8d0bbf8002a2bd7fa58f19cb44\",\n \"historical_failed_runs_retained\": [\n \"f66de505/task11482/run1\",\n \"acecad887/task11483/run2\"\n ],\n \"native_hosting_changed\": false,\n \"native_backup_restore_executed\": false,\n \"human_approval\": false,\n \"evidence_file_sha256\": {\n \"image-manifest.json\": \"978c575d3c7bf0de39dbe4e9567c39cd36f70b7e55bc17357bdb03fb3b96b0fb\",\n \"image-config.json\": \"4ad7249c75fd9fc039ceb186772419e1cba5fd9759c404556459c80a2d285d10\",\n \"base-image-config.json\": \"b706c9209e324f39a86ffcda2a3e9d94c92649739ad5b21fe4611006e36f6f00\",\n \"registry-proof.json\": \"5aa2c1f780c47f62fa9b59da9543d82c07afa02b1d946e6144b8a042ef86f213\",\n \"trivy-full.json\": \"f38a8f7e6c419eed9154d7762f932b9deb6680a622247b08196b7458b893434e\",\n \"sbom.cdx.json\": \"a4252951e2027472c26d8679cb543e30983180809d6dd3c7c94b883d62803e5d\",\n \"base-trivy-full.json\": \"d44c555aecbb1a4518f4127d48015ea459325c93e8b0371910a55de47293ca80\",\n \"check_installed.py\": \"a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad\",\n \"verify_registry.py\": \"413f575c21a2bd18a3696f8f2d939eeadc52d76f282c42813f76bb0e3ee8a2a4\",\n \"sqlite_readonly.py\": \"eef53dd233eee74c17f20823bd7f5787c60cad79ac648021c9479643c6ce9e38\",\n \"sealed-native-dependencies.json\": \"042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369\",\n \"review-refinement.json\": \"ea62845cee5ee6f4f6cb7f5dcd0af601ba29a21c8ff80efbbc02ad16e35bea75\",\n \"test_change_guard.py\": \"da5350437357ba329236cc137610c03856f38f836ddf2856025bc12011fad07f\",\n \"test_sqlite_readonly.py\": \"c7a91d0c6a373d738c88bb817d9bfb2ff8a179bc61b93063b89677b566520323\",\n \"test_preflight_optimization.py\": \"a0c4fa18c5d6c21476a06c6d05fe7656259d204299138851599e9214d911206d\"\n }\n}\n"
},
{
"item_id": "registry-proof-json",
"media_type": "application/json",
"content": "{\n \"image_digest\": \"sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"source_revision\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"base_image_digest\": \"sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"base_layer_bytes_identical\": true,\n \"layer_media_type_conversion\": \"OCI gzip to Docker gzip, same digest and size\",\n \"base_runtime_config_semantics_identical\": true,\n \"legacy_builder_config_additions\": {\n \"Hostname\": \"\",\n \"Domainname\": \"\",\n \"AttachStdin\": false,\n \"AttachStdout\": false,\n \"AttachStderr\": false,\n \"Tty\": false,\n \"OpenStdin\": false,\n \"StdinOnce\": false,\n \"Cmd\": null,\n \"Volumes\": null,\n \"OnBuild\": null,\n \"Image\": \"sha256:90f1574f9eda35fa6cb972961beb27a7cb904c36560e381930b0e14065c23883\"\n },\n \"base_rootfs_prefix_identical\": true,\n \"overlay_regular_files\": [\n \"opt/venv/lib/python3.12/site-packages/informed_decision/policy.py\"\n ],\n \"overlay_directories\": [\n \"opt\",\n \"opt/venv\",\n \"opt/venv/lib\",\n \"opt/venv/lib/python3.12\",\n \"opt/venv/lib/python3.12/site-packages\",\n \"opt/venv/lib/python3.12/site-packages/informed_decision\"\n ],\n \"policy_sha256\": \"9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62\",\n \"policy_mode\": \"0644\",\n \"base_user\": \"10001:10001\",\n \"source_scope_labels\": {\n \"org.opencontainers.image.revision\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"org.opencontainers.image.base.digest\": \"sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"social.coulomb.source.policy.sha256\": \"9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62\",\n \"social.coulomb.release.scope\": \"INFD-WP-0009-T04/purpose-overlay-v1\"\n },\n \"registry_read_route\": \"anonymous public scoped bearer challenge, no token retention\",\n \"image_executed\": false,\n \"native_workload_changed\": false,\n \"native_backup_restore_executed\": false\n}\n"
},
{
"item_id": "security-summary-json",
"media_type": "application/json",
"content": "{\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"source_revision\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"scanner\": \"aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969\",\n \"version\": \"0.74.0\",\n \"db_metadata\": {\n \"Version\": 2,\n \"NextUpdate\": \"2026-10-11T18:59:50.889010572Z\",\n \"UpdatedAt\": \"2026-10-10T18:59:50.889010923Z\",\n \"DownloadedAt\": \"2026-10-10T23:32:32.380033131Z\"\n },\n \"suppression\": false,\n \"ignore_unfixed\": false,\n \"severity_filter\": null,\n \"package_count\": 44,\n \"findings_by_severity\": {\n \"MEDIUM\": 1\n },\n \"findings\": [\n {\n \"id\": \"CVE-2026-85091\",\n \"package\": \"zlib\",\n \"installed\": \"1.3.2-r0\",\n \"fixed\": \"1.3.2-r1\",\n \"severity\": \"MEDIUM\"\n }\n ],\n \"coverage_limits\": [\n \"Alpine3.24 absent scanner EOL list; OS detector ran against Alpine3.24 repository on38OS packages\",\n \"Known findings asof pinnedDB, not claim absence of unknown vulnerabilities\"\n ],\n \"high_critical\": 0,\n \"same_scanner_actual_base_scan_findings_identical\": true,\n \"base_scan_file\": \"base-trivy-full.json\"\n}\n"
},
{
"item_id": "trivy-full-json",
"media_type": "application/json",
"content": "{\n \"SchemaVersion\": 2,\n \"Trivy\": {\n \"Version\": \"0.74.0\"\n },\n \"ReportID\": \"01a1288d-8df1-73fb-9313-3642dd64ba72\",\n \"CreatedAt\": \"2026-10-11T01:22:07.985264404Z\",\n \"ArtifactID\": \"sha256:40f873b8d6345341e2f661a5038c092d186e2831dc60b61704a419a1f4f77ef6\",\n \"ArtifactName\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"ArtifactType\": \"container_image\",\n \"Metadata\": {\n \"Size\": 88258048,\n \"OS\": {\n \"Family\": \"alpine\",\n \"Name\": \"3.24.1\"\n },\n \"ImageID\": \"sha256:f34de21379c4f50ea0361ca1d8296c8e72f989499ad288016b81204997ae4779\",\n \"DiffIDs\": [\n \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\",\n \"sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd\",\n \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\",\n \"sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe\",\n \"sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1\",\n \"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c\",\n \"sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59\",\n \"sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02\",\n \"sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3\"\n ],\n \"RepoDigests\": [\n \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\"\n ],\n \"Reference\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n \"ImageConfig\": {\n \"architecture\": \"amd64\",\n \"created\": \"2026-10-11T01:21:04.787527697Z\",\n \"docker_version\": \"27.5.1\",\n \"history\": [\n {\n \"created\": \"2026-06-16T00:01:29.967161902Z\",\n \"created_by\": \"ADD alpine-minirootfs-3.24.1-x86_64.tar.gz / # buildkit\",\n \"comment\": \"buildkit.dockerfile.v0\"\n },\n {\n \"created\": \"2026-06-16T00:01:29.967161902Z\",\n \"created_by\": \"CMD [\\\"/bin/sh\\\"]\",\n \"comment\": \"buildkit.dockerfile.v0\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-09-01T00:05:24.224544843Z\",\n \"created_by\": \"ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\",\n \"comment\": \"buildkit.dockerfile.v0\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-09-01T00:05:24.224544843Z\",\n \"created_by\": \"ENV LANG=C.UTF-8\",\n \"comment\": \"buildkit.dockerfile.v0\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-09-01T00:05:24.224544843Z\",\n \"created_by\": \"RUN /bin/sh -c set -eux; \\tapk add --no-cache \\t\\tca-certificates \\t\\ttzdata \\t; # buildkit\",\n \"comment\": \"buildkit.dockerfile.v0\"\n },\n {\n \"created\": \"2026-09-01T00:05:24.224544843Z\",\n \"created_by\": \"ENV GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305\",\n \"comment\": \"buildkit.dockerfile.v0\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-09-01T00:05:24.224544843Z\",\n \"created_by\": \"ENV PYTHON_VERSION=3.12.14\",\n \"comment\": \"buildkit.dockerfile.v0\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-09-01T00:05:24.224544843Z\",\n \"created_by\": \"ENV PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a\",\n \"comment\": \"buildkit.dockerfile.v0\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-09-01T00:10:30.672225972Z\",\n \"created_by\": \"RUN /bin/sh -c set -eux; \\t\\tapk add --no-cache --virtual .build-deps \\t\\tbluez-dev \\t\\tbzip2-dev \\t\\tdpkg-dev dpkg \\t\\tfindutils \\t\\tg++ \\t\\tgcc \\t\\tgdbm-dev \\t\\tgnupg \\t\\tlibc-dev \\t\\tlibffi-dev \\t\\tlibnsl-dev \\t\\tlibtirpc-dev \\t\\tlinux-headers \\t\\tmake \\t\\tncurses-dev \\t\\topenssl-dev \\t\\tpax-utils \\t\\treadline-dev \\t\\tsqlite-dev \\t\\ttar \\t\\ttcl-dev \\t\\ttk \\t\\ttk-dev \\t\\tutil-linux-dev \\t\\txz \\t\\txz-dev \\t\\tzlib-dev \\t; \\t\\twget -O python.tar.xz \\\"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz\\\"; \\techo \\\"$PYTHON_SHA256 *python.tar.xz\\\" | sha256sum -c -; \\twget -O python.tar.xz.asc \\\"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc\\\"; \\tGNUPGHOME=\\\"$(mktemp -d)\\\"; export GNUPGHOME; \\tgpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \\\"$GPG_KEY\\\"; \\tgpg --batch --verify python.tar.xz.asc python.tar.xz; \\tgpgconf --kill all; \\trm -rf \\\"$GNUPGHOME\\\" python.tar.xz.asc; \\tmkdir -p /usr/src/python; \\ttar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; \\trm python.tar.xz; \\t\\tcd /usr/src/python; \\tgnuArch=\\\"$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)\\\"; \\t./configure \\t\\t--build=\\\"$gnuArch\\\" \\t\\t--enable-loadable-sqlite-extensions \\t\\t--enable-option-checking=fatal \\t\\t--enable-shared \\t\\t$(test \\\"${gnuArch%%-*}\\\" != 'riscv64' \\u0026\\u0026 echo '--with-lto') \\t\\t--with-ensurepip \\t; \\tnproc=\\\"$(nproc)\\\"; \\tEXTRA_CFLAGS=\\\"-DTHREAD_STACK_SIZE=0x100000\\\"; \\tLDFLAGS=\\\"${LDFLAGS:-} -Wl,--strip-all\\\"; \\tarch=\\\"$(apk --print-arch)\\\"; \\tcase \\\"$arch\\\" in \\t\\tx86_64|aarch64) \\t\\t\\tEXTRA_CFLAGS=\\\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer\\\"; \\t\\t\\t;; \\t\\tx86) \\t\\t\\t;; \\t\\t*) \\t\\t\\tEXTRA_CFLAGS=\\\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer\\\"; \\t\\t\\t;; \\tesac; \\tmake -j \\\"$nproc\\\" \\t\\t\\\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\\\" \\t\\t\\\"LDFLAGS=${LDFLAGS:-}\\\" \\t; \\trm python; \\tmake -j \\\"$nproc\\\" \\t\\t\\\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\\\" \\t\\t\\\"LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\\\\$\\\\$ORIGIN/../lib'\\\" \\t\\tpython \\t; \\tmake install; \\t\\tcd /; \\trm -rf /usr/src/python; \\t\\tfind /usr/local -depth \\t\\t\\\\( \\t\\t\\t\\\\( -type d -a \\\\( -name test -o -name tests -o -name idle_test \\\\) \\\\) \\t\\t\\t-o \\\\( -type f -a \\\\( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \\\\) \\\\) \\t\\t\\\\) -exec rm -rf '{}' + \\t; \\t\\tfind /usr/local -type f -executable -not \\\\( -name '*tkinter*' \\\\) -exec scanelf --needed --nobanner --format '%n#p' '{}' ';' \\t\\t| tr ',' '\\\\n' \\t\\t| sort -u \\t\\t| awk 'system(\\\"[ -e /usr/local/lib/\\\" $1 \\\" ]\\\") == 0 { next } { print \\\"so:\\\" $1 }' \\t\\t| xargs -rt apk add --no-network --virtual .python-rundeps \\t; \\tapk del --no-network .build-deps; \\t\\texport PYTHONDONTWRITEBYTECODE=1; \\tpython3 --version; \\tpip3 --version # buildkit\",\n \"comment\": \"buildkit.dockerfile.v0\"\n },\n {\n \"created\": \"2026-09-01T00:10:30.782726003Z\",\n \"created_by\": \"RUN /bin/sh -c set -eux; \\tfor src in idle3 pip3 pydoc3 python3 python3-config; do \\t\\tdst=\\\"$(echo \\\"$src\\\" | tr -d 3)\\\"; \\t\\t[ -s \\\"/usr/local/bin/$src\\\" ]; \\t\\t[ ! -e \\\"/usr/local/bin/$dst\\\" ]; \\t\\tln -svT \\\"$src\\\" \\\"/usr/local/bin/$dst\\\"; \\tdone # buildkit\",\n \"comment\": \"buildkit.dockerfile.v0\"\n },\n {\n \"created\": \"2026-09-01T00:10:30.782726003Z\",\n \"created_by\": \"CMD [\\\"python3\\\"]\",\n \"comment\": \"buildkit.dockerfile.v0\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-09-11T00:49:47.962156876+02:00\",\n \"created_by\": \"ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\",\n \"comment\": \"buildkit.dockerfile.v0\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-09-11T00:49:47.962156876+02:00\",\n \"created_by\": \"RUN /bin/sh -c apk add --no-cache 'libuuid\\u003e=2.42.3-r1' \\u0026\\u0026 addgroup -S -g 10001 informed \\u0026\\u0026 adduser -S -u 10001 -G informed -H informed # buildkit\",\n \"comment\": \"buildkit.dockerfile.v0\"\n },\n {\n \"created\": \"2026-10-05T01:03:55.351944978+02:00\",\n \"created_by\": \"COPY /opt/venv /opt/venv # buildkit\",\n \"comment\": \"buildkit.dockerfile.v0\"\n },\n {\n \"created\": \"2026-10-05T01:03:56.462092072+02:00\",\n \"created_by\": \"RUN /bin/sh -c rm -rf /usr/local/bin/pip* /usr/local/lib/python3.12/site-packages/pip* /usr/local/lib/python3.12/site-packages/setuptools* /usr/local/lib/python3.12/site-packages/pkg_resources /opt/venv/bin/pip* /opt/venv/lib/python3.12/site-packages/pip* /opt/venv/lib/python3.12/site-packages/setuptools* /opt/venv/lib/python3.12/site-packages/pkg_resources # buildkit\",\n \"comment\": \"buildkit.dockerfile.v0\"\n },\n {\n \"created\": \"2026-10-05T01:03:56.675216821+02:00\",\n \"created_by\": \"WORKDIR /app\",\n \"comment\": \"buildkit.dockerfile.v0\"\n },\n {\n \"created\": \"2026-10-05T01:03:56.675216821+02:00\",\n \"created_by\": \"USER 10001:10001\",\n \"comment\": \"buildkit.dockerfile.v0\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-10-05T01:03:56.675216821+02:00\",\n \"created_by\": \"EXPOSE [8080/tcp 8081/tcp]\",\n \"comment\": \"buildkit.dockerfile.v0\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-10-05T01:03:56.675216821+02:00\",\n \"created_by\": \"ENTRYPOINT [\\\"informed-decision-container\\\"]\",\n \"comment\": \"buildkit.dockerfile.v0\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-10-11T01:15:11.991443676Z\",\n \"created_by\": \"/bin/sh -c #(nop) ARG SOURCE_REVISION\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-10-11T01:21:04.716126392Z\",\n \"created_by\": \"/bin/sh -c #(nop) LABEL org.opencontainers.image.revision=3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168 org.opencontainers.image.base.digest=sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173 social.coulomb.source.policy.sha256=9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62 social.coulomb.release.scope=INFD-WP-0009-T04/purpose-overlay-v1\",\n \"empty_layer\": true\n },\n {\n \"created\": \"2026-10-11T01:21:04.787527697Z\",\n \"created_by\": \"/bin/sh -c #(nop) COPY file:2be9cb36e7253e15733673359cda8caa22986b6888822a008c1b360d909994e0 in /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py \"\n }\n ],\n \"os\": \"linux\",\n \"rootfs\": {\n \"type\": \"layers\",\n \"diff_ids\": [\n \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\",\n \"sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd\",\n \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\",\n \"sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe\",\n \"sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1\",\n \"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c\",\n \"sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59\",\n \"sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02\",\n \"sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3\"\n ]\n },\n \"config\": {\n \"Entrypoint\": [\n \"informed-decision-container\"\n ],\n \"Env\": [\n \"PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\",\n \"LANG=C.UTF-8\",\n \"GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305\",\n \"PYTHON_VERSION=3.12.14\",\n \"PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a\",\n \"PYTHONDONTWRITEBYTECODE=1\",\n \"PYTHONUNBUFFERED=1\"\n ],\n \"Image\": \"sha256:90f1574f9eda35fa6cb972961beb27a7cb904c36560e381930b0e14065c23883\",\n \"Labels\": {\n \"org.opencontainers.image.base.digest\": \"sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"org.opencontainers.image.revision\": \"3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168\",\n \"social.coulomb.release.scope\": \"INFD-WP-0009-T04/purpose-overlay-v1\",\n \"social.coulomb.source.policy.sha256\": \"9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62\"\n },\n \"User\": \"10001:10001\",\n \"WorkingDir\": \"/app\",\n \"ExposedPorts\": {\n \"8080/tcp\": {},\n \"8081/tcp\": {}\n }\n }\n },\n \"Layers\": [\n {\n \"Size\": 8697856,\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n {\n \"Size\": 1538048,\n \"Digest\": \"sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb\",\n \"DiffID\": \"sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd\"\n },\n {\n \"Size\": 47150592,\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n {\n \"Size\": 5120,\n \"Digest\": \"sha256:ed62c91ccd94e36a928e96d704cfcf20861302590245cc12aa89a15a5d6be29b\",\n \"DiffID\": \"sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe\"\n },\n {\n \"Size\": 131584,\n \"Digest\": \"sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86\",\n \"DiffID\": \"sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1\"\n },\n {\n \"Size\": 30705664,\n \"Digest\": \"sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87\",\n \"DiffID\": \"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c\"\n },\n {\n \"Size\": 12288,\n \"Digest\": \"sha256:16a3dba6b720d3059eab918cd3596f94145ac9cf4d456f925a21f0f72522863f\",\n \"DiffID\": \"sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59\"\n },\n {\n \"Size\": 1536,\n \"Digest\": \"sha256:e73dd464fbff5607cc62a1b2b66b0eefe737dfad4db8e7b58a48cda7c12d94d3\",\n \"DiffID\": \"sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02\"\n },\n {\n \"Size\": 15360,\n \"Digest\": \"sha256:cfee29c2f8119d2a39714ecbe5095a2dc1c986054f2e1fe0a6565163242417e3\",\n \"DiffID\": \"sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3\"\n }\n ]\n },\n \"Results\": [\n {\n \"Target\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a (alpine 3.24.1)\",\n \"Class\": \"os-pkgs\",\n \"Type\": \"alpine\",\n \"Packages\": [\n {\n \"ID\": \".python-rundeps@20260901.001029\",\n \"Name\": \".python-rundeps\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch\\u0026distro=3.24.1\",\n \"UID\": \"4e26c99fecac1e97\"\n },\n \"Version\": \"20260901.001029\",\n \"Arch\": \"noarch\",\n \"DependsOn\": [\n \"gdbm@1.26-r0\",\n \"libbz2@1.0.8-r6\",\n \"libcrypto3@3.5.8-r0\",\n \"libffi@3.5.2-r1\",\n \"libncursesw@6.6_p20260516-r0\",\n \"libnsl@2.0.1-r2\",\n \"libpanelw@6.6_p20260516-r0\",\n \"libssl3@3.5.8-r0\",\n \"libtirpc@1.3.5-r1\",\n \"libuuid@2.42.3-r1\",\n \"musl@1.2.6-r2\",\n \"readline@8.3.3-r1\",\n \"sqlite-libs@3.53.4-r0\",\n \"xz-libs@5.8.3-r0\",\n \"zlib@1.3.2-r0\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:51d0c1e7d88a414345799f0309185c625013ef32\",\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"alpine-baselayout@3.7.2-r1\",\n \"Name\": \"alpine-baselayout\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"1b9c543300f8073e\"\n },\n \"Version\": \"3.7.2-r1\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"alpine-baselayout\",\n \"SrcVersion\": \"3.7.2-r1\",\n \"Licenses\": [\n \"GPL-2.0-only\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"alpine-baselayout-data@3.7.2-r1\",\n \"busybox-binsh@1.37.0-r31\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:f0fcfdc2f4da058af6473bc45c4eab62916225b2\",\n \"InstalledFiles\": [\n \"etc/motd\",\n \"etc/crontabs/root\",\n \"etc/modprobe.d/aliases.conf\",\n \"etc/modprobe.d/blacklist.conf\",\n \"etc/modprobe.d/i386.conf\",\n \"etc/profile.d/20locale.sh\",\n \"etc/profile.d/README\",\n \"etc/profile.d/color_prompt.sh.disabled\",\n \"usr/lib/sysctl.d/00-alpine.conf\",\n \"var/lock\",\n \"var/run\",\n \"var/spool/mail\",\n \"var/spool/cron/crontabs\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"alpine-baselayout-data@3.7.2-r1\",\n \"Name\": \"alpine-baselayout-data\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"fcc3cd90122d8aa7\"\n },\n \"Version\": \"3.7.2-r1\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"alpine-baselayout\",\n \"SrcVersion\": \"3.7.2-r1\",\n \"Licenses\": [\n \"GPL-2.0-only\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:c6f9bded17d844b6f1b0bb5766d2c35c0d5c8508\",\n \"InstalledFiles\": [\n \"etc/fstab\",\n \"etc/group\",\n \"etc/hostname\",\n \"etc/hosts\",\n \"etc/inittab\",\n \"etc/modules\",\n \"etc/mtab\",\n \"etc/nsswitch.conf\",\n \"etc/passwd\",\n \"etc/profile\",\n \"etc/protocols\",\n \"etc/services\",\n \"etc/shadow\",\n \"etc/shells\",\n \"etc/sysctl.conf\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"alpine-keys@2.6-r0\",\n \"Name\": \"alpine-keys\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"cb1f6c8fa74713e0\"\n },\n \"Version\": \"2.6-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"alpine-keys\",\n \"SrcVersion\": \"2.6-r0\",\n \"Licenses\": [\n \"MIT\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:d8d6b80e53c059a77e4915da78ba964f3ffea240\",\n \"InstalledFiles\": [\n \"etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub\",\n \"etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub\",\n \"etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub\",\n \"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub\",\n \"usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub\",\n \"usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub\",\n \"usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub\",\n \"usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub\",\n \"usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub\",\n \"usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub\",\n \"usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub\",\n \"usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub\",\n \"usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub\",\n \"usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub\",\n \"usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub\",\n \"usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub\",\n \"usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub\",\n \"usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub\",\n \"usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub\",\n \"usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub\",\n \"usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub\",\n \"usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub\",\n \"usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub\",\n \"usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"alpine-release@3.24.1-r0\",\n \"Name\": \"alpine-release\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"6cfad6f36e1f31aa\"\n },\n \"Version\": \"3.24.1-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"alpine-base\",\n \"SrcVersion\": \"3.24.1-r0\",\n \"Licenses\": [\n \"MIT\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"alpine-keys@2.6-r0\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:bc6912a25cdc7733e0035ed509eceaa4026946e3\",\n \"InstalledFiles\": [\n \"etc/alpine-release\",\n \"etc/issue\",\n \"etc/os-release\",\n \"etc/secfixes.d/alpine\",\n \"usr/lib/os-release\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"apk-tools@3.0.6-r0\",\n \"Name\": \"apk-tools\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"cb2633c883b17a04\"\n },\n \"Version\": \"3.0.6-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"apk-tools\",\n \"SrcVersion\": \"3.0.6-r0\",\n \"Licenses\": [\n \"GPL-2.0-only\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"ca-certificates-bundle@20260611-r0\",\n \"libapk@3.0.6-r0\",\n \"libcrypto3@3.5.8-r0\",\n \"musl@1.2.6-r2\",\n \"zlib@1.3.2-r0\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:043333589798a1f52e09ae63f026c6c8fa676d34\",\n \"InstalledFiles\": [\n \"sbin/apk\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"busybox@1.37.0-r31\",\n \"Name\": \"busybox\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"771020c43c8440bf\"\n },\n \"Version\": \"1.37.0-r31\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"busybox\",\n \"SrcVersion\": \"1.37.0-r31\",\n \"Licenses\": [\n \"GPL-2.0-only\"\n ],\n \"Maintainer\": \"S\u00f6ren Tempel \\u003csoeren+alpine@soeren-tempel.net\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:b5405ebc02f7dd8be95b6265c54b243d5456ab8f\",\n \"InstalledFiles\": [\n \"bin/busybox\",\n \"etc/securetty\",\n \"etc/busybox-paths.d/busybox\",\n \"etc/logrotate.d/acpid\",\n \"etc/network/if-up.d/dad\",\n \"etc/udhcpc/udhcpc.conf\",\n \"usr/share/udhcpc/default.script\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"busybox-binsh@1.37.0-r31\",\n \"Name\": \"busybox-binsh\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"1ec8a3d5d2b63297\"\n },\n \"Version\": \"1.37.0-r31\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"busybox\",\n \"SrcVersion\": \"1.37.0-r31\",\n \"Licenses\": [\n \"GPL-2.0-only\"\n ],\n \"Maintainer\": \"S\u00f6ren Tempel \\u003csoeren+alpine@soeren-tempel.net\\u003e\",\n \"DependsOn\": [\n \"busybox@1.37.0-r31\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:5cbd14acc6f1804c5bac6c77dc2c492f010b0fc7\",\n \"InstalledFiles\": [\n \"bin/sh\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"ca-certificates@20260611-r0\",\n \"Name\": \"ca-certificates\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"2a3c316ee83c6198\"\n },\n \"Version\": \"20260611-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"ca-certificates\",\n \"SrcVersion\": \"20260611-r0\",\n \"Licenses\": [\n \"MPL-2.0\",\n \"MIT\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"busybox-binsh@1.37.0-r31\",\n \"libcrypto3@3.5.8-r0\",\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb\",\n \"DiffID\": \"sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd\"\n },\n \"Digest\": \"sha1:8f2a04abeb54b331e2970a0a0dffb7bd6bdde567\",\n \"InstalledFiles\": [\n \"etc/ca-certificates.conf\",\n \"etc/apk/protected_paths.d/ca-certificates.list\",\n \"etc/ca-certificates/update.d/certhash\",\n \"usr/bin/c_rehash\",\n \"usr/sbin/update-ca-certificates\",\n \"usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt\",\n \"usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt\",\n \"usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt\",\n \"usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt\",\n \"usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt\",\n \"usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt\",\n \"usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt\",\n \"usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt\",\n \"usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt\",\n \"usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt\",\n \"usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt\",\n \"usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt\",\n \"usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt\",\n \"usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt\",\n \"usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt\",\n \"usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt\",\n \"usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt\",\n \"usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt\",\n \"usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt\",\n \"usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt\",\n \"usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt\",\n \"usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt\",\n \"usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt\",\n \"usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt\",\n \"usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt\",\n \"usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt\",\n \"usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt\",\n \"usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt\",\n \"usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt\",\n \"usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt\",\n \"usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt\",\n \"usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt\",\n \"usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt\",\n \"usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt\",\n \"usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt\",\n \"usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt\",\n \"usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt\",\n \"usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt\",\n \"usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt\",\n \"usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt\",\n \"usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt\",\n \"usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt\",\n \"usr/share/ca-certificates/mozilla/GTS_Root_R1.crt\",\n \"usr/share/ca-certificates/mozilla/GTS_Root_R3.crt\",\n \"usr/share/ca-certificates/mozilla/GTS_Root_R4.crt\",\n \"usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt\",\n \"usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt\",\n \"usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt\",\n \"usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt\",\n \"usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt\",\n \"usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt\",\n \"usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt\",\n \"usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt\",\n \"usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt\",\n \"usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt\",\n \"usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt\",\n \"usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt\",\n \"usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt\",\n \"usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt\",\n \"usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt\",\n \"usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt\",\n \"usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt\",\n \"usr/share/ca-certificates/mozilla/Izenpe.com.crt\",\n \"usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt\",\n \"usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt\",\n \"usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt\",\n \"usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt\",\n \"usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_F\u0151tan\u00fas\u00edtv\u00e1ny.crt\",\n \"usr/share/ca-certificates/mozilla/OISTE_Server_Root_ECC_G1.crt\",\n \"usr/share/ca-certificates/mozilla/OISTE_Server_Root_RSA_G1.crt\",\n \"usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt\",\n \"usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt\",\n \"usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt\",\n \"usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt\",\n \"usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt\",\n \"usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt\",\n \"usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt\",\n \"usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt\",\n \"usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt\",\n \"usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt\",\n \"usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt\",\n \"usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt\",\n \"usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt\",\n \"usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt\",\n \"usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt\",\n \"usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt\",\n \"usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt\",\n \"usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt\",\n \"usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt\",\n \"usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt\",\n \"usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt\",\n \"usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt\",\n \"usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt\",\n \"usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt\",\n \"usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt\",\n \"usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt\",\n \"usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt\",\n \"usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt\",\n \"usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt\",\n \"usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt\",\n \"usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt\",\n \"usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt\",\n \"usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt\",\n \"usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt\",\n \"usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt\",\n \"usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt\",\n \"usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt\",\n \"usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt\",\n \"usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt\",\n \"usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt\",\n \"usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt\",\n \"usr/share/ca-certificates/mozilla/e-Szigno_TLS_Root_CA_2023.crt\",\n \"usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt\",\n \"usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt\",\n \"usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt\",\n \"usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt\",\n \"usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt\",\n \"usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt\",\n \"usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"ca-certificates-bundle@20260611-r0\",\n \"Name\": \"ca-certificates-bundle\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"20337c2ea28bef28\"\n },\n \"Version\": \"20260611-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"ca-certificates\",\n \"SrcVersion\": \"20260611-r0\",\n \"Licenses\": [\n \"MPL-2.0\",\n \"MIT\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:c9534a03750bdfae341f10969016090fc11febbd\",\n \"InstalledFiles\": [\n \"etc/ssl/cert.pem\",\n \"etc/ssl/certs/ca-certificates.crt\",\n \"etc/ssl1.1/cert.pem\",\n \"etc/ssl1.1/certs\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"gdbm@1.26-r0\",\n \"Name\": \"gdbm\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"5eb1a3f86262ca77\"\n },\n \"Version\": \"1.26-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"gdbm\",\n \"SrcVersion\": \"1.26-r0\",\n \"Licenses\": [\n \"GPL-3.0-or-later\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:619493d8124fe49a8ee1d8f7a1372cf7e3977337\",\n \"InstalledFiles\": [\n \"usr/lib/libgdbm.so.6\",\n \"usr/lib/libgdbm.so.6.0.0\",\n \"usr/lib/libgdbm_compat.so.4\",\n \"usr/lib/libgdbm_compat.so.4.0.0\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"keyutils-libs@1.6.3-r4\",\n \"Name\": \"keyutils-libs\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"a1a29120eb342032\"\n },\n \"Version\": \"1.6.3-r4\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"keyutils\",\n \"SrcVersion\": \"1.6.3-r4\",\n \"Licenses\": [\n \"GPL-2.0-or-later\",\n \"LGPL-2.0-or-later\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:b7331c96f077fc3522ee4361a441d1097204cd90\",\n \"InstalledFiles\": [\n \"usr/lib/libkeyutils.so.1\",\n \"usr/lib/libkeyutils.so.1.10\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"krb5-conf@1.0-r2\",\n \"Name\": \"krb5-conf\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"e7cf94ba8b6dbc33\"\n },\n \"Version\": \"1.0-r2\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"krb5-conf\",\n \"SrcVersion\": \"1.0-r2\",\n \"Licenses\": [\n \"MIT\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:40a11e0690a59e110367b62a80661024e9942a2d\",\n \"InstalledFiles\": [\n \"etc/krb5.conf\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"krb5-libs@1.22.2-r1\",\n \"Name\": \"krb5-libs\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"958f8b4a4f087dac\"\n },\n \"Version\": \"1.22.2-r1\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"krb5\",\n \"SrcVersion\": \"1.22.2-r1\",\n \"Licenses\": [\n \"MIT\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"keyutils-libs@1.6.3-r4\",\n \"krb5-conf@1.0-r2\",\n \"libcom_err@1.47.4-r0\",\n \"libcrypto3@3.5.8-r0\",\n \"libssl3@3.5.8-r0\",\n \"libverto@0.3.2-r2\",\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:ef02346e21b817ff379e4601e5b1fc9760e5e31a\",\n \"InstalledFiles\": [\n \"usr/lib/libgssapi_krb5.so.2\",\n \"usr/lib/libgssapi_krb5.so.2.2\",\n \"usr/lib/libgssrpc.so.4\",\n \"usr/lib/libgssrpc.so.4.2\",\n \"usr/lib/libk5crypto.so.3\",\n \"usr/lib/libk5crypto.so.3.1\",\n \"usr/lib/libkadm5clnt_mit.so.12\",\n \"usr/lib/libkadm5clnt_mit.so.12.0\",\n \"usr/lib/libkadm5srv_mit.so.12\",\n \"usr/lib/libkadm5srv_mit.so.12.0\",\n \"usr/lib/libkdb5.so.10\",\n \"usr/lib/libkdb5.so.10.0\",\n \"usr/lib/libkrad.so.0\",\n \"usr/lib/libkrad.so.0.0\",\n \"usr/lib/libkrb5.so.3\",\n \"usr/lib/libkrb5.so.3.3\",\n \"usr/lib/libkrb5support.so.0\",\n \"usr/lib/libkrb5support.so.0.1\",\n \"usr/lib/krb5/plugins/kdb/db2.so\",\n \"usr/lib/krb5/plugins/preauth/otp.so\",\n \"usr/lib/krb5/plugins/preauth/spake.so\",\n \"usr/lib/krb5/plugins/preauth/test.so\",\n \"usr/lib/krb5/plugins/tls/k5tls.so\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libapk@3.0.6-r0\",\n \"Name\": \"libapk\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"a35b8b9b3219513a\"\n },\n \"Version\": \"3.0.6-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"apk-tools\",\n \"SrcVersion\": \"3.0.6-r0\",\n \"Licenses\": [\n \"GPL-2.0-only\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"libcrypto3@3.5.8-r0\",\n \"libssl3@3.5.8-r0\",\n \"musl@1.2.6-r2\",\n \"zlib@1.3.2-r0\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:523a8f58104589f74f743d501c81bf6517155378\",\n \"InstalledFiles\": [\n \"usr/lib/libapk.so.3.0.0\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libbz2@1.0.8-r6\",\n \"Name\": \"libbz2\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"48e17539404e2d56\"\n },\n \"Version\": \"1.0.8-r6\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"bzip2\",\n \"SrcVersion\": \"1.0.8-r6\",\n \"Licenses\": [\n \"bzip-2-1.0.6\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:08566ba5c7af97c25474be8b24e8b48f0116b67d\",\n \"InstalledFiles\": [\n \"usr/lib/libbz2.so.1\",\n \"usr/lib/libbz2.so.1.0.8\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libcom_err@1.47.4-r0\",\n \"Name\": \"libcom_err\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"3fc35a3f66d192af\"\n },\n \"Version\": \"1.47.4-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"e2fsprogs\",\n \"SrcVersion\": \"1.47.4-r0\",\n \"Licenses\": [\n \"GPL-2.0-or-later\",\n \"LGPL-2.0-or-later\",\n \"BSD-3-Clause\",\n \"MIT\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:4b9fb5899ea0b1c0cfbb2a2c5952704437d4ecef\",\n \"InstalledFiles\": [\n \"usr/lib/libcom_err.so.2\",\n \"usr/lib/libcom_err.so.2.1\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libcrypto3@3.5.8-r0\",\n \"Name\": \"libcrypto3\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"4299bba2ba9c96aa\"\n },\n \"Version\": \"3.5.8-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"openssl\",\n \"SrcVersion\": \"3.5.8-r0\",\n \"Licenses\": [\n \"Apache-2.0\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:1b3b9fc0c136f4936932bcb2ec21499f0ae5dfd3\",\n \"InstalledFiles\": [\n \"etc/ssl/ct_log_list.cnf\",\n \"etc/ssl/ct_log_list.cnf.dist\",\n \"etc/ssl/openssl.cnf\",\n \"etc/ssl/openssl.cnf.dist\",\n \"usr/lib/libcrypto.so.3\",\n \"usr/lib/engines-3/afalg.so\",\n \"usr/lib/engines-3/capi.so\",\n \"usr/lib/engines-3/loader_attic.so\",\n \"usr/lib/engines-3/padlock.so\",\n \"usr/lib/ossl-modules/legacy.so\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libffi@3.5.2-r1\",\n \"Name\": \"libffi\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"d3eaa921287b1ccd\"\n },\n \"Version\": \"3.5.2-r1\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"libffi\",\n \"SrcVersion\": \"3.5.2-r1\",\n \"Licenses\": [\n \"MIT\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:2f7b261f7fcecc4eebd8b330e7f6fb80713bfe3a\",\n \"InstalledFiles\": [\n \"usr/lib/libffi.so.8\",\n \"usr/lib/libffi.so.8.2.0\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libintl@1.0-r0\",\n \"Name\": \"libintl\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libintl@1.0-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"25c18808d8fc87e0\"\n },\n \"Version\": \"1.0-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"gettext\",\n \"SrcVersion\": \"1.0-r0\",\n \"Licenses\": [\n \"LGPL-2.1-or-later\"\n ],\n \"Maintainer\": \"Carlo Landmeter \\u003cclandmeter@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:282d6642ccac87237e43a864159d73cf5abe7550\",\n \"InstalledFiles\": [\n \"usr/lib/libintl.so.8\",\n \"usr/lib/libintl.so.8.4.6\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libncursesw@6.6_p20260516-r0\",\n \"Name\": \"libncursesw\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"e8939f45e2191bcc\"\n },\n \"Version\": \"6.6_p20260516-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"ncurses\",\n \"SrcVersion\": \"6.6_p20260516-r0\",\n \"Licenses\": [\n \"X-11\"\n ],\n \"Maintainer\": \"Milan P. Stani\u0107 \\u003cmps@arvanta.net\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\",\n \"ncurses-terminfo-base@6.6_p20260516-r0\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:9f318e6e324d6827274829194cf6ac6afbaded12\",\n \"InstalledFiles\": [\n \"usr/lib/libncursesw.so.6\",\n \"usr/lib/libncursesw.so.6.6\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libnsl@2.0.1-r2\",\n \"Name\": \"libnsl\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"3d893c60d41da67b\"\n },\n \"Version\": \"2.0.1-r2\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"libnsl\",\n \"SrcVersion\": \"2.0.1-r2\",\n \"Licenses\": [\n \"LGPL-2.0-or-later\"\n ],\n \"DependsOn\": [\n \"libintl@1.0-r0\",\n \"libtirpc@1.3.5-r1\",\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:5194adbf26560b52be318481a7af294ab05fd795\",\n \"InstalledFiles\": [\n \"usr/lib/libnsl.so.3\",\n \"usr/lib/libnsl.so.3.0.0\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libpanelw@6.6_p20260516-r0\",\n \"Name\": \"libpanelw\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"ef1ad9bb256b373\"\n },\n \"Version\": \"6.6_p20260516-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"ncurses\",\n \"SrcVersion\": \"6.6_p20260516-r0\",\n \"Licenses\": [\n \"X-11\"\n ],\n \"Maintainer\": \"Milan P. Stani\u0107 \\u003cmps@arvanta.net\\u003e\",\n \"DependsOn\": [\n \"libncursesw@6.6_p20260516-r0\",\n \"musl@1.2.6-r2\",\n \"ncurses-terminfo-base@6.6_p20260516-r0\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:149bdc434232ed11fc5bb975ba519a07154a6f56\",\n \"InstalledFiles\": [\n \"usr/lib/libpanelw.so.6\",\n \"usr/lib/libpanelw.so.6.6\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libssl3@3.5.8-r0\",\n \"Name\": \"libssl3\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"f290ab59b88b1c4a\"\n },\n \"Version\": \"3.5.8-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"openssl\",\n \"SrcVersion\": \"3.5.8-r0\",\n \"Licenses\": [\n \"Apache-2.0\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"libcrypto3@3.5.8-r0\",\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:5f9b1e55d821953d2e2b1db322dad70a3b5041ea\",\n \"InstalledFiles\": [\n \"usr/lib/libssl.so.3\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libtirpc@1.3.5-r1\",\n \"Name\": \"libtirpc\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"471c8d955ca03be5\"\n },\n \"Version\": \"1.3.5-r1\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"libtirpc\",\n \"SrcVersion\": \"1.3.5-r1\",\n \"Licenses\": [\n \"BSD-3-Clause\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"krb5-libs@1.22.2-r1\",\n \"libtirpc-conf@1.3.5-r1\",\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:c32865bd86a8b8829d152279cabbc5ac6d430eb2\",\n \"InstalledFiles\": [\n \"usr/lib/libtirpc.so.3\",\n \"usr/lib/libtirpc.so.3.0.0\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libtirpc-conf@1.3.5-r1\",\n \"Name\": \"libtirpc-conf\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"3437392c14aad33f\"\n },\n \"Version\": \"1.3.5-r1\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"libtirpc\",\n \"SrcVersion\": \"1.3.5-r1\",\n \"Licenses\": [\n \"BSD-3-Clause\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:0c17d9988dc986c90e22f79778df047eca9973ff\",\n \"InstalledFiles\": [\n \"etc/bindresvport.blacklist\",\n \"etc/netconfig\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libuuid@2.42.3-r1\",\n \"Name\": \"libuuid\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"c444e9cdd1bdda40\"\n },\n \"Version\": \"2.42.3-r1\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"util-linux\",\n \"SrcVersion\": \"2.42.3-r1\",\n \"Licenses\": [\n \"BSD-3-Clause\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:f0fe3e08ab046c0c5e29d34ee73bc8c7e03398eb891e4498e0a67088a5ea3e86\",\n \"DiffID\": \"sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1\"\n },\n \"Digest\": \"sha1:8f041ef637ad75f381cc0c034f2afbbb0303264e\",\n \"InstalledFiles\": [\n \"usr/lib/libuuid.so.1\",\n \"usr/lib/libuuid.so.1.3.0\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"libverto@0.3.2-r2\",\n \"Name\": \"libverto\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"9df4321a283a6cf6\"\n },\n \"Version\": \"0.3.2-r2\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"libverto\",\n \"SrcVersion\": \"0.3.2-r2\",\n \"Licenses\": [\n \"MIT\"\n ],\n \"Maintainer\": \"Francesco Colista \\u003cfcolista@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:73233059338142e4ac6d8fb8bb0074e93da75dc1\",\n \"InstalledFiles\": [\n \"usr/lib/libverto.so.1\",\n \"usr/lib/libverto.so.1.0.0\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"musl@1.2.6-r2\",\n \"Name\": \"musl\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"1f8cb44befe503d4\"\n },\n \"Version\": \"1.2.6-r2\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"musl\",\n \"SrcVersion\": \"1.2.6-r2\",\n \"Licenses\": [\n \"MIT\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:0f7e5827e4e1a73631beda27b78431a8ba240e05\",\n \"InstalledFiles\": [\n \"lib/ld-musl-x86_64.so.1\",\n \"lib/libc.musl-x86_64.so.1\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"musl-utils@1.2.6-r2\",\n \"Name\": \"musl-utils\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"4497482ec1d943e1\"\n },\n \"Version\": \"1.2.6-r2\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"musl\",\n \"SrcVersion\": \"1.2.6-r2\",\n \"Licenses\": [\n \"MIT\",\n \"BSD-2-Clause\",\n \"GPL-2.0-or-later\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\",\n \"scanelf@1.3.9-r1\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:75ada3c48d63ec5d87c42fdf934a3fdd11298dc5\",\n \"InstalledFiles\": [\n \"sbin/ldconfig\",\n \"usr/bin/getconf\",\n \"usr/bin/getent\",\n \"usr/bin/iconv\",\n \"usr/bin/ldd\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"ncurses-terminfo-base@6.6_p20260516-r0\",\n \"Name\": \"ncurses-terminfo-base\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"e7fac5c6a6e9ae8\"\n },\n \"Version\": \"6.6_p20260516-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"ncurses\",\n \"SrcVersion\": \"6.6_p20260516-r0\",\n \"Licenses\": [\n \"X-11\"\n ],\n \"Maintainer\": \"Milan P. Stani\u0107 \\u003cmps@arvanta.net\\u003e\",\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:9d551d828e9c8ee52c5801c1d6046828ebf15752\",\n \"InstalledFiles\": [\n \"etc/terminfo/a/alacritty\",\n \"etc/terminfo/a/ansi\",\n \"etc/terminfo/d/dumb\",\n \"etc/terminfo/g/gnome\",\n \"etc/terminfo/g/gnome-256color\",\n \"etc/terminfo/k/konsole\",\n \"etc/terminfo/k/konsole-256color\",\n \"etc/terminfo/k/konsole-linux\",\n \"etc/terminfo/l/linux\",\n \"etc/terminfo/p/putty\",\n \"etc/terminfo/p/putty-256color\",\n \"etc/terminfo/r/rxvt\",\n \"etc/terminfo/r/rxvt-256color\",\n \"etc/terminfo/s/screen\",\n \"etc/terminfo/s/screen-256color\",\n \"etc/terminfo/s/st-0.6\",\n \"etc/terminfo/s/st-0.7\",\n \"etc/terminfo/s/st-0.8\",\n \"etc/terminfo/s/st-0.8.5\",\n \"etc/terminfo/s/st-16color\",\n \"etc/terminfo/s/st-256color\",\n \"etc/terminfo/s/st-direct\",\n \"etc/terminfo/s/sun\",\n \"etc/terminfo/t/terminator\",\n \"etc/terminfo/t/terminology\",\n \"etc/terminfo/t/terminology-0.6.1\",\n \"etc/terminfo/t/terminology-1.0.0\",\n \"etc/terminfo/t/terminology-1.8.1\",\n \"etc/terminfo/t/tmux\",\n \"etc/terminfo/t/tmux-256color\",\n \"etc/terminfo/v/vt100\",\n \"etc/terminfo/v/vt102\",\n \"etc/terminfo/v/vt200\",\n \"etc/terminfo/v/vt220\",\n \"etc/terminfo/v/vt52\",\n \"etc/terminfo/v/vte\",\n \"etc/terminfo/v/vte-256color\",\n \"etc/terminfo/x/xterm\",\n \"etc/terminfo/x/xterm-256color\",\n \"etc/terminfo/x/xterm-color\",\n \"etc/terminfo/x/xterm-xfree86\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"readline@8.3.3-r1\",\n \"Name\": \"readline\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"f50058781c93e1f2\"\n },\n \"Version\": \"8.3.3-r1\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"readline\",\n \"SrcVersion\": \"8.3.3-r1\",\n \"Licenses\": [\n \"GPL-3.0-or-later\"\n ],\n \"Maintainer\": \"qaqland \\u003cqaq@qaq.land\\u003e\",\n \"DependsOn\": [\n \"libncursesw@6.6_p20260516-r0\",\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:945b16e378bc00e44d89d4de8124bba7647fdf4d\",\n \"InstalledFiles\": [\n \"etc/inputrc\",\n \"usr/lib/libreadline.so.8\",\n \"usr/lib/libreadline.so.8.3\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"scanelf@1.3.9-r1\",\n \"Name\": \"scanelf\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"936394657a1626fb\"\n },\n \"Version\": \"1.3.9-r1\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"pax-utils\",\n \"SrcVersion\": \"1.3.9-r1\",\n \"Licenses\": [\n \"GPL-2.0-only\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:013f903d0ba219673aebbdd04f74bb5ed82b01f0\",\n \"InstalledFiles\": [\n \"usr/bin/scanelf\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"sqlite-libs@3.53.4-r0\",\n \"Name\": \"sqlite-libs\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"8b10aee2ccc192de\"\n },\n \"Version\": \"3.53.4-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"sqlite\",\n \"SrcVersion\": \"3.53.4-r0\",\n \"Licenses\": [\n \"blessing\"\n ],\n \"Maintainer\": \"Jingyun Hua \\u003chuajingyun@loongson.cn\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:f7630ceb37c232b6609861aeab6cdb9cd120e6fa\",\n \"InstalledFiles\": [\n \"usr/lib/libsqlite3.so.0\",\n \"usr/lib/libsqlite3.so.3.53.4\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"ssl_client@1.37.0-r31\",\n \"Name\": \"ssl_client\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"d42e31f15a4ce47a\"\n },\n \"Version\": \"1.37.0-r31\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"busybox\",\n \"SrcVersion\": \"1.37.0-r31\",\n \"Licenses\": [\n \"GPL-2.0-only\"\n ],\n \"Maintainer\": \"S\u00f6ren Tempel \\u003csoeren+alpine@soeren-tempel.net\\u003e\",\n \"DependsOn\": [\n \"libcrypto3@3.5.8-r0\",\n \"libssl3@3.5.8-r0\",\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:c220f4a5125a313af733e98def94132bb1e9d40d\",\n \"InstalledFiles\": [\n \"usr/bin/ssl_client\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"tzdata@2026c-r0\",\n \"Name\": \"tzdata\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"52c6b50eff629f9d\"\n },\n \"Version\": \"2026c-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"tzdata\",\n \"SrcVersion\": \"2026c-r0\",\n \"Licenses\": [\n \"Public-Domain\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"Layer\": {\n \"Digest\": \"sha256:47393b668ce535d06e8967917d424c177e2ecccae83856d48b2e99164f8cc6cb\",\n \"DiffID\": \"sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd\"\n },\n \"Digest\": \"sha1:61f7544ecd8dd63eac23fe3e645702fda92ef02a\",\n \"InstalledFiles\": [\n \"usr/share/zoneinfo/CET\",\n \"usr/share/zoneinfo/CST6CDT\",\n \"usr/share/zoneinfo/Cuba\",\n \"usr/share/zoneinfo/EET\",\n \"usr/share/zoneinfo/EST\",\n \"usr/share/zoneinfo/EST5EDT\",\n \"usr/share/zoneinfo/Egypt\",\n \"usr/share/zoneinfo/Eire\",\n \"usr/share/zoneinfo/Factory\",\n \"usr/share/zoneinfo/GB\",\n \"usr/share/zoneinfo/GB-Eire\",\n \"usr/share/zoneinfo/GMT\",\n \"usr/share/zoneinfo/GMT+0\",\n \"usr/share/zoneinfo/GMT-0\",\n \"usr/share/zoneinfo/GMT0\",\n \"usr/share/zoneinfo/Greenwich\",\n \"usr/share/zoneinfo/HST\",\n \"usr/share/zoneinfo/Hongkong\",\n \"usr/share/zoneinfo/Iceland\",\n \"usr/share/zoneinfo/Iran\",\n \"usr/share/zoneinfo/Israel\",\n \"usr/share/zoneinfo/Jamaica\",\n \"usr/share/zoneinfo/Japan\",\n \"usr/share/zoneinfo/Kwajalein\",\n \"usr/share/zoneinfo/Libya\",\n \"usr/share/zoneinfo/MET\",\n \"usr/share/zoneinfo/MST\",\n \"usr/share/zoneinfo/MST7MDT\",\n \"usr/share/zoneinfo/NZ\",\n \"usr/share/zoneinfo/NZ-CHAT\",\n \"usr/share/zoneinfo/Navajo\",\n \"usr/share/zoneinfo/PRC\",\n \"usr/share/zoneinfo/PST8PDT\",\n \"usr/share/zoneinfo/Poland\",\n \"usr/share/zoneinfo/Portugal\",\n \"usr/share/zoneinfo/ROC\",\n \"usr/share/zoneinfo/ROK\",\n \"usr/share/zoneinfo/Singapore\",\n \"usr/share/zoneinfo/Turkey\",\n \"usr/share/zoneinfo/UCT\",\n \"usr/share/zoneinfo/UTC\",\n \"usr/share/zoneinfo/Universal\",\n \"usr/share/zoneinfo/W-SU\",\n \"usr/share/zoneinfo/WET\",\n \"usr/share/zoneinfo/Zulu\",\n \"usr/share/zoneinfo/iso3166.tab\",\n \"usr/share/zoneinfo/leap-seconds.list\",\n \"usr/share/zoneinfo/posixrules\",\n \"usr/share/zoneinfo/zone.tab\",\n \"usr/share/zoneinfo/zone1970.tab\",\n \"usr/share/zoneinfo/Africa/Abidjan\",\n \"usr/share/zoneinfo/Africa/Accra\",\n \"usr/share/zoneinfo/Africa/Addis_Ababa\",\n \"usr/share/zoneinfo/Africa/Algiers\",\n \"usr/share/zoneinfo/Africa/Asmara\",\n \"usr/share/zoneinfo/Africa/Asmera\",\n \"usr/share/zoneinfo/Africa/Bamako\",\n \"usr/share/zoneinfo/Africa/Bangui\",\n \"usr/share/zoneinfo/Africa/Banjul\",\n \"usr/share/zoneinfo/Africa/Bissau\",\n \"usr/share/zoneinfo/Africa/Blantyre\",\n \"usr/share/zoneinfo/Africa/Brazzaville\",\n \"usr/share/zoneinfo/Africa/Bujumbura\",\n \"usr/share/zoneinfo/Africa/Cairo\",\n \"usr/share/zoneinfo/Africa/Casablanca\",\n \"usr/share/zoneinfo/Africa/Ceuta\",\n \"usr/share/zoneinfo/Africa/Conakry\",\n \"usr/share/zoneinfo/Africa/Dakar\",\n \"usr/share/zoneinfo/Africa/Dar_es_Salaam\",\n \"usr/share/zoneinfo/Africa/Djibouti\",\n \"usr/share/zoneinfo/Africa/Douala\",\n \"usr/share/zoneinfo/Africa/El_Aaiun\",\n \"usr/share/zoneinfo/Africa/Freetown\",\n \"usr/share/zoneinfo/Africa/Gaborone\",\n \"usr/share/zoneinfo/Africa/Harare\",\n \"usr/share/zoneinfo/Africa/Johannesburg\",\n \"usr/share/zoneinfo/Africa/Juba\",\n \"usr/share/zoneinfo/Africa/Kampala\",\n \"usr/share/zoneinfo/Africa/Khartoum\",\n \"usr/share/zoneinfo/Africa/Kigali\",\n \"usr/share/zoneinfo/Africa/Kinshasa\",\n \"usr/share/zoneinfo/Africa/Lagos\",\n \"usr/share/zoneinfo/Africa/Libreville\",\n \"usr/share/zoneinfo/Africa/Lome\",\n \"usr/share/zoneinfo/Africa/Luanda\",\n \"usr/share/zoneinfo/Africa/Lubumbashi\",\n \"usr/share/zoneinfo/Africa/Lusaka\",\n \"usr/share/zoneinfo/Africa/Malabo\",\n \"usr/share/zoneinfo/Africa/Maputo\",\n \"usr/share/zoneinfo/Africa/Maseru\",\n \"usr/share/zoneinfo/Africa/Mbabane\",\n \"usr/share/zoneinfo/Africa/Mogadishu\",\n \"usr/share/zoneinfo/Africa/Monrovia\",\n \"usr/share/zoneinfo/Africa/Nairobi\",\n \"usr/share/zoneinfo/Africa/Ndjamena\",\n \"usr/share/zoneinfo/Africa/Niamey\",\n \"usr/share/zoneinfo/Africa/Nouakchott\",\n \"usr/share/zoneinfo/Africa/Ouagadougou\",\n \"usr/share/zoneinfo/Africa/Porto-Novo\",\n \"usr/share/zoneinfo/Africa/Sao_Tome\",\n \"usr/share/zoneinfo/Africa/Timbuktu\",\n \"usr/share/zoneinfo/Africa/Tripoli\",\n \"usr/share/zoneinfo/Africa/Tunis\",\n \"usr/share/zoneinfo/Africa/Windhoek\",\n \"usr/share/zoneinfo/America/Adak\",\n \"usr/share/zoneinfo/America/Anchorage\",\n \"usr/share/zoneinfo/America/Anguilla\",\n \"usr/share/zoneinfo/America/Antigua\",\n \"usr/share/zoneinfo/America/Araguaina\",\n \"usr/share/zoneinfo/America/Aruba\",\n \"usr/share/zoneinfo/America/Asuncion\",\n \"usr/share/zoneinfo/America/Atikokan\",\n \"usr/share/zoneinfo/America/Atka\",\n \"usr/share/zoneinfo/America/Bahia\",\n \"usr/share/zoneinfo/America/Bahia_Banderas\",\n \"usr/share/zoneinfo/America/Barbados\",\n \"usr/share/zoneinfo/America/Belem\",\n \"usr/share/zoneinfo/America/Belize\",\n \"usr/share/zoneinfo/America/Blanc-Sablon\",\n \"usr/share/zoneinfo/America/Boa_Vista\",\n \"usr/share/zoneinfo/America/Bogota\",\n \"usr/share/zoneinfo/America/Boise\",\n \"usr/share/zoneinfo/America/Buenos_Aires\",\n \"usr/share/zoneinfo/America/Cambridge_Bay\",\n \"usr/share/zoneinfo/America/Campo_Grande\",\n \"usr/share/zoneinfo/America/Cancun\",\n \"usr/share/zoneinfo/America/Caracas\",\n \"usr/share/zoneinfo/America/Catamarca\",\n \"usr/share/zoneinfo/America/Cayenne\",\n \"usr/share/zoneinfo/America/Cayman\",\n \"usr/share/zoneinfo/America/Chicago\",\n \"usr/share/zoneinfo/America/Chihuahua\",\n \"usr/share/zoneinfo/America/Ciudad_Juarez\",\n \"usr/share/zoneinfo/America/Coral_Harbour\",\n \"usr/share/zoneinfo/America/Cordoba\",\n \"usr/share/zoneinfo/America/Costa_Rica\",\n \"usr/share/zoneinfo/America/Coyhaique\",\n \"usr/share/zoneinfo/America/Creston\",\n \"usr/share/zoneinfo/America/Cuiaba\",\n \"usr/share/zoneinfo/America/Curacao\",\n \"usr/share/zoneinfo/America/Danmarkshavn\",\n \"usr/share/zoneinfo/America/Dawson\",\n \"usr/share/zoneinfo/America/Dawson_Creek\",\n \"usr/share/zoneinfo/America/Denver\",\n \"usr/share/zoneinfo/America/Detroit\",\n \"usr/share/zoneinfo/America/Dominica\",\n \"usr/share/zoneinfo/America/Edmonton\",\n \"usr/share/zoneinfo/America/Eirunepe\",\n \"usr/share/zoneinfo/America/El_Salvador\",\n \"usr/share/zoneinfo/America/Ensenada\",\n \"usr/share/zoneinfo/America/Fort_Nelson\",\n \"usr/share/zoneinfo/America/Fort_Wayne\",\n \"usr/share/zoneinfo/America/Fortaleza\",\n \"usr/share/zoneinfo/America/Glace_Bay\",\n \"usr/share/zoneinfo/America/Godthab\",\n \"usr/share/zoneinfo/America/Goose_Bay\",\n \"usr/share/zoneinfo/America/Grand_Turk\",\n \"usr/share/zoneinfo/America/Grenada\",\n \"usr/share/zoneinfo/America/Guadeloupe\",\n \"usr/share/zoneinfo/America/Guatemala\",\n \"usr/share/zoneinfo/America/Guayaquil\",\n \"usr/share/zoneinfo/America/Guyana\",\n \"usr/share/zoneinfo/America/Halifax\",\n \"usr/share/zoneinfo/America/Havana\",\n \"usr/share/zoneinfo/America/Hermosillo\",\n \"usr/share/zoneinfo/America/Indianapolis\",\n \"usr/share/zoneinfo/America/Inuvik\",\n \"usr/share/zoneinfo/America/Iqaluit\",\n \"usr/share/zoneinfo/America/Jamaica\",\n \"usr/share/zoneinfo/America/Jujuy\",\n \"usr/share/zoneinfo/America/Juneau\",\n \"usr/share/zoneinfo/America/Knox_IN\",\n \"usr/share/zoneinfo/America/Kralendijk\",\n \"usr/share/zoneinfo/America/La_Paz\",\n \"usr/share/zoneinfo/America/Lima\",\n \"usr/share/zoneinfo/America/Los_Angeles\",\n \"usr/share/zoneinfo/America/Louisville\",\n \"usr/share/zoneinfo/America/Lower_Princes\",\n \"usr/share/zoneinfo/America/Maceio\",\n \"usr/share/zoneinfo/America/Managua\",\n \"usr/share/zoneinfo/America/Manaus\",\n \"usr/share/zoneinfo/America/Marigot\",\n \"usr/share/zoneinfo/America/Martinique\",\n \"usr/share/zoneinfo/America/Matamoros\",\n \"usr/share/zoneinfo/America/Mazatlan\",\n \"usr/share/zoneinfo/America/Mendoza\",\n \"usr/share/zoneinfo/America/Menominee\",\n \"usr/share/zoneinfo/America/Merida\",\n \"usr/share/zoneinfo/America/Metlakatla\",\n \"usr/share/zoneinfo/America/Mexico_City\",\n \"usr/share/zoneinfo/America/Miquelon\",\n \"usr/share/zoneinfo/America/Moncton\",\n \"usr/share/zoneinfo/America/Monterrey\",\n \"usr/share/zoneinfo/America/Montevideo\",\n \"usr/share/zoneinfo/America/Montreal\",\n \"usr/share/zoneinfo/America/Montserrat\",\n \"usr/share/zoneinfo/America/Nassau\",\n \"usr/share/zoneinfo/America/New_York\",\n \"usr/share/zoneinfo/America/Nipigon\",\n \"usr/share/zoneinfo/America/Nome\",\n \"usr/share/zoneinfo/America/Noronha\",\n \"usr/share/zoneinfo/America/Nuuk\",\n \"usr/share/zoneinfo/America/Ojinaga\",\n \"usr/share/zoneinfo/America/Panama\",\n \"usr/share/zoneinfo/America/Pangnirtung\",\n \"usr/share/zoneinfo/America/Paramaribo\",\n \"usr/share/zoneinfo/America/Phoenix\",\n \"usr/share/zoneinfo/America/Port-au-Prince\",\n \"usr/share/zoneinfo/America/Port_of_Spain\",\n \"usr/share/zoneinfo/America/Porto_Acre\",\n \"usr/share/zoneinfo/America/Porto_Velho\",\n \"usr/share/zoneinfo/America/Puerto_Rico\",\n \"usr/share/zoneinfo/America/Punta_Arenas\",\n \"usr/share/zoneinfo/America/Rainy_River\",\n \"usr/share/zoneinfo/America/Rankin_Inlet\",\n \"usr/share/zoneinfo/America/Recife\",\n \"usr/share/zoneinfo/America/Regina\",\n \"usr/share/zoneinfo/America/Resolute\",\n \"usr/share/zoneinfo/America/Rio_Branco\",\n \"usr/share/zoneinfo/America/Rosario\",\n \"usr/share/zoneinfo/America/Santa_Isabel\",\n \"usr/share/zoneinfo/America/Santarem\",\n \"usr/share/zoneinfo/America/Santiago\",\n \"usr/share/zoneinfo/America/Santo_Domingo\",\n \"usr/share/zoneinfo/America/Sao_Paulo\",\n \"usr/share/zoneinfo/America/Scoresbysund\",\n \"usr/share/zoneinfo/America/Shiprock\",\n \"usr/share/zoneinfo/America/Sitka\",\n \"usr/share/zoneinfo/America/St_Barthelemy\",\n \"usr/share/zoneinfo/America/St_Johns\",\n \"usr/share/zoneinfo/America/St_Kitts\",\n \"usr/share/zoneinfo/America/St_Lucia\",\n \"usr/share/zoneinfo/America/St_Thomas\",\n \"usr/share/zoneinfo/America/St_Vincent\",\n \"usr/share/zoneinfo/America/Swift_Current\",\n \"usr/share/zoneinfo/America/Tegucigalpa\",\n \"usr/share/zoneinfo/America/Thule\",\n \"usr/share/zoneinfo/America/Thunder_Bay\",\n \"usr/share/zoneinfo/America/Tijuana\",\n \"usr/share/zoneinfo/America/Toronto\",\n \"usr/share/zoneinfo/America/Tortola\",\n \"usr/share/zoneinfo/America/Vancouver\",\n \"usr/share/zoneinfo/America/Virgin\",\n \"usr/share/zoneinfo/America/Whitehorse\",\n \"usr/share/zoneinfo/America/Winnipeg\",\n \"usr/share/zoneinfo/America/Yakutat\",\n \"usr/share/zoneinfo/America/Yellowknife\",\n \"usr/share/zoneinfo/America/Argentina/Buenos_Aires\",\n \"usr/share/zoneinfo/America/Argentina/Catamarca\",\n \"usr/share/zoneinfo/America/Argentina/ComodRivadavia\",\n \"usr/share/zoneinfo/America/Argentina/Cordoba\",\n \"usr/share/zoneinfo/America/Argentina/Jujuy\",\n \"usr/share/zoneinfo/America/Argentina/La_Rioja\",\n \"usr/share/zoneinfo/America/Argentina/Mendoza\",\n \"usr/share/zoneinfo/America/Argentina/Rio_Gallegos\",\n \"usr/share/zoneinfo/America/Argentina/Salta\",\n \"usr/share/zoneinfo/America/Argentina/San_Juan\",\n \"usr/share/zoneinfo/America/Argentina/San_Luis\",\n \"usr/share/zoneinfo/America/Argentina/Tucuman\",\n \"usr/share/zoneinfo/America/Argentina/Ushuaia\",\n \"usr/share/zoneinfo/America/Indiana/Indianapolis\",\n \"usr/share/zoneinfo/America/Indiana/Knox\",\n \"usr/share/zoneinfo/America/Indiana/Marengo\",\n \"usr/share/zoneinfo/America/Indiana/Petersburg\",\n \"usr/share/zoneinfo/America/Indiana/Tell_City\",\n \"usr/share/zoneinfo/America/Indiana/Vevay\",\n \"usr/share/zoneinfo/America/Indiana/Vincennes\",\n \"usr/share/zoneinfo/America/Indiana/Winamac\",\n \"usr/share/zoneinfo/America/Kentucky/Louisville\",\n \"usr/share/zoneinfo/America/Kentucky/Monticello\",\n \"usr/share/zoneinfo/America/North_Dakota/Beulah\",\n \"usr/share/zoneinfo/America/North_Dakota/Center\",\n \"usr/share/zoneinfo/America/North_Dakota/New_Salem\",\n \"usr/share/zoneinfo/Antarctica/Casey\",\n \"usr/share/zoneinfo/Antarctica/Davis\",\n \"usr/share/zoneinfo/Antarctica/DumontDUrville\",\n \"usr/share/zoneinfo/Antarctica/Macquarie\",\n \"usr/share/zoneinfo/Antarctica/Mawson\",\n \"usr/share/zoneinfo/Antarctica/McMurdo\",\n \"usr/share/zoneinfo/Antarctica/Palmer\",\n \"usr/share/zoneinfo/Antarctica/Rothera\",\n \"usr/share/zoneinfo/Antarctica/South_Pole\",\n \"usr/share/zoneinfo/Antarctica/Syowa\",\n \"usr/share/zoneinfo/Antarctica/Troll\",\n \"usr/share/zoneinfo/Antarctica/Vostok\",\n \"usr/share/zoneinfo/Arctic/Longyearbyen\",\n \"usr/share/zoneinfo/Asia/Aden\",\n \"usr/share/zoneinfo/Asia/Almaty\",\n \"usr/share/zoneinfo/Asia/Amman\",\n \"usr/share/zoneinfo/Asia/Anadyr\",\n \"usr/share/zoneinfo/Asia/Aqtau\",\n \"usr/share/zoneinfo/Asia/Aqtobe\",\n \"usr/share/zoneinfo/Asia/Ashgabat\",\n \"usr/share/zoneinfo/Asia/Ashkhabad\",\n \"usr/share/zoneinfo/Asia/Atyrau\",\n \"usr/share/zoneinfo/Asia/Baghdad\",\n \"usr/share/zoneinfo/Asia/Bahrain\",\n \"usr/share/zoneinfo/Asia/Baku\",\n \"usr/share/zoneinfo/Asia/Bangkok\",\n \"usr/share/zoneinfo/Asia/Barnaul\",\n \"usr/share/zoneinfo/Asia/Beirut\",\n \"usr/share/zoneinfo/Asia/Bishkek\",\n \"usr/share/zoneinfo/Asia/Brunei\",\n \"usr/share/zoneinfo/Asia/Calcutta\",\n \"usr/share/zoneinfo/Asia/Chita\",\n \"usr/share/zoneinfo/Asia/Choibalsan\",\n \"usr/share/zoneinfo/Asia/Chongqing\",\n \"usr/share/zoneinfo/Asia/Chungking\",\n \"usr/share/zoneinfo/Asia/Colombo\",\n \"usr/share/zoneinfo/Asia/Dacca\",\n \"usr/share/zoneinfo/Asia/Damascus\",\n \"usr/share/zoneinfo/Asia/Dhaka\",\n \"usr/share/zoneinfo/Asia/Dili\",\n \"usr/share/zoneinfo/Asia/Dubai\",\n \"usr/share/zoneinfo/Asia/Dushanbe\",\n \"usr/share/zoneinfo/Asia/Famagusta\",\n \"usr/share/zoneinfo/Asia/Gaza\",\n \"usr/share/zoneinfo/Asia/Harbin\",\n \"usr/share/zoneinfo/Asia/Hebron\",\n \"usr/share/zoneinfo/Asia/Ho_Chi_Minh\",\n \"usr/share/zoneinfo/Asia/Hong_Kong\",\n \"usr/share/zoneinfo/Asia/Hovd\",\n \"usr/share/zoneinfo/Asia/Irkutsk\",\n \"usr/share/zoneinfo/Asia/Istanbul\",\n \"usr/share/zoneinfo/Asia/Jakarta\",\n \"usr/share/zoneinfo/Asia/Jayapura\",\n \"usr/share/zoneinfo/Asia/Jerusalem\",\n \"usr/share/zoneinfo/Asia/Kabul\",\n \"usr/share/zoneinfo/Asia/Kamchatka\",\n \"usr/share/zoneinfo/Asia/Karachi\",\n \"usr/share/zoneinfo/Asia/Kashgar\",\n \"usr/share/zoneinfo/Asia/Kathmandu\",\n \"usr/share/zoneinfo/Asia/Katmandu\",\n \"usr/share/zoneinfo/Asia/Khandyga\",\n \"usr/share/zoneinfo/Asia/Kolkata\",\n \"usr/share/zoneinfo/Asia/Krasnoyarsk\",\n \"usr/share/zoneinfo/Asia/Kuala_Lumpur\",\n \"usr/share/zoneinfo/Asia/Kuching\",\n \"usr/share/zoneinfo/Asia/Kuwait\",\n \"usr/share/zoneinfo/Asia/Macao\",\n \"usr/share/zoneinfo/Asia/Macau\",\n \"usr/share/zoneinfo/Asia/Magadan\",\n \"usr/share/zoneinfo/Asia/Makassar\",\n \"usr/share/zoneinfo/Asia/Manila\",\n \"usr/share/zoneinfo/Asia/Muscat\",\n \"usr/share/zoneinfo/Asia/Nicosia\",\n \"usr/share/zoneinfo/Asia/Novokuznetsk\",\n \"usr/share/zoneinfo/Asia/Novosibirsk\",\n \"usr/share/zoneinfo/Asia/Omsk\",\n \"usr/share/zoneinfo/Asia/Oral\",\n \"usr/share/zoneinfo/Asia/Phnom_Penh\",\n \"usr/share/zoneinfo/Asia/Pontianak\",\n \"usr/share/zoneinfo/Asia/Pyongyang\",\n \"usr/share/zoneinfo/Asia/Qatar\",\n \"usr/share/zoneinfo/Asia/Qostanay\",\n \"usr/share/zoneinfo/Asia/Qyzylorda\",\n \"usr/share/zoneinfo/Asia/Rangoon\",\n \"usr/share/zoneinfo/Asia/Riyadh\",\n \"usr/share/zoneinfo/Asia/Saigon\",\n \"usr/share/zoneinfo/Asia/Sakhalin\",\n \"usr/share/zoneinfo/Asia/Samarkand\",\n \"usr/share/zoneinfo/Asia/Seoul\",\n \"usr/share/zoneinfo/Asia/Shanghai\",\n \"usr/share/zoneinfo/Asia/Singapore\",\n \"usr/share/zoneinfo/Asia/Srednekolymsk\",\n \"usr/share/zoneinfo/Asia/Taipei\",\n \"usr/share/zoneinfo/Asia/Tashkent\",\n \"usr/share/zoneinfo/Asia/Tbilisi\",\n \"usr/share/zoneinfo/Asia/Tehran\",\n \"usr/share/zoneinfo/Asia/Tel_Aviv\",\n \"usr/share/zoneinfo/Asia/Thimbu\",\n \"usr/share/zoneinfo/Asia/Thimphu\",\n \"usr/share/zoneinfo/Asia/Tokyo\",\n \"usr/share/zoneinfo/Asia/Tomsk\",\n \"usr/share/zoneinfo/Asia/Ujung_Pandang\",\n \"usr/share/zoneinfo/Asia/Ulaanbaatar\",\n \"usr/share/zoneinfo/Asia/Ulan_Bator\",\n \"usr/share/zoneinfo/Asia/Urumqi\",\n \"usr/share/zoneinfo/Asia/Ust-Nera\",\n \"usr/share/zoneinfo/Asia/Vientiane\",\n \"usr/share/zoneinfo/Asia/Vladivostok\",\n \"usr/share/zoneinfo/Asia/Yakutsk\",\n \"usr/share/zoneinfo/Asia/Yangon\",\n \"usr/share/zoneinfo/Asia/Yekaterinburg\",\n \"usr/share/zoneinfo/Asia/Yerevan\",\n \"usr/share/zoneinfo/Atlantic/Azores\",\n \"usr/share/zoneinfo/Atlantic/Bermuda\",\n \"usr/share/zoneinfo/Atlantic/Canary\",\n \"usr/share/zoneinfo/Atlantic/Cape_Verde\",\n \"usr/share/zoneinfo/Atlantic/Faeroe\",\n \"usr/share/zoneinfo/Atlantic/Faroe\",\n \"usr/share/zoneinfo/Atlantic/Jan_Mayen\",\n \"usr/share/zoneinfo/Atlantic/Madeira\",\n \"usr/share/zoneinfo/Atlantic/Reykjavik\",\n \"usr/share/zoneinfo/Atlantic/South_Georgia\",\n \"usr/share/zoneinfo/Atlantic/St_Helena\",\n \"usr/share/zoneinfo/Atlantic/Stanley\",\n \"usr/share/zoneinfo/Australia/ACT\",\n \"usr/share/zoneinfo/Australia/Adelaide\",\n \"usr/share/zoneinfo/Australia/Brisbane\",\n \"usr/share/zoneinfo/Australia/Broken_Hill\",\n \"usr/share/zoneinfo/Australia/Canberra\",\n \"usr/share/zoneinfo/Australia/Currie\",\n \"usr/share/zoneinfo/Australia/Darwin\",\n \"usr/share/zoneinfo/Australia/Eucla\",\n \"usr/share/zoneinfo/Australia/Hobart\",\n \"usr/share/zoneinfo/Australia/LHI\",\n \"usr/share/zoneinfo/Australia/Lindeman\",\n \"usr/share/zoneinfo/Australia/Lord_Howe\",\n \"usr/share/zoneinfo/Australia/Melbourne\",\n \"usr/share/zoneinfo/Australia/NSW\",\n \"usr/share/zoneinfo/Australia/North\",\n \"usr/share/zoneinfo/Australia/Perth\",\n \"usr/share/zoneinfo/Australia/Queensland\",\n \"usr/share/zoneinfo/Australia/South\",\n \"usr/share/zoneinfo/Australia/Sydney\",\n \"usr/share/zoneinfo/Australia/Tasmania\",\n \"usr/share/zoneinfo/Australia/Victoria\",\n \"usr/share/zoneinfo/Australia/West\",\n \"usr/share/zoneinfo/Australia/Yancowinna\",\n \"usr/share/zoneinfo/Brazil/Acre\",\n \"usr/share/zoneinfo/Brazil/DeNoronha\",\n \"usr/share/zoneinfo/Brazil/East\",\n \"usr/share/zoneinfo/Brazil/West\",\n \"usr/share/zoneinfo/Canada/Atlantic\",\n \"usr/share/zoneinfo/Canada/Central\",\n \"usr/share/zoneinfo/Canada/Eastern\",\n \"usr/share/zoneinfo/Canada/Mountain\",\n \"usr/share/zoneinfo/Canada/Newfoundland\",\n \"usr/share/zoneinfo/Canada/Pacific\",\n \"usr/share/zoneinfo/Canada/Saskatchewan\",\n \"usr/share/zoneinfo/Canada/Yukon\",\n \"usr/share/zoneinfo/Chile/Continental\",\n \"usr/share/zoneinfo/Chile/EasterIsland\",\n \"usr/share/zoneinfo/Etc/GMT\",\n \"usr/share/zoneinfo/Etc/GMT+0\",\n \"usr/share/zoneinfo/Etc/GMT+1\",\n \"usr/share/zoneinfo/Etc/GMT+10\",\n \"usr/share/zoneinfo/Etc/GMT+11\",\n \"usr/share/zoneinfo/Etc/GMT+12\",\n \"usr/share/zoneinfo/Etc/GMT+2\",\n \"usr/share/zoneinfo/Etc/GMT+3\",\n \"usr/share/zoneinfo/Etc/GMT+4\",\n \"usr/share/zoneinfo/Etc/GMT+5\",\n \"usr/share/zoneinfo/Etc/GMT+6\",\n \"usr/share/zoneinfo/Etc/GMT+7\",\n \"usr/share/zoneinfo/Etc/GMT+8\",\n \"usr/share/zoneinfo/Etc/GMT+9\",\n \"usr/share/zoneinfo/Etc/GMT-0\",\n \"usr/share/zoneinfo/Etc/GMT-1\",\n \"usr/share/zoneinfo/Etc/GMT-10\",\n \"usr/share/zoneinfo/Etc/GMT-11\",\n \"usr/share/zoneinfo/Etc/GMT-12\",\n \"usr/share/zoneinfo/Etc/GMT-13\",\n \"usr/share/zoneinfo/Etc/GMT-14\",\n \"usr/share/zoneinfo/Etc/GMT-2\",\n \"usr/share/zoneinfo/Etc/GMT-3\",\n \"usr/share/zoneinfo/Etc/GMT-4\",\n \"usr/share/zoneinfo/Etc/GMT-5\",\n \"usr/share/zoneinfo/Etc/GMT-6\",\n \"usr/share/zoneinfo/Etc/GMT-7\",\n \"usr/share/zoneinfo/Etc/GMT-8\",\n \"usr/share/zoneinfo/Etc/GMT-9\",\n \"usr/share/zoneinfo/Etc/GMT0\",\n \"usr/share/zoneinfo/Etc/Greenwich\",\n \"usr/share/zoneinfo/Etc/UCT\",\n \"usr/share/zoneinfo/Etc/UTC\",\n \"usr/share/zoneinfo/Etc/Universal\",\n \"usr/share/zoneinfo/Etc/Zulu\",\n \"usr/share/zoneinfo/Europe/Amsterdam\",\n \"usr/share/zoneinfo/Europe/Andorra\",\n \"usr/share/zoneinfo/Europe/Astrakhan\",\n \"usr/share/zoneinfo/Europe/Athens\",\n \"usr/share/zoneinfo/Europe/Belfast\",\n \"usr/share/zoneinfo/Europe/Belgrade\",\n \"usr/share/zoneinfo/Europe/Berlin\",\n \"usr/share/zoneinfo/Europe/Bratislava\",\n \"usr/share/zoneinfo/Europe/Brussels\",\n \"usr/share/zoneinfo/Europe/Bucharest\",\n \"usr/share/zoneinfo/Europe/Budapest\",\n \"usr/share/zoneinfo/Europe/Busingen\",\n \"usr/share/zoneinfo/Europe/Chisinau\",\n \"usr/share/zoneinfo/Europe/Copenhagen\",\n \"usr/share/zoneinfo/Europe/Dublin\",\n \"usr/share/zoneinfo/Europe/Gibraltar\",\n \"usr/share/zoneinfo/Europe/Guernsey\",\n \"usr/share/zoneinfo/Europe/Helsinki\",\n \"usr/share/zoneinfo/Europe/Isle_of_Man\",\n \"usr/share/zoneinfo/Europe/Istanbul\",\n \"usr/share/zoneinfo/Europe/Jersey\",\n \"usr/share/zoneinfo/Europe/Kaliningrad\",\n \"usr/share/zoneinfo/Europe/Kiev\",\n \"usr/share/zoneinfo/Europe/Kirov\",\n \"usr/share/zoneinfo/Europe/Kyiv\",\n \"usr/share/zoneinfo/Europe/Lisbon\",\n \"usr/share/zoneinfo/Europe/Ljubljana\",\n \"usr/share/zoneinfo/Europe/London\",\n \"usr/share/zoneinfo/Europe/Luxembourg\",\n \"usr/share/zoneinfo/Europe/Madrid\",\n \"usr/share/zoneinfo/Europe/Malta\",\n \"usr/share/zoneinfo/Europe/Mariehamn\",\n \"usr/share/zoneinfo/Europe/Minsk\",\n \"usr/share/zoneinfo/Europe/Monaco\",\n \"usr/share/zoneinfo/Europe/Moscow\",\n \"usr/share/zoneinfo/Europe/Nicosia\",\n \"usr/share/zoneinfo/Europe/Oslo\",\n \"usr/share/zoneinfo/Europe/Paris\",\n \"usr/share/zoneinfo/Europe/Podgorica\",\n \"usr/share/zoneinfo/Europe/Prague\",\n \"usr/share/zoneinfo/Europe/Riga\",\n \"usr/share/zoneinfo/Europe/Rome\",\n \"usr/share/zoneinfo/Europe/Samara\",\n \"usr/share/zoneinfo/Europe/San_Marino\",\n \"usr/share/zoneinfo/Europe/Sarajevo\",\n \"usr/share/zoneinfo/Europe/Saratov\",\n \"usr/share/zoneinfo/Europe/Simferopol\",\n \"usr/share/zoneinfo/Europe/Skopje\",\n \"usr/share/zoneinfo/Europe/Sofia\",\n \"usr/share/zoneinfo/Europe/Stockholm\",\n \"usr/share/zoneinfo/Europe/Tallinn\",\n \"usr/share/zoneinfo/Europe/Tirane\",\n \"usr/share/zoneinfo/Europe/Tiraspol\",\n \"usr/share/zoneinfo/Europe/Ulyanovsk\",\n \"usr/share/zoneinfo/Europe/Uzhgorod\",\n \"usr/share/zoneinfo/Europe/Vaduz\",\n \"usr/share/zoneinfo/Europe/Vatican\",\n \"usr/share/zoneinfo/Europe/Vienna\",\n \"usr/share/zoneinfo/Europe/Vilnius\",\n \"usr/share/zoneinfo/Europe/Volgograd\",\n \"usr/share/zoneinfo/Europe/Warsaw\",\n \"usr/share/zoneinfo/Europe/Zagreb\",\n \"usr/share/zoneinfo/Europe/Zaporozhye\",\n \"usr/share/zoneinfo/Europe/Zurich\",\n \"usr/share/zoneinfo/Indian/Antananarivo\",\n \"usr/share/zoneinfo/Indian/Chagos\",\n \"usr/share/zoneinfo/Indian/Christmas\",\n \"usr/share/zoneinfo/Indian/Cocos\",\n \"usr/share/zoneinfo/Indian/Comoro\",\n \"usr/share/zoneinfo/Indian/Kerguelen\",\n \"usr/share/zoneinfo/Indian/Mahe\",\n \"usr/share/zoneinfo/Indian/Maldives\",\n \"usr/share/zoneinfo/Indian/Mauritius\",\n \"usr/share/zoneinfo/Indian/Mayotte\",\n \"usr/share/zoneinfo/Indian/Reunion\",\n \"usr/share/zoneinfo/Mexico/BajaNorte\",\n \"usr/share/zoneinfo/Mexico/BajaSur\",\n \"usr/share/zoneinfo/Mexico/General\",\n \"usr/share/zoneinfo/Pacific/Apia\",\n \"usr/share/zoneinfo/Pacific/Auckland\",\n \"usr/share/zoneinfo/Pacific/Bougainville\",\n \"usr/share/zoneinfo/Pacific/Chatham\",\n \"usr/share/zoneinfo/Pacific/Chuuk\",\n \"usr/share/zoneinfo/Pacific/Easter\",\n \"usr/share/zoneinfo/Pacific/Efate\",\n \"usr/share/zoneinfo/Pacific/Enderbury\",\n \"usr/share/zoneinfo/Pacific/Fakaofo\",\n \"usr/share/zoneinfo/Pacific/Fiji\",\n \"usr/share/zoneinfo/Pacific/Funafuti\",\n \"usr/share/zoneinfo/Pacific/Galapagos\",\n \"usr/share/zoneinfo/Pacific/Gambier\",\n \"usr/share/zoneinfo/Pacific/Guadalcanal\",\n \"usr/share/zoneinfo/Pacific/Guam\",\n \"usr/share/zoneinfo/Pacific/Honolulu\",\n \"usr/share/zoneinfo/Pacific/Johnston\",\n \"usr/share/zoneinfo/Pacific/Kanton\",\n \"usr/share/zoneinfo/Pacific/Kiritimati\",\n \"usr/share/zoneinfo/Pacific/Kosrae\",\n \"usr/share/zoneinfo/Pacific/Kwajalein\",\n \"usr/share/zoneinfo/Pacific/Majuro\",\n \"usr/share/zoneinfo/Pacific/Marquesas\",\n \"usr/share/zoneinfo/Pacific/Midway\",\n \"usr/share/zoneinfo/Pacific/Nauru\",\n \"usr/share/zoneinfo/Pacific/Niue\",\n \"usr/share/zoneinfo/Pacific/Norfolk\",\n \"usr/share/zoneinfo/Pacific/Noumea\",\n \"usr/share/zoneinfo/Pacific/Pago_Pago\",\n \"usr/share/zoneinfo/Pacific/Palau\",\n \"usr/share/zoneinfo/Pacific/Pitcairn\",\n \"usr/share/zoneinfo/Pacific/Pohnpei\",\n \"usr/share/zoneinfo/Pacific/Ponape\",\n \"usr/share/zoneinfo/Pacific/Port_Moresby\",\n \"usr/share/zoneinfo/Pacific/Rarotonga\",\n \"usr/share/zoneinfo/Pacific/Saipan\",\n \"usr/share/zoneinfo/Pacific/Samoa\",\n \"usr/share/zoneinfo/Pacific/Tahiti\",\n \"usr/share/zoneinfo/Pacific/Tarawa\",\n \"usr/share/zoneinfo/Pacific/Tongatapu\",\n \"usr/share/zoneinfo/Pacific/Truk\",\n \"usr/share/zoneinfo/Pacific/Wake\",\n \"usr/share/zoneinfo/Pacific/Wallis\",\n \"usr/share/zoneinfo/Pacific/Yap\",\n \"usr/share/zoneinfo/US/Alaska\",\n \"usr/share/zoneinfo/US/Aleutian\",\n \"usr/share/zoneinfo/US/Arizona\",\n \"usr/share/zoneinfo/US/Central\",\n \"usr/share/zoneinfo/US/East-Indiana\",\n \"usr/share/zoneinfo/US/Eastern\",\n \"usr/share/zoneinfo/US/Hawaii\",\n \"usr/share/zoneinfo/US/Indiana-Starke\",\n \"usr/share/zoneinfo/US/Michigan\",\n \"usr/share/zoneinfo/US/Mountain\",\n \"usr/share/zoneinfo/US/Pacific\",\n \"usr/share/zoneinfo/US/Samoa\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"xz-libs@5.8.3-r0\",\n \"Name\": \"xz-libs\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"1ae658a5f132a091\"\n },\n \"Version\": \"5.8.3-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"xz\",\n \"SrcVersion\": \"5.8.3-r0\",\n \"Licenses\": [\n \"GPL-2.0-or-later\",\n \"0BSD\",\n \"Public-Domain\",\n \"LGPL-2.1-or-later\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:2014fd3d47b2c2dd4dedc765822ac60ae269f3efa0e614f46ae29f540c7f1235\",\n \"DiffID\": \"sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366\"\n },\n \"Digest\": \"sha1:4c92c5be0c5bef404e93c880eba9037a9b147347\",\n \"InstalledFiles\": [\n \"usr/lib/liblzma.so.5\",\n \"usr/lib/liblzma.so.5.8.3\"\n ],\n \"AnalyzedBy\": \"apk\"\n },\n {\n \"ID\": \"zlib@1.3.2-r0\",\n \"Name\": \"zlib\",\n \"Identifier\": {\n \"PURL\": \"pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"e37054a2982d6c16\"\n },\n \"Version\": \"1.3.2-r0\",\n \"Arch\": \"x86_64\",\n \"SrcName\": \"zlib\",\n \"SrcVersion\": \"1.3.2-r0\",\n \"Licenses\": [\n \"Zlib\"\n ],\n \"Maintainer\": \"Natanael Copa \\u003cncopa@alpinelinux.org\\u003e\",\n \"DependsOn\": [\n \"musl@1.2.6-r2\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"Digest\": \"sha1:dd4c3d102acaef2a71a1495951d55fabc8680613\",\n \"InstalledFiles\": [\n \"usr/lib/libz.so.1\",\n \"usr/lib/libz.so.1.3.2\"\n ],\n \"AnalyzedBy\": \"apk\"\n }\n ],\n \"Vulnerabilities\": [\n {\n \"VulnerabilityID\": \"CVE-2026-85091\",\n \"PkgID\": \"zlib@1.3.2-r0\",\n \"PkgName\": \"zlib\",\n \"PkgIdentifier\": {\n \"PURL\": \"pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\\u0026distro=3.24.1\",\n \"UID\": \"e37054a2982d6c16\"\n },\n \"InstalledVersion\": \"1.3.2-r0\",\n \"FixedVersion\": \"1.3.2-r1\",\n \"Status\": \"fixed\",\n \"Layer\": {\n \"Digest\": \"sha256:55afa1ecc21d2bb5e5045f32dafee56272ffd89860bac26f6c32123439af26a4\",\n \"DiffID\": \"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c\"\n },\n \"PrimaryURL\": \"https://avd.aquasec.com/nvd/cve-2026-85091\",\n \"DataSource\": {\n \"ID\": \"alpine\",\n \"Name\": \"Alpine Secdb\",\n \"URL\": \"https://secdb.alpinelinux.org/\"\n },\n \"Fingerprint\": \"sha256:d73c01b020c55acc174a3fde47c8af6f5638c58c7189c817edd6862029f6c5f5\",\n \"Title\": \"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...\",\n \"Description\": \"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\",\n \"Severity\": \"MEDIUM\",\n \"CweIDs\": [\n \"CWE-787\"\n ],\n \"VendorSeverity\": {\n \"ubuntu\": 2\n },\n \"References\": [\n \"https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490\",\n \"https://github.com/madler/zlib\",\n \"https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393\",\n \"https://www.cve.org/CVERecord?id=CVE-2026-85091\",\n \"https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate\"\n ],\n \"PublishedDate\": \"2026-09-03T13:06:20.573Z\",\n \"LastModifiedDate\": \"2026-09-09T20:41:07.123Z\"\n }\n ]\n },\n {\n \"Target\": \"Python\",\n \"Class\": \"lang-pkgs\",\n \"Type\": \"python-pkg\",\n \"Packages\": [\n {\n \"Name\": \"PyJWT\",\n \"Identifier\": {\n \"PURL\": \"pkg:pypi/pyjwt@2.15.1\",\n \"UID\": \"d3f5f9a421b8abc9\"\n },\n \"Version\": \"2.15.1\",\n \"Licenses\": [\n \"MIT\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87\",\n \"DiffID\": \"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c\"\n },\n \"FilePath\": \"opt/venv/lib/python3.12/site-packages/pyjwt-2.15.1.dist-info/METADATA\",\n \"AnalyzedBy\": \"python-pkg\"\n },\n {\n \"Name\": \"cffi\",\n \"Identifier\": {\n \"PURL\": \"pkg:pypi/cffi@2.1.1\",\n \"UID\": \"21042e2f37e33c05\"\n },\n \"Version\": \"2.1.1\",\n \"Licenses\": [\n \"MIT-0\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87\",\n \"DiffID\": \"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c\"\n },\n \"FilePath\": \"opt/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATA\",\n \"AnalyzedBy\": \"python-pkg\"\n },\n {\n \"Name\": \"cryptography\",\n \"Identifier\": {\n \"PURL\": \"pkg:pypi/cryptography@50.0.1\",\n \"UID\": \"dcb3df6383fe2a60\"\n },\n \"Version\": \"50.0.1\",\n \"Licenses\": [\n \"Apache-2.0 OR BSD-3-Clause\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87\",\n \"DiffID\": \"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c\"\n },\n \"FilePath\": \"opt/venv/lib/python3.12/site-packages/cryptography-50.0.1.dist-info/METADATA\",\n \"AnalyzedBy\": \"python-pkg\"\n },\n {\n \"Name\": \"informed-decision\",\n \"Identifier\": {\n \"PURL\": \"pkg:pypi/informed-decision@0.2.0\",\n \"UID\": \"7989f2afae8ff568\"\n },\n \"Version\": \"0.2.0\",\n \"Layer\": {\n \"Digest\": \"sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87\",\n \"DiffID\": \"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c\"\n },\n \"FilePath\": \"opt/venv/lib/python3.12/site-packages/informed_decision-0.2.0.dist-info/METADATA\",\n \"AnalyzedBy\": \"python-pkg\"\n },\n {\n \"Name\": \"pycparser\",\n \"Identifier\": {\n \"PURL\": \"pkg:pypi/pycparser@3.0\",\n \"UID\": \"e5a4d03f15a695ff\"\n },\n \"Version\": \"3.0\",\n \"Licenses\": [\n \"BSD-3-Clause\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87\",\n \"DiffID\": \"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c\"\n },\n \"FilePath\": \"opt/venv/lib/python3.12/site-packages/pycparser-3.0.dist-info/METADATA\",\n \"AnalyzedBy\": \"python-pkg\"\n },\n {\n \"Name\": \"waitress\",\n \"Identifier\": {\n \"PURL\": \"pkg:pypi/waitress@3.0.2\",\n \"UID\": \"806e218e1c1e85f\"\n },\n \"Version\": \"3.0.2\",\n \"Licenses\": [\n \"ZPL-2.1\"\n ],\n \"Layer\": {\n \"Digest\": \"sha256:82ff17b555d91096dd328eb1e829daaeba9a48d7757143d0b97c35a721f6fb87\",\n \"DiffID\": \"sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c\"\n },\n \"FilePath\": \"opt/venv/lib/python3.12/site-packages/waitress-3.0.2.dist-info/METADATA\",\n \"AnalyzedBy\": \"python-pkg\"\n }\n ]\n }\n ]\n}\n"
},
{
"item_id": "sqlite-readonly-py",
"media_type": "text/plain",
"content": "\"\"\"Pre-open schema/integrity/count proof; stdlib only, never constructs Store.\"\"\"\nimport argparse\nimport json\nfrom pathlib import Path\nimport sqlite3\n\n\ndef inspect_readonly(path):\n path = Path(path)\n if not path.is_file() or path.is_symlink():\n raise ValueError('existing nonsymlink private database required')\n with sqlite3.connect(path.resolve().as_uri() + '?mode=ro', uri=True, timeout=5) as db:\n db.execute('PRAGMA query_only=ON')\n db.execute('BEGIN')\n version = db.execute('PRAGMA user_version').fetchone()[0]\n if version != 5:\n raise ValueError('pre-open database is not schema5; refuse migration')\n if db.execute('PRAGMA integrity_check').fetchall() != [('ok',)]:\n raise ValueError('read-only integrity check refused')\n lifecycle = {name: db.execute('SELECT COUNT(*) FROM ' + table).fetchone()[0]\n for name, table in (('records', 'lifecycle_records'),\n ('events', 'lifecycle_events'),\n ('pending', 'lifecycle_pending'))}\n result = {'schema_version': version, 'lifecycle': lifecycle,\n 'outbox': dict(db.execute('SELECT state,COUNT(*) FROM outbox GROUP BY state')),\n 'submissions': dict(db.execute('SELECT state,COUNT(*) FROM submissions GROUP BY state')),\n 'integrity': 'ok', 'read_only_pre_open': True, 'store_constructed': False}\n db.rollback()\n return result\n\n\nif __name__ == '__main__':\n parser = argparse.ArgumentParser(description=__doc__)\n parser.add_argument('--db', type=Path, required=True)\n args = parser.parse_args()\n try:\n print(json.dumps(inspect_readonly(args.db), sort_keys=True))\n except Exception:\n raise SystemExit('read-only schema5/integrity/count gate refused; no Store/admin open') from None\n"
},
{
"item_id": "sealed-native-dependencies-json",
"media_type": "application/json",
"content": "{\n \"configmap\": {\n \"apiVersion\": \"v1\",\n \"immutable\": true,\n \"kind\": \"ConfigMap\",\n \"metadata\": {\n \"annotations\": {\n \"argocd.argoproj.io/tracking-id\": \"informed-decision:/ConfigMap:informed-decision/informed-decision-runtime-6c221878d051\",\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\"\n },\n \"name\": \"informed-decision-runtime-6c221878d051\",\n \"namespace\": \"informed-decision\",\n \"uid\": \"90113d2d-54d9-4e82-b1d3-90b49ebed2b5\"\n },\n \"canonical_data_sha256\": \"8ec462d12347548f506eeebf1e3c7cc47648019c8a783804d09bcc79b0f22af6\"\n },\n \"pvc\": {\n \"apiVersion\": \"v1\",\n \"kind\": \"PersistentVolumeClaim\",\n \"metadata\": {\n \"annotations\": {\n \"argocd.argoproj.io/tracking-id\": \"informed-decision:/PersistentVolumeClaim:informed-decision/informed-decision-data\",\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\",\n \"pv.kubernetes.io/bind-completed\": \"yes\",\n \"pv.kubernetes.io/bound-by-controller\": \"yes\",\n \"volume.beta.kubernetes.io/storage-provisioner\": \"rancher.io/local-path\",\n \"volume.kubernetes.io/selected-node\": \"239.62.205.92.host.secureserver.net\",\n \"volume.kubernetes.io/storage-provisioner\": \"rancher.io/local-path\"\n },\n \"finalizers\": [\n \"kubernetes.io/pvc-protection\"\n ],\n \"name\": \"informed-decision-data\",\n \"namespace\": \"informed-decision\",\n \"uid\": \"d80b25b1-141a-441b-b205-98fa2fd98b7c\"\n },\n \"spec\": {\n \"accessModes\": [\n \"ReadWriteOnce\"\n ],\n \"resources\": {\n \"requests\": {\n \"storage\": \"1Gi\"\n }\n },\n \"storageClassName\": \"local-path\",\n \"volumeMode\": \"Filesystem\",\n \"volumeName\": \"pvc-d80b25b1-141a-441b-b205-98fa2fd98b7c\"\n }\n },\n \"pvc_phase\": \"Bound\"\n}\n"
},
{
"item_id": "native-backup-restore-protocol-md",
"media_type": "text/markdown",
"content": "# Protected native backup/restore and image-only release protocol\n\nPrepared protocol for `INFD-WP-0009-T04/purpose-overlay-v1`. No actual native backup, data export, restore, workload change or approval is recorded here. Candidate registry image identity remains a prerequisite; only after actual artifact proof may the founder approve one exact conditional protocol/rollout packet. The config-only7db8485 approval is outside this scope.\n\n## Preconditions and protected custody\n\nFreeze exact candidate and prior7f5c6cb image digests, source/installed policy hashes, current manually managed Argo Application/revision, runtime ConfigMap6c221878d051, Deployment UID/template/spec, schema5, policy package pins, database path `/data/private/review.sqlite`, PVC binding, replicas1/Recreate and stable keys for intended verification. Confirm no concurrent writer or custody change. Use fixed metadata; never fetch Secret objects or token values. A changed image/config/schema/owner invalidates the packet. Fresh resources/headroom and exact source/native server-dry-run/diff remain required.\n\nBackups are private evidence containing real decision records, not logs or packet attachments. Allocate a unique backup directory under existing protected PVC custody, owned10001, mode0700, snapshot file0600, no symlink/hardlink/reused output path. An off-cluster copy belongs only in the already established ignored `.private-backups/<unique-trial-directory>` custody with0700/0600 permissions; no Git, StateHub, public object store or terminal-content dump. Record only schema, integrity pass/fail, bounded table/state counts and protected receipt identifier; retain byte digests in protected custody if needed for internal copy identity. No credential, record payload or token fingerprint enters public evidence.\n\n## Approved online compatibility drill\n\nWithin the explicit founder-approved action, run the existing base image's `informed-decision-admin backup --db /data/private/review.sqlite --output <new-private-snapshot>` in the actual serving workload. This uses SQLite's backup API for a transactionally consistent snapshot; copying a live main database while ignoring WAL is prohibited. Suppress raw failures/output and retain only sanitized status. Observe schema/integrity and count-only metadata from the resulting snapshot, not record content.\n\nTransfer that consistent snapshot only into protected off-cluster custody through the existing authorized operator lane. The copy is real production data even in build mode. Verify private permissions, unique identity and protected internal digest agreement. Do not export mounted workload credentials or directory trees; copy only the exact snapshot.\n\nCreate a separate private disposable restore volume/directory; retain the original snapshot unchanged. Run the exact published candidate with network disabled, no production ConfigMap/token mounts, read-only image and only that isolated volume writable. Override the service entrypoint with the owner's count-only administrative inspection/integrity check; do not start HTTP listeners, audit delivery, requester exchanges or approval operations. The current candidate changes policy.py only and retains the schema/store module bytes; still prove schema5, SQLite integrity and exact bounded counts before/after opening the restored copy. Refuse any migration/downgrade, lost/changed counts, unexpected write class or unknown outcome. Keep pending/uncertain submission and outbox states; never replay, discard or mark them delivered to green the drill. Cleanup only the disposable copy/volume after verified receipt; retain the original protected backup for the approved recovery interval.\n\nThis step is actual native-data compatibility evidence once performed. Its previous synthetic fixture checks remain mechanism evidence and cannot be renamed native success. A failed drill stops rollout and remains a failed/unverified outcome in the same trial.\n\n## Fresh cutover snapshot and single-writer rollout\n\nAfter successful actual-data compatibility checks, create another unique SQLite-consistent online snapshot immediately before the image cutover, retaining its point-in-time schema/integrity/count receipt. This is an online transactional snapshot, not a claim that dispatchers or human writes were quiesced. Every later committed record remains in the live database; same-schema rollback retains that database and never restores the earlier snapshot over it. The narrow image-only update does not need dispatcher/configuration/PVC/temporary-pod changes or a schema cutover. If fresh verification shows a migration or any data-restoration requirement, stop and refine the proposal rather than applying this protocol.\n\nThe existing Recreate rollout drains/stops the single old writer before starting the new image on the same PVC; the inherited single-writer lock independently refuses concurrent serving processes. Do not add an admin pod, scale-to-zero, dispatcher stop, network-policy rewrite or snapshot overwrite as an improvised image-only step. The existing owner admin backup operation runs inside the admitted serving workload, and its separate protected restore drill runs off-cluster with network disabled and no workload credentials. Those exact custody operations must be enumerated in the founder packet alongside the one Deployment image change.\n\nOnce backup/compatibility/preflight gates pass, manually pin the existing Argo Application to the exact reviewed source revision and sync only Deployment/informed-decision with prune false, keeping the current immutable runtime ConfigMap and all other resources. The source patch changes only the image in admission/rendered Deployment; no Secret, PVC, policy, database or dispatcher change is included unless separately enumerated in the final proposal. Observe five-minute readiness and exact image/config/schema/pins. Verify native lifecycle binding using stable keys and an isolated installed-client probe based on a real provider response contaminated with advisory purpose; prove refusal before any write. Do not contaminate the live PDP, create human approvals, read credentials through CLI, or replay unknown external outcomes for testing.\n\n## Same-schema rollback and evidence retention\n\nOn startup/readiness/binding/refusal failure, retain current database, cutover backup and every post-cutover evidence/uncertain outcome. Restore only the prior7f5c6cb image through the same manual Argo owner path, retaining schema5 and current DB/configuration; never restore an old snapshot over current live evidence just to roll the image back. Verify old image/Ready1, same schema/counts and prior behavior, and reconcile any external effects using existing lifecycle/audit ownership. The narrow overlay's identical store/schema/dependency bytes permit this image-only rollback; it is not permission for a schema downgrade or data loss.\n\nRecord original/approved/executed source and image revisions, backup/drill/cutover/rollout timestamps, exact disposition and sanitized outcomes in the existing supervised trial receipt. EUR0 incremental infrastructure estimate uses existing service/storage/operator lane; protected temporary copy/storage consumption and15\u201330minute recovery time remain operational costs. No EUR incident-loss cap or autonomy grant is inferred. TaskT04 cannot close until actual published image, approved native compatibility and release plus post-release refusal/binding evidence all exist.\n\n## Exact release case identifiers\n\nProposal `INFD-WP-0009-T04/purpose-overlay-v1`, trial `infd-purpose-20261011-r1`.\nProtected native parent `/data/private/purpose-overlay-r1` must be unique/non-symlink, owned10001 and0700. The drill snapshot is `drill.sqlite`, the refreshed pre-cutover snapshot `cutover.sqlite`, each new0600 file; refuse any existing output. Off-cluster custody is the existing ignored Custodian `.private-backups/20261011-infd-purpose-r1` parent0700, files0600; no snapshot is an evidence attachment. Check owner UID, no symlinks, ignored status and free capacity for both native snapshots plus independently protected copies before making any snapshot.\n\nThe disposable offline restore volume is `infd-purpose-r1-restore-20261011`; refuse an existing volume, copy only the selected frozen snapshot, and run exact published candidate763c with networknone/read-only image,128MiB/core1 and no runtime config/token mounts. SQLite `PRAGMA integrity_check` must return `ok`, `PRAGMA user_version`/Store inspection must agree with actual schema5 semantics, and installed admin count-only inspection must match the frozen snapshot. Validate the actual schema representation rather than assume PRAGMA user_version is the schema authority. No synthetic restoration is reported as native restoration. Native original/off-cluster copies remain retained; only the disposable restore copy/volume may be removed under the exact approved cleanup scope.\n\n## Mandatory pre-open schema gate and offline command\n\n`informed-decision-admin inspect` and `backup` construct Store, which can migrate schemas1\u20134 to5. Therefore **before any Store/admin open**, run the exact attached stdlib-only `sqlite_readonly.py` against the native source database using SQLite URI mode=ro, query_only and one read transaction. Require PRAGMA user_version5, integrity_check=ok and retain count-only baseline. Refuse any other/unknown schema or incomplete integrity/count check before constructing Store; do not infer no migration from a post-open admin report. This native gate has not been executed in this source-preparation stage. Repeat before each native backup/admin operation.\n\nAfter copying the selected consistent snapshot to the isolated restored private path `/restore/review.sqlite`, run the same read-only checker **before** any offline candidate admin/Store opens that copy. Frozen snapshot and restored-copy schema/integrity/count reports must agree exactly; the copied main-file digest must match the selected closed snapshot. Reject oldschema fixtures rather than allow migration. Only after this pre-open gate may the offline candidate admin inspect run.\n\nOffline command vectors use exactimage `forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a`, `--network none --read-only --cpus 1 --memory 128m`, private restored volume mounted at `/restore`, and **no runtime config/credential/token mounts**. First override entrypoint to `python`, arguments `- --db /restore/review.sqlite`, streaming only the verified attached checker on stdin. Then override entrypoint to **`informed-decision-admin`**, arguments **`inspect --db /restore/review.sqlite`**. This does not start `informed-decision-container`, the HTTP service, dispatcher or delivery workers. Compare the admin's schema/lifecycle/outbox/submission counters to the frozen pre-open snapshot report; integrity and migration-free pre-open proof come from the stdlib checker, not admin output alone.\n\nLive reads and online snapshots may legitimately differ because reviews, intake and delivery can commit concurrently. Exact counter equality is required between the frozen selected snapshot and its offline restored clone; it is **not** required between a running post-cutover/rollback database and an earlier snapshot. Live count changes must be accounted for as legitimate committed records/state transitions; preserve all current and uncertain entries. Do not discard new commits or restore the old snapshot to force equality. Same-schema image rollback keeps the current live DB, followed by read-only schema5/integrity and count-only health checks; any unexplained evidence loss or required data recovery stops and requires a separate founder decision.\n\nThe fresh preflight also independently reads the actual immutable nonsecret ConfigMap and bound PVC: compares sealed UIDs/fullmetadata/PVCspec+volumeName and canonical runtime data checksum, returning no raw runtime data. Same-name deletion/recreation or content/custody drift stops before admission. Secret values remain excluded. Both local and remote optimized Python interpreters are explicitly refused before assertion-based gates.\n"
},
{
"item_id": "inherited-vulnerability-follow-through-json",
"media_type": "application/json",
"content": "{\n \"id\": \"INFD-RISK-20261011-ZLIB-85091\",\n \"kind\": \"owner-vulnerability-follow-through\",\n \"owner\": \"informed-decision\",\n \"task\": \"INFD-WP-0009-T05\",\n \"status\": \"open\",\n \"created\": \"2026-10-11\",\n \"review_due\": \"2026-10-18\",\n \"finding\": \"CVE-2026-85091\",\n \"scanner_severity\": \"MEDIUM\",\n \"estate_risk_grade\": null,\n \"affected_package\": \"zlib\",\n \"installed\": \"1.3.2-r0\",\n \"fixed\": \"1.3.2-r1\",\n \"actual_current_base_and_candidate_findings_identical\": true,\n \"source_evidence\": \"security-summary.json, trivy-full.json, base-trivy-full.json\",\n \"human_temporary_disposition\": \"pending\",\n \"follow_through\": \"Prepare a separately source-bound official-base/dependency refresh through normal owner CI, verify full scan and runtime compatibility, obtain distinct native release approval before updating this workload\",\n \"manual_review_expiry\": \"Due date requires owner review/escalation if unresolved; no automatic rollback/controller is installed\",\n \"close_condition\": \"Verified installed native fixed package and full unfiltered rescan; preserve original detection and any human disposition\"\n}\n"
},
{
"item_id": "native-preflight-json",
"media_type": "application/json",
"content": "{\n \"captured_at\": \"2026-10-11T01:25:38.793555+00:00\",\n \"native_workload_changed\": false,\n \"native_backup_restore_executed\": false,\n \"argo\": {\n \"uid\": \"499868f2-eabc-4df4-ae31-b89ce58d750d\",\n \"repoURL\": \"https://forgejo.coulomb.social/coulomb/informed-decision.git\",\n \"targetRevision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\",\n \"path\": \"deploy/lifecycle\",\n \"destination\": {\n \"namespace\": \"informed-decision\",\n \"server\": \"https://kubernetes.default.svc\"\n },\n \"automated\": false,\n \"sync\": {\n \"comparedTo\": {\n \"destination\": {\n \"namespace\": \"informed-decision\",\n \"server\": \"https://kubernetes.default.svc\"\n },\n \"source\": {\n \"path\": \"deploy/lifecycle\",\n \"repoURL\": \"https://forgejo.coulomb.social/coulomb/informed-decision.git\",\n \"targetRevision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\"\n }\n },\n \"revision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\",\n \"status\": \"OutOfSync\"\n },\n \"health\": {\n \"lastTransitionTime\": \"2026-10-10T23:14:52Z\",\n \"status\": \"Healthy\"\n }\n },\n \"live_ready_replicas\": 1,\n \"admitted_uid\": \"a588e10a-90d2-4883-975e-6dd8b8feca92\",\n \"server_dry_run_passed\": true,\n \"admitted_spec_exactly_live_plus_image\": true,\n \"client_diff_exit\": 1,\n \"client_diff_sha256\": \"a4bc024a8cec658f835285ed51964e2e084edbaf103d45a48b89c0950bcd3e7d\",\n \"node_allocated_resources\": \"(Total limits may be over 100 percent, i.e., overcommitted.)\\n Resource Requests Limits\\n -------- -------- ------\\n cpu 3460m (86%) 36200m (905%)\\n memory 9472Mi (59%) 32898Mi (205%)\\n ephemeral-storage 0 (0%) 0 (0%)\\n hugepages-1Gi 0 (0%) 0 (0%)\\n hugepages-2Mi 0 (0%) 0 (0%)\",\n \"all_checks_pass\": true\n}\n"
},
{
"item_id": "sealed-live-deployment-json",
"media_type": "application/json",
"content": "{\n \"apiVersion\": \"apps/v1\",\n \"kind\": \"Deployment\",\n \"metadata\": {\n \"annotations\": {\n \"argocd.argoproj.io/tracking-id\": \"informed-decision:apps/Deployment:informed-decision/informed-decision\",\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\"\n },\n \"name\": \"informed-decision\",\n \"namespace\": \"informed-decision\",\n \"uid\": \"a588e10a-90d2-4883-975e-6dd8b8feca92\"\n },\n \"spec\": {\n \"progressDeadlineSeconds\": 600,\n \"replicas\": 1,\n \"revisionHistoryLimit\": 10,\n \"selector\": {\n \"matchLabels\": {\n \"app.kubernetes.io/name\": \"informed-decision\"\n }\n },\n \"strategy\": {\n \"type\": \"Recreate\"\n },\n \"template\": {\n \"metadata\": {\n \"annotations\": {\n \"informed-decision.coulomb.social/admission\": \"approved; INFD-WP-0007 cutover\"\n },\n \"labels\": {\n \"app.kubernetes.io/component\": \"review\",\n \"app.kubernetes.io/name\": \"informed-decision\"\n }\n },\n \"spec\": {\n \"automountServiceAccountToken\": false,\n \"containers\": [\n {\n \"env\": [\n {\n \"name\": \"INFD_KEYCAPE_ISSUER\",\n \"value\": \"https://kc.coulomb.social\"\n },\n {\n \"name\": \"INFD_CONTAINER_CONFIG\",\n \"value\": \"/configuration/runtime.json\"\n }\n ],\n \"image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n \"imagePullPolicy\": \"IfNotPresent\",\n \"livenessProbe\": {\n \"failureThreshold\": 3,\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\",\n \"scheme\": \"HTTP\"\n },\n \"periodSeconds\": 10,\n \"successThreshold\": 1,\n \"timeoutSeconds\": 2\n },\n \"name\": \"informed-decision\",\n \"ports\": [\n {\n \"containerPort\": 8080,\n \"name\": \"http\",\n \"protocol\": \"TCP\"\n },\n {\n \"containerPort\": 8081,\n \"name\": \"workload\",\n \"protocol\": \"TCP\"\n }\n ],\n \"readinessProbe\": {\n \"failureThreshold\": 3,\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\",\n \"scheme\": \"HTTP\"\n },\n \"periodSeconds\": 10,\n \"successThreshold\": 1,\n \"timeoutSeconds\": 2\n },\n \"resources\": {\n \"limits\": {\n \"cpu\": \"500m\",\n \"memory\": \"256Mi\"\n },\n \"requests\": {\n \"cpu\": \"5m\",\n \"memory\": \"64Mi\"\n }\n },\n \"securityContext\": {\n \"allowPrivilegeEscalation\": false,\n \"capabilities\": {\n \"drop\": [\n \"ALL\"\n ]\n },\n \"readOnlyRootFilesystem\": true\n },\n \"startupProbe\": {\n \"failureThreshold\": 12,\n \"httpGet\": {\n \"path\": \"/healthz\",\n \"port\": \"http\",\n \"scheme\": \"HTTP\"\n },\n \"periodSeconds\": 10,\n \"successThreshold\": 1,\n \"timeoutSeconds\": 2\n },\n \"terminationMessagePath\": \"/dev/termination-log\",\n \"terminationMessagePolicy\": \"File\",\n \"volumeMounts\": [\n {\n \"mountPath\": \"/data\",\n \"name\": \"data\"\n },\n {\n \"mountPath\": \"/run/informed-decision\",\n \"name\": \"runtime\"\n },\n {\n \"mountPath\": \"/tmp\",\n \"name\": \"tmp\"\n },\n {\n \"mountPath\": \"/configuration\",\n \"name\": \"configuration\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/policy\",\n \"name\": \"caller\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/audit\",\n \"name\": \"audit\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/kubernetes\",\n \"name\": \"kubernetes-api\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/workload-registry\",\n \"name\": \"workload-registry\",\n \"readOnly\": true\n },\n {\n \"mountPath\": \"/var/run/secrets/informed-decision/requester\",\n \"name\": \"sitting-requester\",\n \"readOnly\": true\n }\n ]\n }\n ],\n \"dnsPolicy\": \"ClusterFirst\",\n \"restartPolicy\": \"Always\",\n \"schedulerName\": \"default-scheduler\",\n \"securityContext\": {\n \"fsGroup\": 10001,\n \"fsGroupChangePolicy\": \"OnRootMismatch\",\n \"runAsGroup\": 10001,\n \"runAsNonRoot\": true,\n \"runAsUser\": 10001,\n \"seccompProfile\": {\n \"type\": \"RuntimeDefault\"\n }\n },\n \"serviceAccount\": \"review\",\n \"serviceAccountName\": \"review\",\n \"terminationGracePeriodSeconds\": 45,\n \"volumes\": [\n {\n \"name\": \"data\",\n \"persistentVolumeClaim\": {\n \"claimName\": \"informed-decision-data\"\n }\n },\n {\n \"emptyDir\": {\n \"medium\": \"Memory\",\n \"sizeLimit\": \"16Mi\"\n },\n \"name\": \"runtime\"\n },\n {\n \"emptyDir\": {\n \"medium\": \"Memory\",\n \"sizeLimit\": \"16Mi\"\n },\n \"name\": \"tmp\"\n },\n {\n \"configMap\": {\n \"defaultMode\": 292,\n \"name\": \"informed-decision-runtime-6c221878d051\"\n },\n \"name\": \"configuration\"\n },\n {\n \"name\": \"caller\",\n \"projected\": {\n \"defaultMode\": 288,\n \"sources\": [\n {\n \"serviceAccountToken\": {\n \"audience\": \"flex-auth\",\n \"expirationSeconds\": 3600,\n \"path\": \"token\"\n }\n }\n ]\n }\n },\n {\n \"name\": \"audit\",\n \"secret\": {\n \"defaultMode\": 288,\n \"items\": [\n {\n \"key\": \"token\",\n \"path\": \"token\"\n }\n ],\n \"secretName\": \"informed-decision-audit\"\n }\n },\n {\n \"name\": \"kubernetes-api\",\n \"projected\": {\n \"defaultMode\": 288,\n \"sources\": [\n {\n \"serviceAccountToken\": {\n \"expirationSeconds\": 600,\n \"path\": \"token\"\n }\n },\n {\n \"configMap\": {\n \"items\": [\n {\n \"key\": \"ca.crt\",\n \"path\": \"ca.crt\"\n }\n ],\n \"name\": \"kube-root-ca.crt\"\n }\n }\n ]\n }\n },\n {\n \"configMap\": {\n \"defaultMode\": 292,\n \"name\": \"informed-decision-workload-registry\"\n },\n \"name\": \"workload-registry\"\n },\n {\n \"name\": \"sitting-requester\",\n \"secret\": {\n \"defaultMode\": 288,\n \"items\": [\n {\n \"key\": \"client-secret\",\n \"path\": \"client-secret\"\n }\n ],\n \"optional\": false,\n \"secretName\": \"informed-decision-sitting-requester\"\n }\n }\n ]\n }\n }\n }\n}\n"
},
{
"item_id": "change-guard-py",
"media_type": "text/plain",
"content": "\"\"\"Read-only exact Deployment and admission boundaries; no mutation authority.\"\"\"\nimport copy\nimport hashlib\nimport json\n\nBASE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173'\nCANDIDATE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a'\n\n\ndef dependency_projection(configmap, pvc):\n if (configmap.get('kind') != 'ConfigMap' or configmap.get('immutable') is not True\n or configmap['metadata']['namespace'] != 'informed-decision'\n or configmap['metadata']['name'] != 'informed-decision-runtime-6c221878d051'\n or set(configmap.get('data', {})) != {'runtime.json'}\n or configmap.get('binaryData')):\n raise ValueError('unexpected immutable runtime config identity')\n if (pvc.get('kind') != 'PersistentVolumeClaim'\n or pvc['metadata']['namespace'] != 'informed-decision'\n or pvc['metadata']['name'] != 'informed-decision-data'\n or pvc.get('status', {}).get('phase') != 'Bound'\n or not pvc.get('spec', {}).get('volumeName')):\n raise ValueError('unexpected bound PVC custody')\n config = projection(configmap)\n config.pop('data')\n config['canonical_data_sha256'] = hashlib.sha256(json.dumps(\n configmap['data'], sort_keys=True, separators=(',', ':')).encode()).hexdigest()\n return {'configmap': config, 'pvc': projection(pvc), 'pvc_phase': 'Bound'}\n\n\ndef check_dependencies(configmap, pvc, sealed):\n if dependency_projection(configmap, pvc) != sealed:\n raise ValueError('runtime config or PVC identity/custody changed')\n\n\ndef projection(value):\n value = copy.deepcopy(value)\n value.pop('status', None)\n for key in ('resourceVersion', 'generation', 'creationTimestamp', 'managedFields'):\n value['metadata'].pop(key, None)\n for key in ('kubectl.kubernetes.io/last-applied-configuration', 'deployment.kubernetes.io/revision'):\n value['metadata'].get('annotations', {}).pop(key, None)\n return value\n\n\ndef check_current(current, sealed):\n if projection(current) != sealed:\n raise ValueError('sealed live UID or configuration changed')\n\n\ndef check_admitted(admitted, sealed):\n expected = copy.deepcopy(sealed)\n containers = expected['spec']['template']['spec']['containers']\n if len(containers) != 1 or containers[0]['name'] != 'informed-decision' or containers[0]['image'] != BASE:\n raise ValueError('unexpected baseline container identity')\n containers[0]['image'] = CANDIDATE\n if projection(admitted) != expected:\n raise ValueError('admission changed configuration beyond the sole image pin')\n\n\ndef transport_result(exit_code, output):\n import json\n try:\n value = json.loads(output)\n except (ValueError, TypeError):\n return {'all_checks_pass': False, 'reason': 'invalid transport result'}\n if exit_code != 0 or not isinstance(value, dict) or value.get('all_checks_pass') is not True:\n return {'all_checks_pass': False, 'reason': 'read-only preflight refused'}\n return value\n"
},
{
"item_id": "preflight-py",
"media_type": "text/plain",
"content": "\"\"\"Read-only refresh; exact original capture remains immutable; never execute cutover.\"\"\"\nimport argparse,hashlib,json,subprocess,sys\nfrom pathlib import Path\nif sys.flags.optimize:\n raise SystemExit(\"optimized interpreter refused before source/transport execution\")\nROOT=Path(__file__).resolve().parent\np=argparse.ArgumentParser();p.add_argument('--receipt-output',type=Path,required=True);p.add_argument('--source-root',type=Path,default=Path('/home/worsch/informed-decision'));a=p.parse_args()\nout=a.receipt_output.resolve()\nif not a.receipt_output.is_absolute() or out==ROOT or ROOT in out.parents or out==a.source_root.resolve() or a.source_root.resolve() in out.parents or out.exists():\n raise SystemExit('unique execution receipt must be outside the sealed packet')\ninputs=json.loads((ROOT/'preflight-inputs.json').read_text())\nfor relative,digest in inputs['packet_files'].items():\n path=ROOT/relative\n if path.is_symlink() or hashlib.sha256(path.read_bytes()).hexdigest()!=digest:raise SystemExit('sealed helper/input bytes changed')\nfor relative,digest in inputs['owner_source_files'].items():\n path=a.source_root/relative\n if path.is_symlink() or hashlib.sha256(path.read_bytes()).hexdigest()!=digest:raise SystemExit('owner source bytes changed')\nfrom change_guard import transport_result\nprogram='import subprocess,json,hashlib,datetime,sys,copy,re\\nif sys.flags.optimize:raise RuntimeError(\"optimized interpreter refused\")\\ncandidate=json.loads(CANDIDATE_LITERAL)\\nsealed_dependencies=json.loads(DEPENDENCIES_LITERAL)\\nsealed_baseline=json.loads(SEALED_LITERAL)\\nexec(GUARD_LITERAL)\\ndef run(args,data=None):\\n p=subprocess.run(args,input=data,text=True,capture_output=True)\\n if p.returncode: raise ValueError(\\'read-only command failed: \\'+args[1]+\\' \\'+args[2])\\n return p.stdout\\nlive=json.loads(run([\\'kubectl\\',\\'get\\',\\'deployment\\',\\'informed-decision\\',\\'-n\\',\\'informed-decision\\',\\'-o\\',\\'json\\']))\\ncm=json.loads(run([\\'kubectl\\',\\'get\\',\\'configmap\\',\\'informed-decision-runtime-6c221878d051\\',\\'-n\\',\\'informed-decision\\',\\'-o\\',\\'json\\']))\\npvc=json.loads(run([\\'kubectl\\',\\'get\\',\\'pvc\\',\\'informed-decision-data\\',\\'-n\\',\\'informed-decision\\',\\'-o\\',\\'json\\']))\\ncheck_dependencies(cm,pvc,sealed_dependencies)\\ncheck_current(live,sealed_baseline)\\nspec=live[\\'spec\\']; cs=spec[\\'template\\'][\\'spec\\'][\\'containers\\'];assert len(cs)==1 and cs[0][\\'name\\']==\\'informed-decision\\'\\nexpected_env={\\'INFD_KEYCAPE_ISSUER\\':\\'https://kc.coulomb.social\\',\\'INFD_CONTAINER_CONFIG\\':\\'/configuration/runtime.json\\'}\\nassert cs[0].get(\\'env\\')==[{\\'name\\':\\'INFD_KEYCAPE_ISSUER\\',\\'value\\':expected_env[\\'INFD_KEYCAPE_ISSUER\\']},{\\'name\\':\\'INFD_CONTAINER_CONFIG\\',\\'value\\':expected_env[\\'INFD_CONTAINER_CONFIG\\']}]\\nassert cs[0][\\'image\\']==\\'forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\\'\\nassert spec[\\'replicas\\']==1 and spec[\\'strategy\\']=={\\'type\\':\\'Recreate\\'}\\nassert next(v for v in spec[\\'template\\'][\\'spec\\'][\\'volumes\\'] if v[\\'name\\']==\\'configuration\\')[\\'configMap\\'][\\'name\\']==\\'informed-decision-runtime-6c221878d051\\'\\nassert live[\\'status\\'].get(\\'readyReplicas\\')==1 and live[\\'status\\'].get(\\'updatedReplicas\\')==1\\nsealed={\\'apiVersion\\':live[\\'apiVersion\\'],\\'kind\\':live[\\'kind\\'],\\'metadata\\':{k:copy.deepcopy(v) for k,v in live[\\'metadata\\'].items() if k not in (\\'resourceVersion\\',\\'generation\\',\\'creationTimestamp\\',\\'managedFields\\')},\\'spec\\':copy.deepcopy(spec)}\\nfor key in (\\'kubectl.kubernetes.io/last-applied-configuration\\',\\'deployment.kubernetes.io/revision\\'):sealed[\\'metadata\\'].get(\\'annotations\\',{}).pop(key,None)\\nadmitted=json.loads(run([\\'kubectl\\',\\'apply\\',\\'--dry-run=server\\',\\'-f\\',\\'-\\',\\'-o\\',\\'json\\'],json.dumps(candidate)))\\ncheck_admitted(admitted,sealed_baseline)\\napp=json.loads(run([\\'kubectl\\',\\'get\\',\\'application\\',\\'informed-decision\\',\\'-n\\',\\'argocd\\',\\'-o\\',\\'json\\']))\\nassert app[\\'spec\\'][\\'source\\'][\\'path\\']==\\'deploy/lifecycle\\' and not app[\\'spec\\'].get(\\'syncPolicy\\',{}).get(\\'automated\\')\\nargo={\\'uid\\':app[\\'metadata\\'][\\'uid\\'],\\'repoURL\\':app[\\'spec\\'][\\'source\\'][\\'repoURL\\'],\\'targetRevision\\':app[\\'spec\\'][\\'source\\'][\\'targetRevision\\'],\\'path\\':app[\\'spec\\'][\\'source\\'][\\'path\\'],\\'destination\\':app[\\'spec\\'][\\'destination\\'],\\'automated\\':False,\\'sync\\':app.get(\\'status\\',{}).get(\\'sync\\'),\\'health\\':app.get(\\'status\\',{}).get(\\'health\\')}\\nexpected_argo=json.loads(ARGO_LITERAL)\\nfor key in (\\'uid\\',\\'repoURL\\',\\'targetRevision\\',\\'path\\',\\'destination\\',\\'automated\\'):\\n assert argo[key]==expected_argo[key]\\nassert argo[\\'health\\'][\\'status\\']==\\'Healthy\\'\\ndiff=subprocess.run([\\'kubectl\\',\\'diff\\',\\'-f\\',\\'-\\'],input=json.dumps(candidate),text=True,capture_output=True);assert diff.returncode in (0,1)\\n# Diff can contain only nonsecret Deployment references; preserve digest rather than raw stdout.\\nnode=run([\\'kubectl\\',\\'describe\\',\\'node\\']);allocated=re.search(r\\'Allocated resources:.*?CPU Requests|Allocated resources:\\',node,re.S)\\nsection=node.split(\\'Allocated resources:\\')[1].split(\\'Events:\\')[0] if \\'Allocated resources:\\' in node else \\'\\'\\nnodes=json.loads(run([\\'kubectl\\',\\'get\\',\\'nodes\\',\\'-o\\',\\'json\\']))[\\'items\\'];assert len(nodes)==1\\nalloc=nodes[0][\\'status\\'][\\'allocatable\\'];cpu=alloc[\\'cpu\\'];cpu_m=int(cpu[:-1]) if cpu.endswith(\\'m\\') else int(cpu)*1000\\nrequested=int(re.search(r\\'cpu\\\\s+(\\\\d+)m\\',section).group(1));assert requested<=cpu_m\\nreceipt={\\'node_allocatable_cpu_m\\':cpu_m,\\'node_requested_cpu_m\\':requested,\\'captured_at\\':datetime.datetime.now(datetime.timezone.utc).isoformat(),\\'native_workload_changed\\':False,\\'native_backup_restore_executed\\':False,\\'argo\\':argo,\\'native_dependencies_checked\\':True,\\'configmap_uid\\':cm[\\'metadata\\'][\\'uid\\'],\\'pvc_uid\\':pvc[\\'metadata\\'][\\'uid\\'],\\'live_ready_replicas\\':1,\\'admitted_uid\\':admitted[\\'metadata\\'][\\'uid\\'],\\'server_dry_run_passed\\':True,\\'admitted_spec_exactly_live_plus_image\\':True,\\'client_diff_exit\\':diff.returncode,\\'client_diff_sha256\\':hashlib.sha256(diff.stdout.encode()).hexdigest(),\\'node_allocated_resources\\':section.strip(),\\'all_checks_pass\\':True}\\nprint(json.dumps(receipt))\\n'\nfor marker,value in [('DEPENDENCIES_LITERAL',(ROOT/'sealed-native-dependencies.json').read_text()),('CANDIDATE_LITERAL',(ROOT/'candidate-deployment.json').read_text()),('SEALED_LITERAL',(ROOT/'sealed-live-deployment.json').read_text()),('GUARD_LITERAL',(ROOT/'change_guard.py').read_text()),('ARGO_LITERAL',json.dumps(json.loads((ROOT/'native-preflight.json').read_text())['argo']))]:\n program=program.replace(marker,repr(value))\nprogram='import traceback,json\\ntry:\\n'+''.join(' '+line+'\\n' for line in program.splitlines())+\"except Exception as error:\\n print(json.dumps({'all_checks_pass':False,'exception_type':type(error).__name__,'exception_line':traceback.extract_tb(error.__traceback__)[-1].lineno}))\\n\"\nr=subprocess.run(['ssh','railiance01','python3 -'],input=program,text=True,capture_output=True)\nresult=transport_result(r.returncode,r.stdout);result['sealed_preflight_inputs_sha256']=hashlib.sha256((ROOT/'preflight-inputs.json').read_bytes()).hexdigest();result['fresh_execution_receipt']=True\nout.write_text(json.dumps(result,indent=2)+'\\n');print(json.dumps(result,indent=2));sys.exit(0 if result.get('all_checks_pass') is True else 1)\n"
},
{
"item_id": "preflight-inputs-json",
"media_type": "application/json",
"content": "{\n \"packet_files\": {\n \"change_guard.py\": \"f348e449c49f4d9e49af9e82e01764e7197837fd3df9d756f5891d9b8d9b38be\",\n \"preflight.py\": \"6b4c65f708238c9a9d17fd065876c7a00e1f1745926f990a1dd5e667298340cd\",\n \"candidate-deployment.json\": \"722a8e2dc52bec217bf960e23b2fddfc7ac27d343ac8743790e3183db81a6a0e\",\n \"rollback-deployment.json\": \"39b3f43bb84ef4921cc3a1fbcdc444610741ed8809149d8f8f17ed805f262121\",\n \"sealed-live-deployment.json\": \"d18d27063d06f535ae884ea01f96747fe301685518ab94b1cba072a1e1519362\",\n \"native-preflight.json\": \"eb5f41aefb97666bb0c1279617e95a7c05017a609415624daee724c48b90d262\",\n \"sealed-native-dependencies.json\": \"042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369\",\n \"sqlite_readonly.py\": \"eef53dd233eee74c17f20823bd7f5787c60cad79ac648021c9479643c6ce9e38\"\n },\n \"owner_source_files\": {\n \"deploy/lifecycle/admission.candidate.json\": \"92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55\",\n \"deploy/lifecycle/service.candidate.json\": \"38b78b9cbee5ade7750a58d5156ca4c5773352e947acb304ee714b59e749ceb4\"\n }\n}\n"
},
{
"item_id": "fresh-preflight-validation-json",
"media_type": "application/json",
"content": "{\n \"node_allocatable_cpu_m\": 4000,\n \"node_requested_cpu_m\": 3460,\n \"captured_at\": \"2026-10-11T01:39:14.234277+00:00\",\n \"native_workload_changed\": false,\n \"native_backup_restore_executed\": false,\n \"argo\": {\n \"uid\": \"499868f2-eabc-4df4-ae31-b89ce58d750d\",\n \"repoURL\": \"https://forgejo.coulomb.social/coulomb/informed-decision.git\",\n \"targetRevision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\",\n \"path\": \"deploy/lifecycle\",\n \"destination\": {\n \"namespace\": \"informed-decision\",\n \"server\": \"https://kubernetes.default.svc\"\n },\n \"automated\": false,\n \"sync\": {\n \"comparedTo\": {\n \"destination\": {\n \"namespace\": \"informed-decision\",\n \"server\": \"https://kubernetes.default.svc\"\n },\n \"source\": {\n \"path\": \"deploy/lifecycle\",\n \"repoURL\": \"https://forgejo.coulomb.social/coulomb/informed-decision.git\",\n \"targetRevision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\"\n }\n },\n \"revision\": \"7db8485ffecdebfabd77a9daec085553c74bf0bf\",\n \"status\": \"OutOfSync\"\n },\n \"health\": {\n \"lastTransitionTime\": \"2026-10-10T23:14:52Z\",\n \"status\": \"Healthy\"\n }\n },\n \"native_dependencies_checked\": true,\n \"configmap_uid\": \"90113d2d-54d9-4e82-b1d3-90b49ebed2b5\",\n \"pvc_uid\": \"d80b25b1-141a-441b-b205-98fa2fd98b7c\",\n \"live_ready_replicas\": 1,\n \"admitted_uid\": \"a588e10a-90d2-4883-975e-6dd8b8feca92\",\n \"server_dry_run_passed\": true,\n \"admitted_spec_exactly_live_plus_image\": true,\n \"client_diff_exit\": 1,\n \"client_diff_sha256\": \"840769c7d2a9c1655c40a3259f833d1fc8f69950ceb3bedb707a955fed711566\",\n \"node_allocated_resources\": \"(Total limits may be over 100 percent, i.e., overcommitted.)\\n Resource Requests Limits\\n -------- -------- ------\\n cpu 3460m (86%) 36200m (905%)\\n memory 9472Mi (59%) 32898Mi (205%)\\n ephemeral-storage 0 (0%) 0 (0%)\\n hugepages-1Gi 0 (0%) 0 (0%)\\n hugepages-2Mi 0 (0%) 0 (0%)\",\n \"all_checks_pass\": true,\n \"sealed_preflight_inputs_sha256\": \"756e72da9ec36572242421bea8b6d2285394e334f991db5e90e9b409563b5f06\",\n \"fresh_execution_receipt\": true\n}\n"
}
]
}
Reference in a new issue View git blame Copy permalink