diff --git a/.kaizen/agents/custodian-codex/supervision.json b/.kaizen/agents/custodian-codex/supervision.json index b58b6139..21ac31f9 100644 --- a/.kaizen/agents/custodian-codex/supervision.json +++ b/.kaizen/agents/custodian-codex/supervision.json @@ -381,8 +381,8 @@ { "proposal_id": "INFD-WP-0009-T05/zlib85091-r1", "trial_id": "infd-zlib-20261011-r1", - "disposition": "pending", - "outcome": "not_executed", + "disposition": "accepted_unchanged", + "outcome": "succeeded", "original_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", "original_digest": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206", "commands_sha256": "4cf81acb7d42f52d81f8ba624a6b2349a0b8948477a14c09bd069d2a4acab7cf", @@ -393,7 +393,7 @@ "target": "realm:kubernetes/railiance01/informed-decision", "authority_mode": "ADMINISTER", "expected_result": "New guarded protected same-schema drill and one-Deployment zlib-only release to exact published f558; installed r1, fresh full zero scan, Ready and canonical authenticated provider proof. Human acceptance required first.", - "verification_ref": "/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release/native-backup-restore-protocol.md", + "verification_ref": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/canonical-provider-verification.json", "rollback_ref": "/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release/rollback-deployment.json", "rollback": "Exact image763/sourcec96; preserve latest database. Proposed manual outage recovery limited to same trial,30 minutes and deadline; later revocation uncertainty requires express new human consent.", "cost_estimate_eur": 0, @@ -425,15 +425,50 @@ "preparation_history_ref": "/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release/preparation-failure-history.json", "history_limit": "Original67 full snapshot unavailable; retained digest and observations are not reconstructed full bytes. Earlier changes-requested reviews and failed T04 evidence preserved.", "promotion_evidence": false, - "native_execution": false, - "bounded_outage_exception": "proposed-only-unapproved", + "native_execution": true, + "bounded_outage_exception": "approved_scoped_manual_same_trial_only", "checklist_item": 19, "checklist_display_label": "INFD-WP-0009-T05/zlib-85091-r1", "scoring_semantics": "New distinct T05 trial; preparation refinements are not executed trials or scored successes. No old T04 approval inherited.", "review_memo_id": "review-2cf690a6-8c46-4faa-826c-a24a88d53dea", "native_authoring_receipt_ref": "/home/worsch/the-custodian/docs/evidence/2026-10-10-security-consolidation/zlib-native-authoring-receipt.json", "review_ready_at": "2026-10-11T10:40:24.369238+00:00", - "user_review_preference": "Review in informed-decision; not founder acceptance" + "user_review_preference": "Review in informed-decision; not founder acceptance", + "approved_digest": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206", + "approved_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "approved_at": "2026-10-11T10:40:55Z", + "approval_ref": "b5ce337c-5d7d-44fa-864d-706b54039f7c", + "human_disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f", + "approved_source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "executed_digest": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206", + "executed_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "executed_source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "refinement_or_rescue": true, + "preexecution_refinement": "Root receipt incorrectly reused native clock1.1806s ahead; three invocations refused before custody/journal. Root-only local verified_at correction; approved actuator/render/plan unchanged; failed prephase receipts retained.", + "completed_phases": [ + "drill-backup", + "drill-copy", + "offline-verify", + "cleanup-offline", + "cutover-backup", + "cutover-copy", + "release", + "verify" + ], + "verified_at": "2026-10-11T11:20:27.541827+00:00", + "outage_recovery_used": false, + "latest_database_preserved": true, + "scan_completed_at": "2026-10-11T10:48:46.790940Z", + "installed_zlib": "1.3.2-r1", + "allseverity_findings": 0, + "owner_postacceptance": "verified and recorded separately: Product T10 and Platform RPF-IN-0010", + "product_closure_commit": "47881fc1ff262bb705e75e4b59b8ef4731780d87", + "platform_acceptance_commit": "8647587ca292b67857c79f4561d3264e7f8132ef", + "actual_hub_decision_id": "2b81326f-4c09-5c66-88d1-84af4e5895fd", + "residuals_retained": [ + "INFD-IN-0010", + "INFD-IN-0009" + ] } ] } diff --git a/docs/evidence/2026-10-10-security-consolidation/source-after-zlib-native-closure-2026-10-11.json b/docs/evidence/2026-10-10-security-consolidation/source-after-zlib-native-closure-2026-10-11.json new file mode 100644 index 00000000..ed16e97a --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/source-after-zlib-native-closure-2026-10-11.json @@ -0,0 +1,437 @@ +{ + "observed_at": "2026-10-11T11:29:24.110383+00:00", + "scope": "same13 owner repositories; top-level authoritative workplan files, statuses proposed/ready/active/blocked/backlog; done/cancel tasks excluded; residuals counted separately", + "repos": { + "railiance-platform": { + "open_plans": 10, + "nonresidual_plans": 9, + "residual_plans": 1, + "unfinished_tasks": 30, + "workplans": [ + { + "id": "RPF-WP-0015", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 2, + "file": "/home/worsch/railiance-platform/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md" + }, + { + "id": "RPF-WP-0027", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 2, + "file": "/home/worsch/railiance-platform/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md" + }, + { + "id": "RPF-WP-0035", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 7, + "file": "/home/worsch/railiance-platform/workplans/RPF-WP-0035-credential-lane-implementation.md" + }, + { + "id": "RPF-WP-0036", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 3, + "file": "/home/worsch/railiance-platform/workplans/RPF-WP-0036-platform-service-assurance.md" + }, + { + "id": "RPF-WP-0038", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/railiance-platform/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md" + }, + { + "id": "RPF-WP-0043", + "status": "blocked", + "flavor": "planning", + "unfinished_tasks": 2, + "file": "/home/worsch/railiance-platform/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md" + }, + { + "id": "RPF-WP-0044", + "status": "blocked", + "flavor": "planning", + "unfinished_tasks": 6, + "file": "/home/worsch/railiance-platform/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md" + }, + { + "id": "RPF-WP-0048", + "status": "blocked", + "flavor": null, + "unfinished_tasks": 1, + "file": "/home/worsch/railiance-platform/workplans/RPF-WP-0048-activity-core-gitops-adoption.md" + }, + { + "id": "RPF-WP-0053", + "status": "proposed", + "flavor": null, + "unfinished_tasks": 5, + "file": "/home/worsch/railiance-platform/workplans/RPF-WP-0053-coulomb-paired-backup-admission.md" + }, + { + "id": "RPF-WP-0055", + "status": "backlog", + "flavor": "residual", + "unfinished_tasks": 1, + "file": "/home/worsch/railiance-platform/workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md" + } + ] + }, + "net-kingdom": { + "open_plans": 7, + "nonresidual_plans": 7, + "residual_plans": 0, + "unfinished_tasks": 17, + "workplans": [ + { + "id": "NK-WP-0011", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 8, + "file": "/home/worsch/net-kingdom/workplans/NK-WP-0011-enterprise-federation-saml.md" + }, + { + "id": "NK-WP-0022", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/net-kingdom/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md" + }, + { + "id": "NK-WP-0027", + "status": "blocked", + "flavor": "planning", + "unfinished_tasks": 3, + "file": "/home/worsch/net-kingdom/workplans/NK-WP-0027-reef-placement-reconciliation.md" + }, + { + "id": "NK-WP-0031", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/net-kingdom/workplans/NK-WP-0031-deterministic-posture-feedback.md" + }, + { + "id": "NK-WP-0035", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/net-kingdom/workplans/NK-WP-0035-emission-cadence-security-profile.md" + }, + { + "id": "NK-WP-0040", + "status": "blocked", + "flavor": "planning", + "unfinished_tasks": 1, + "file": "/home/worsch/net-kingdom/workplans/NK-WP-0040-execution-attribution-receipt.md" + }, + { + "id": "NK-WP-0048", + "status": "active", + "flavor": "implementation", + "unfinished_tasks": 2, + "file": "/home/worsch/net-kingdom/workplans/NK-WP-0048-security-case-types.md" + } + ] + }, + "access-engine": { + "open_plans": 4, + "nonresidual_plans": 4, + "residual_plans": 0, + "unfinished_tasks": 14, + "workplans": [ + { + "id": "FLEX-WP-ADHOC-2026-10-03", + "status": "blocked", + "flavor": null, + "unfinished_tasks": 1, + "file": "/home/worsch/access-engine/workplans/ADHOC-2026-10-03.md" + }, + { + "id": "FLEX-WP-0020", + "status": "blocked", + "flavor": "planning", + "unfinished_tasks": 1, + "file": "/home/worsch/access-engine/workplans/FLEX-WP-0020-repository-identity-migration.md" + }, + { + "id": "FLEX-WP-0031", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 4, + "file": "/home/worsch/access-engine/workplans/FLEX-WP-0031-decision-record-emission.md" + }, + { + "id": "FLEX-WP-0036", + "status": "active", + "flavor": null, + "unfinished_tasks": 8, + "file": "/home/worsch/access-engine/workplans/FLEX-WP-0036-runtime-rename-access-engine.md" + } + ] + }, + "secrets-engine": { + "open_plans": 4, + "nonresidual_plans": 4, + "residual_plans": 0, + "unfinished_tasks": 5, + "workplans": [ + { + "id": "SECRETS-WP-0006", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 2, + "file": "/home/worsch/secrets-engine/workplans/SECRETS-WP-0006-catalog-lane-adoption.md" + }, + { + "id": "SECRETS-WP-0007", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/secrets-engine/workplans/SECRETS-WP-0007-production-lifecycle-hardening.md" + }, + { + "id": "SECRETS-WP-0008", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/secrets-engine/workplans/SECRETS-WP-0008-layer-model-lifecycle-conformance.md" + }, + { + "id": "SECRETS-WP-0009", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/secrets-engine/workplans/SECRETS-WP-0009-glas-claude-native-delivery.md" + } + ] + }, + "ops-mason": { + "open_plans": 5, + "nonresidual_plans": 5, + "residual_plans": 0, + "unfinished_tasks": 8, + "workplans": [ + { + "id": "MASON-WP-0004", + "status": "blocked", + "flavor": "planning", + "unfinished_tasks": 2, + "file": "/home/worsch/ops-mason/workplans/MASON-WP-0004-credential-inventory-descriptions.md" + }, + { + "id": "MASON-WP-0005", + "status": "blocked", + "flavor": "planning", + "unfinished_tasks": 2, + "file": "/home/worsch/ops-mason/workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md" + }, + { + "id": "MASON-WP-0006", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/ops-mason/workplans/MASON-WP-0006-readiness-tier-check.md" + }, + { + "id": "MASON-WP-0009", + "status": "blocked", + "flavor": "planning", + "unfinished_tasks": 1, + "file": "/home/worsch/ops-mason/workplans/MASON-WP-0009-keycape-secrets-engine-openbao-client-custody.md" + }, + { + "id": "MASON-WP-0010", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 2, + "file": "/home/worsch/ops-mason/workplans/MASON-WP-0010-security-case-materialization.md" + } + ] + }, + "ops-warden": { + "open_plans": 5, + "nonresidual_plans": 5, + "residual_plans": 0, + "unfinished_tasks": 8, + "workplans": [ + { + "id": "WARDEN-WP-0027", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/ops-warden/workplans/WARDEN-WP-0027-credential-governance-lockdown.md" + }, + { + "id": "WARDEN-WP-0034", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/ops-warden/workplans/WARDEN-WP-0034-layer-model-v07-conformance.md" + }, + { + "id": "WARDEN-WP-0037", + "status": "blocked", + "flavor": "planning", + "unfinished_tasks": 1, + "file": "/home/worsch/ops-warden/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md" + }, + { + "id": "WARDEN-WP-0040", + "status": "blocked", + "flavor": "planning", + "unfinished_tasks": 3, + "file": "/home/worsch/ops-warden/workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md" + }, + { + "id": "WARDEN-WP-0044", + "status": "active", + "flavor": "implementation", + "unfinished_tasks": 2, + "file": "/home/worsch/ops-warden/workplans/WARDEN-WP-0044-security-case-follow-through.md" + } + ] + }, + "key-cape": { + "open_plans": 2, + "nonresidual_plans": 2, + "residual_plans": 0, + "unfinished_tasks": 3, + "workplans": [ + { + "id": "KEY-WP-0038", + "status": "active", + "flavor": "implementation", + "unfinished_tasks": 2, + "file": "/home/worsch/key-cape/workplans/KEY-WP-0038-forgejo-oidc-client.md" + }, + { + "id": "KEY-WP-0039", + "status": "active", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/key-cape/workplans/KEY-WP-0039-openbao-negative-probe-tokens.md" + } + ] + }, + "user-engine": { + "open_plans": 5, + "nonresidual_plans": 5, + "residual_plans": 0, + "unfinished_tasks": 7, + "workplans": [ + { + "id": "USER-WP-0026", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/user-engine/workplans/USER-WP-0026-account-recovery.md" + }, + { + "id": "USER-WP-0027", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 2, + "file": "/home/worsch/user-engine/workplans/USER-WP-0027-account-journey-clarity.md" + }, + { + "id": "USER-WP-0028", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 2, + "file": "/home/worsch/user-engine/workplans/USER-WP-0028-user-journey-acceptance.md" + }, + { + "id": "USER-WP-0035", + "status": "blocked", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/user-engine/workplans/USER-WP-0035-onboarding-handoff-findings.md" + }, + { + "id": "USER-WP-0037", + "status": "blocked", + "flavor": null, + "unfinished_tasks": 1, + "file": "/home/worsch/user-engine/workplans/USER-WP-0037-hub-authority-lookup.md" + } + ] + }, + "tenant-engine": { + "open_plans": 1, + "nonresidual_plans": 0, + "residual_plans": 1, + "unfinished_tasks": 2, + "workplans": [ + { + "id": "TEN-WP-0012", + "status": "blocked", + "flavor": "residual", + "unfinished_tasks": 2, + "file": "/home/worsch/tenant-engine/workplans/TEN-WP-0012-external-conformance-waits.md" + } + ] + }, + "gate-house": { + "open_plans": 1, + "nonresidual_plans": 1, + "residual_plans": 0, + "unfinished_tasks": 1, + "workplans": [ + { + "id": "GH-WP-0004", + "status": "active", + "flavor": "implementation", + "unfinished_tasks": 1, + "file": "/home/worsch/gate-house/workplans/GH-WP-0004-section-11-layer-declarations.md" + } + ] + }, + "kings-guard": { + "open_plans": 1, + "nonresidual_plans": 1, + "residual_plans": 0, + "unfinished_tasks": 1, + "workplans": [ + { + "id": "KG-WP-0005", + "status": "blocked", + "flavor": null, + "unfinished_tasks": 1, + "file": "/home/worsch/kings-guard/workplans/KG-WP-0005-qonto-source-cadence-admission.md" + } + ] + }, + "policy-nexus": { + "open_plans": 0, + "nonresidual_plans": 0, + "residual_plans": 0, + "unfinished_tasks": 0, + "workplans": [] + }, + "informed-decision": { + "open_plans": 1, + "nonresidual_plans": 1, + "residual_plans": 0, + "unfinished_tasks": 4, + "workplans": [ + { + "id": "INFD-WP-0008", + "status": "backlog", + "flavor": null, + "unfinished_tasks": 4, + "file": "/home/worsch/informed-decision/workplans/INFD-WP-0008-lifecycle-expansion-contracts.md" + } + ] + } + }, + "total": { + "open_plans": 46, + "nonresidual_plans": 44, + "residual_plans": 2, + "unfinished_tasks": 100 + } +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-closure-commits.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-closure-commits.json new file mode 100644 index 00000000..7b247834 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-closure-commits.json @@ -0,0 +1,16 @@ +[ + { + "repo": "informed-decision", + "revision": "47881fc1ff262bb705e75e4b59b8ef4731780d87", + "files": 28, + "source_only": true, + "native_change": false + }, + { + "repo": "railiance-platform", + "revision": "8647587ca292b67857c79f4561d3264e7f8132ef", + "files": 25, + "source_only": true, + "native_change": false + } +] diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-closure-stage-receipts.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-closure-stage-receipts.json new file mode 100644 index 00000000..fcef99fe --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-closure-stage-receipts.json @@ -0,0 +1,12 @@ +[ + { + "manifest": "/tmp/infd-zlib-native-product-acceptance-stage/manifest.json", + "sha256": "a985b1b8978d169c95b8ee693f2d00f2146756854de04a48412f115e23a360b4", + "file_count": 28 + }, + { + "manifest": "/tmp/infd-zlib-platform-native-acceptance-stage/manifest.json", + "sha256": "35953f6ec6340f3a60dd4a72ba68fb91a0bb88a7356b58dd8a94557ba71b6f4a", + "file_count": 25 + } +] diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/approved-local-image-readiness.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/approved-local-image-readiness.json new file mode 100644 index 00000000..03cd3134 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/approved-local-image-readiness.json @@ -0,0 +1,10 @@ +{ + "exact_image_available": true, + "pulled": true, + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23", + "image_config_id": "sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23", + "exact_registry_digest_bound": true, + "source_labels_match": true, + "container_execution": false, + "credentials_used": false +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/approved-native-preflight.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/approved-native-preflight.json new file mode 100644 index 00000000..4908ef8e --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/approved-native-preflight.json @@ -0,0 +1,672 @@ +{ + "all_checks_pass": true, + "observed_at": "2026-10-11T10:44:51.809259+00:00", + "native_changed": false, + "protected_database_read": false, + "secret_read": false, + "deployment_generation": 25, + "ready_replicas": 1, + "sealed_live_deployment": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "annotations": { + "argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision", + "informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover" + }, + "name": "informed-decision", + "namespace": "informed-decision", + "uid": "a588e10a-90d2-4883-975e-6dd8b8feca92" + }, + "spec": { + "progressDeadlineSeconds": 600, + "replicas": 1, + "revisionHistoryLimit": 10, + "selector": { + "matchLabels": { + "app.kubernetes.io/name": "informed-decision" + } + }, + "strategy": { + "type": "Recreate" + }, + "template": { + "metadata": { + "annotations": { + "informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover" + }, + "labels": { + "app.kubernetes.io/component": "review", + "app.kubernetes.io/name": "informed-decision" + } + }, + "spec": { + "automountServiceAccountToken": false, + "containers": [ + { + "env": [ + { + "name": "INFD_KEYCAPE_ISSUER", + "value": "https://kc.coulomb.social" + }, + { + "name": "INFD_CONTAINER_CONFIG", + "value": "/configuration/runtime.json" + } + ], + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "imagePullPolicy": "IfNotPresent", + "livenessProbe": { + "failureThreshold": 3, + "httpGet": { + "path": "/healthz", + "port": "http", + "scheme": "HTTP" + }, + "periodSeconds": 10, + "successThreshold": 1, + "timeoutSeconds": 2 + }, + "name": "informed-decision", + "ports": [ + { + "containerPort": 8080, + "name": "http", + "protocol": "TCP" + }, + { + "containerPort": 8081, + "name": "workload", + "protocol": "TCP" + } + ], + "readinessProbe": { + "failureThreshold": 3, + "httpGet": { + "path": "/healthz", + "port": "http", + "scheme": "HTTP" + }, + "periodSeconds": 10, + "successThreshold": 1, + "timeoutSeconds": 2 + }, + "resources": { + "limits": { + "cpu": "500m", + "memory": "256Mi" + }, + "requests": { + "cpu": "5m", + "memory": "64Mi" + } + }, + "securityContext": { + "allowPrivilegeEscalation": false, + "capabilities": { + "drop": [ + "ALL" + ] + }, + "readOnlyRootFilesystem": true + }, + "startupProbe": { + "failureThreshold": 12, + "httpGet": { + "path": "/healthz", + "port": "http", + "scheme": "HTTP" + }, + "periodSeconds": 10, + "successThreshold": 1, + "timeoutSeconds": 2 + }, + "terminationMessagePath": "/dev/termination-log", + "terminationMessagePolicy": "File", + "volumeMounts": [ + { + "mountPath": "/data", + "name": "data" + }, + { + "mountPath": "/run/informed-decision", + "name": "runtime" + }, + { + "mountPath": "/tmp", + "name": "tmp" + }, + { + "mountPath": "/configuration", + "name": "configuration", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/policy", + "name": "caller", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/audit", + "name": "audit", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/kubernetes", + "name": "kubernetes-api", + "readOnly": true + }, + { + "mountPath": "/workload-registry", + "name": "workload-registry", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/requester", + "name": "sitting-requester", + "readOnly": true + } + ] + } + ], + "dnsPolicy": "ClusterFirst", + "restartPolicy": "Always", + "schedulerName": "default-scheduler", + "securityContext": { + "fsGroup": 10001, + "fsGroupChangePolicy": "OnRootMismatch", + "runAsGroup": 10001, + "runAsNonRoot": true, + "runAsUser": 10001, + "seccompProfile": { + "type": "RuntimeDefault" + } + }, + "serviceAccount": "review", + "serviceAccountName": "review", + "terminationGracePeriodSeconds": 45, + "volumes": [ + { + "name": "data", + "persistentVolumeClaim": { + "claimName": "informed-decision-data" + } + }, + { + "emptyDir": { + "medium": "Memory", + "sizeLimit": "16Mi" + }, + "name": "runtime" + }, + { + "emptyDir": { + "medium": "Memory", + "sizeLimit": "16Mi" + }, + "name": "tmp" + }, + { + "configMap": { + "defaultMode": 292, + "name": "informed-decision-runtime-6c221878d051" + }, + "name": "configuration" + }, + { + "name": "caller", + "projected": { + "defaultMode": 288, + "sources": [ + { + "serviceAccountToken": { + "audience": "flex-auth", + "expirationSeconds": 3600, + "path": "token" + } + } + ] + } + }, + { + "name": "audit", + "secret": { + "defaultMode": 288, + "items": [ + { + "key": "token", + "path": "token" + } + ], + "secretName": "informed-decision-audit" + } + }, + { + "name": "kubernetes-api", + "projected": { + "defaultMode": 288, + "sources": [ + { + "serviceAccountToken": { + "expirationSeconds": 600, + "path": "token" + } + }, + { + "configMap": { + "items": [ + { + "key": "ca.crt", + "path": "ca.crt" + } + ], + "name": "kube-root-ca.crt" + } + } + ] + } + }, + { + "configMap": { + "defaultMode": 292, + "name": "informed-decision-workload-registry" + }, + "name": "workload-registry" + }, + { + "name": "sitting-requester", + "secret": { + "defaultMode": 288, + "items": [ + { + "key": "client-secret", + "path": "client-secret" + } + ], + "optional": false, + "secretName": "informed-decision-sitting-requester" + } + } + ] + } + } + } + }, + "candidate_deployment": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "annotations": { + "argocd.argoproj.io/tracking-id": "informed-decision:apps/Deployment:informed-decision/informed-decision", + "informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover" + }, + "name": "informed-decision", + "namespace": "informed-decision", + "uid": "a588e10a-90d2-4883-975e-6dd8b8feca92" + }, + "spec": { + "progressDeadlineSeconds": 600, + "replicas": 1, + "revisionHistoryLimit": 10, + "selector": { + "matchLabels": { + "app.kubernetes.io/name": "informed-decision" + } + }, + "strategy": { + "type": "Recreate" + }, + "template": { + "metadata": { + "annotations": { + "informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover" + }, + "labels": { + "app.kubernetes.io/component": "review", + "app.kubernetes.io/name": "informed-decision" + } + }, + "spec": { + "automountServiceAccountToken": false, + "containers": [ + { + "env": [ + { + "name": "INFD_KEYCAPE_ISSUER", + "value": "https://kc.coulomb.social" + }, + { + "name": "INFD_CONTAINER_CONFIG", + "value": "/configuration/runtime.json" + } + ], + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23", + "imagePullPolicy": "IfNotPresent", + "livenessProbe": { + "failureThreshold": 3, + "httpGet": { + "path": "/healthz", + "port": "http", + "scheme": "HTTP" + }, + "periodSeconds": 10, + "successThreshold": 1, + "timeoutSeconds": 2 + }, + "name": "informed-decision", + "ports": [ + { + "containerPort": 8080, + "name": "http", + "protocol": "TCP" + }, + { + "containerPort": 8081, + "name": "workload", + "protocol": "TCP" + } + ], + "readinessProbe": { + "failureThreshold": 3, + "httpGet": { + "path": "/healthz", + "port": "http", + "scheme": "HTTP" + }, + "periodSeconds": 10, + "successThreshold": 1, + "timeoutSeconds": 2 + }, + "resources": { + "limits": { + "cpu": "500m", + "memory": "256Mi" + }, + "requests": { + "cpu": "5m", + "memory": "64Mi" + } + }, + "securityContext": { + "allowPrivilegeEscalation": false, + "capabilities": { + "drop": [ + "ALL" + ] + }, + "readOnlyRootFilesystem": true + }, + "startupProbe": { + "failureThreshold": 12, + "httpGet": { + "path": "/healthz", + "port": "http", + "scheme": "HTTP" + }, + "periodSeconds": 10, + "successThreshold": 1, + "timeoutSeconds": 2 + }, + "terminationMessagePath": "/dev/termination-log", + "terminationMessagePolicy": "File", + "volumeMounts": [ + { + "mountPath": "/data", + "name": "data" + }, + { + "mountPath": "/run/informed-decision", + "name": "runtime" + }, + { + "mountPath": "/tmp", + "name": "tmp" + }, + { + "mountPath": "/configuration", + "name": "configuration", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/policy", + "name": "caller", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/audit", + "name": "audit", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/kubernetes", + "name": "kubernetes-api", + "readOnly": true + }, + { + "mountPath": "/workload-registry", + "name": "workload-registry", + "readOnly": true + }, + { + "mountPath": "/var/run/secrets/informed-decision/requester", + "name": "sitting-requester", + "readOnly": true + } + ] + } + ], + "dnsPolicy": "ClusterFirst", + "restartPolicy": "Always", + "schedulerName": "default-scheduler", + "securityContext": { + "fsGroup": 10001, + "fsGroupChangePolicy": "OnRootMismatch", + "runAsGroup": 10001, + "runAsNonRoot": true, + "runAsUser": 10001, + "seccompProfile": { + "type": "RuntimeDefault" + } + }, + "serviceAccount": "review", + "serviceAccountName": "review", + "terminationGracePeriodSeconds": 45, + "volumes": [ + { + "name": "data", + "persistentVolumeClaim": { + "claimName": "informed-decision-data" + } + }, + { + "emptyDir": { + "medium": "Memory", + "sizeLimit": "16Mi" + }, + "name": "runtime" + }, + { + "emptyDir": { + "medium": "Memory", + "sizeLimit": "16Mi" + }, + "name": "tmp" + }, + { + "configMap": { + "defaultMode": 292, + "name": "informed-decision-runtime-6c221878d051" + }, + "name": "configuration" + }, + { + "name": "caller", + "projected": { + "defaultMode": 288, + "sources": [ + { + "serviceAccountToken": { + "audience": "flex-auth", + "expirationSeconds": 3600, + "path": "token" + } + } + ] + } + }, + { + "name": "audit", + "secret": { + "defaultMode": 288, + "items": [ + { + "key": "token", + "path": "token" + } + ], + "secretName": "informed-decision-audit" + } + }, + { + "name": "kubernetes-api", + "projected": { + "defaultMode": 288, + "sources": [ + { + "serviceAccountToken": { + "expirationSeconds": 600, + "path": "token" + } + }, + { + "configMap": { + "items": [ + { + "key": "ca.crt", + "path": "ca.crt" + } + ], + "name": "kube-root-ca.crt" + } + } + ] + } + }, + { + "configMap": { + "defaultMode": 292, + "name": "informed-decision-workload-registry" + }, + "name": "workload-registry" + }, + { + "name": "sitting-requester", + "secret": { + "defaultMode": 288, + "items": [ + { + "key": "client-secret", + "path": "client-secret" + } + ], + "optional": false, + "secretName": "informed-decision-sitting-requester" + } + } + ] + } + } + } + }, + "sealed_dependencies": { + "configmap": { + "apiVersion": "v1", + "immutable": true, + "kind": "ConfigMap", + "metadata": { + "annotations": { + "argocd.argoproj.io/tracking-id": "informed-decision:/ConfigMap:informed-decision/informed-decision-runtime-6c221878d051", + "informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover" + }, + "name": "informed-decision-runtime-6c221878d051", + "namespace": "informed-decision", + "uid": "90113d2d-54d9-4e82-b1d3-90b49ebed2b5" + }, + "canonical_data_sha256": "8ec462d12347548f506eeebf1e3c7cc47648019c8a783804d09bcc79b0f22af6" + }, + "pvc": { + "apiVersion": "v1", + "kind": "PersistentVolumeClaim", + "metadata": { + "annotations": { + "argocd.argoproj.io/tracking-id": "informed-decision:/PersistentVolumeClaim:informed-decision/informed-decision-data", + "informed-decision.coulomb.social/admission": "approved; INFD-WP-0007 cutover", + "pv.kubernetes.io/bind-completed": "yes", + "pv.kubernetes.io/bound-by-controller": "yes", + "volume.beta.kubernetes.io/storage-provisioner": "rancher.io/local-path", + "volume.kubernetes.io/selected-node": "239.62.205.92.host.secureserver.net", + "volume.kubernetes.io/storage-provisioner": "rancher.io/local-path" + }, + "finalizers": [ + "kubernetes.io/pvc-protection" + ], + "name": "informed-decision-data", + "namespace": "informed-decision", + "uid": "d80b25b1-141a-441b-b205-98fa2fd98b7c" + }, + "spec": { + "accessModes": [ + "ReadWriteOnce" + ], + "resources": { + "requests": { + "storage": "1Gi" + } + }, + "storageClassName": "local-path", + "volumeMode": "Filesystem", + "volumeName": "pvc-d80b25b1-141a-441b-b205-98fa2fd98b7c" + } + }, + "pvc_phase": "Bound" + }, + "argo": { + "uid": "499868f2-eabc-4df4-ae31-b89ce58d750d", + "source": { + "path": "deploy/lifecycle", + "repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git", + "targetRevision": "c96b0c6d881e855d1d158003c6de90ef390262e2" + }, + "destination": { + "namespace": "informed-decision", + "server": "https://kubernetes.default.svc" + }, + "automated": false, + "health": { + "lastTransitionTime": "2026-10-11T07:00:42Z", + "status": "Healthy" + }, + "sync": { + "comparedTo": { + "destination": { + "namespace": "informed-decision", + "server": "https://kubernetes.default.svc" + }, + "source": { + "path": "deploy/lifecycle", + "repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git", + "targetRevision": "c96b0c6d881e855d1d158003c6de90ef390262e2" + } + }, + "revision": "c96b0c6d881e855d1d158003c6de90ef390262e2", + "status": "OutOfSync" + } + }, + "server_dry_run_passed": true, + "admission_only_image_delta": true, + "client_diff_exit": 1, + "client_diff_sha256": "ee53537b71df69ea1ce4a67498a47524d1aef87aa5ad1e9499c3f699f142762e", + "allocatable_cpu_m": 4000, + "requested_cpu_m": 3460, + "strategy": "Recreate" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/canonical-provider-verification.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/canonical-provider-verification.json new file mode 100644 index 00000000..3b57f955 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/canonical-provider-verification.json @@ -0,0 +1,48 @@ +{ + "before": { + "all_checks_pass": true, + "observed_at": "2026-10-11T11:20:14.889361+00:00", + "deployment_uid": "a588e10a-90d2-4883-975e-6dd8b8feca92", + "generation": 26, + "ready_replicas": 1, + "pod_name": "informed-decision-68d5f488d8-c576r", + "pod_uid": "1153f806-1e05-4596-baf3-a4fa8adf08be", + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23", + "image_id": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23", + "application_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "application_health": "Healthy", + "native_data_change": false + }, + "native_provider": { + "request_memo_id": "infd-20261011-zlib-remediation-r1", + "request_memo_version": 1, + "request_identity_source": "fixed-authenticated-route", + "has_review": true, + "disposition_count": 1, + "dispositions_interpreted": false, + "approval_inferred": false, + "current_approval_claimed": false, + "http_status": 200, + "observed_at": "2026-10-11T11:20:25.876927+00:00", + "native_authenticated_canonical_lifecycle_outcomes": true, + "native_provider_path_returned": true, + "credential_material_output": false + }, + "after": { + "all_checks_pass": true, + "observed_at": "2026-10-11T11:20:27.541827+00:00", + "deployment_uid": "a588e10a-90d2-4883-975e-6dd8b8feca92", + "generation": 26, + "ready_replicas": 1, + "pod_name": "informed-decision-68d5f488d8-c576r", + "pod_uid": "1153f806-1e05-4596-baf3-a4fa8adf08be", + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23", + "image_id": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23", + "application_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "application_health": "Healthy", + "native_data_change": false + }, + "provider_command_sha256": "ddfe2619f4847238fe79ec779a15b0d8df5d178cbed989ac2d73c1480b57a706", + "founder_approval_inferred": false, + "protected_database_contents_exported": false +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/cleanup-offline.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/cleanup-offline.json new file mode 100644 index 00000000..113769ab --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/cleanup-offline.json @@ -0,0 +1,5 @@ +{ + "all_checks_pass": true, + "only_disposable_offline_volume_removed": "infd-zlib-r1-restore-20261011", + "native_and_offcluster_original_snapshots_retained": true +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/confirmed-root-authority.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/confirmed-root-authority.json new file mode 100644 index 00000000..f88d0740 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/confirmed-root-authority.json @@ -0,0 +1,23 @@ +{ + "proposal_id": "INFD-WP-0009-T05/zlib85091-r1", + "memo_id": "infd-20261011-zlib-remediation-r1", + "memo_version": 1, + "memo_sha256": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206", + "source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "executor_plan_sha256": "d871081999215bd3850ab1173064ed6cb6d7c23b26d9c3d5b3c5940e698d4c61", + "native_outcome_sha256": "7cd00372d1a7c4fb4dc92e2c550d8d4c586f96cda3aecec8016a883370893c86", + "activation": "APPROVED", + "authority_mode": "ADMINISTER", + "target": "realm:kubernetes/railiance01/informed-decision", + "verification_method": "root-fixed-origin-native-readback", + "runtime_authenticated_grant": false, + "outcome_query": "/lifecycle/memos/infd-20261011-zlib-remediation-r1/outcomes?version=1", + "verified_at": "2026-10-11T11:19:17.592644+00:00", + "review_memo_id": "review-2cf690a6-8c46-4faa-826c-a24a88d53dea", + "approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c", + "disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f", + "accepted_at": "2026-10-11T10:40:55Z", + "bounded_outage_rollback_pre_authorized": true, + "note": "Template is not evidence/approval. Root sets scopedpreauthorizationtrue only after actual confirmed founder acceptance of this exact new packet/terms, retains original currentreadback before release.", + "native_observed_at": "2026-10-11T11:19:18.476232+00:00" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/cutover-backup.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/cutover-backup.json new file mode 100644 index 00000000..56f1eb0e --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/cutover-backup.json @@ -0,0 +1,53 @@ +{ + "phase": "cutover-backup", + "all_checks_pass": true, + "raw_output_withheld": true, + "native_approval_verified_by_root": { + "approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c", + "disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f", + "accepted_at": "2026-10-11T10:40:55Z", + "verified_at": "2026-10-11T11:17:33.972874+00:00" + }, + "native_authenticated_grant": false, + "source_readonly_baseline": { + "schema_version": 5, + "lifecycle": { + "records": 17, + "events": 59, + "pending": 0 + }, + "outbox": { + "delivered": 344 + }, + "submissions": { + "confirmed": 44 + }, + "integrity": "ok", + "read_only_pre_open": true, + "store_constructed": false + }, + "snapshot_readonly": { + "schema_version": 5, + "lifecycle": { + "records": 17, + "events": 59, + "pending": 0 + }, + "outbox": { + "delivered": 344 + }, + "submissions": { + "confirmed": 44 + }, + "integrity": "ok", + "read_only_pre_open": true, + "store_constructed": false + }, + "snapshot_sha256": "e0bac513f7445bf702c504ec7c15a1eb277ed7a48529099437d0dd63cf0679bb", + "snapshot_bytes": 23347200, + "snapshot_file": "cutover.sqlite", + "native_parent_private": true, + "native_uid": 10001, + "pod_name": "informed-decision-5557446c88-lvm88", + "pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/cutover-copy.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/cutover-copy.json new file mode 100644 index 00000000..59a6882d --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/cutover-copy.json @@ -0,0 +1,36 @@ +{ + "phase": "cutover-copy", + "all_checks_pass": true, + "raw_output_withheld": true, + "native_approval_verified_by_root": { + "approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c", + "disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f", + "accepted_at": "2026-10-11T10:40:55Z", + "verified_at": "2026-10-11T11:18:05.531924+00:00" + }, + "native_authenticated_grant": false, + "snapshot_file": "cutover.sqlite", + "snapshot_bytes": 23347200, + "snapshot_sha256": "e0bac513f7445bf702c504ec7c15a1eb277ed7a48529099437d0dd63cf0679bb", + "snapshot_readonly": { + "schema_version": 5, + "lifecycle": { + "records": 17, + "events": 59, + "pending": 0 + }, + "outbox": { + "delivered": 344 + }, + "submissions": { + "confirmed": 44 + }, + "integrity": "ok", + "read_only_pre_open": true, + "store_constructed": false + }, + "pod_name": "informed-decision-5557446c88-lvm88", + "pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662", + "off_cluster_private_copy_verified": true, + "snapshot_contents_output": false +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/drill-backup.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/drill-backup.json new file mode 100644 index 00000000..5370dca1 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/drill-backup.json @@ -0,0 +1,53 @@ +{ + "phase": "drill-backup", + "all_checks_pass": true, + "raw_output_withheld": true, + "native_approval_verified_by_root": { + "approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c", + "disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f", + "accepted_at": "2026-10-11T10:40:55Z", + "verified_at": "2026-10-11T11:11:32.769166+00:00" + }, + "native_authenticated_grant": false, + "source_readonly_baseline": { + "schema_version": 5, + "lifecycle": { + "records": 17, + "events": 59, + "pending": 0 + }, + "outbox": { + "delivered": 344 + }, + "submissions": { + "confirmed": 44 + }, + "integrity": "ok", + "read_only_pre_open": true, + "store_constructed": false + }, + "snapshot_readonly": { + "schema_version": 5, + "lifecycle": { + "records": 17, + "events": 59, + "pending": 0 + }, + "outbox": { + "delivered": 344 + }, + "submissions": { + "confirmed": 44 + }, + "integrity": "ok", + "read_only_pre_open": true, + "store_constructed": false + }, + "snapshot_sha256": "97d7dfb8fce4f720456468ff169f5e2b2bcb1edc328687b1a6c1225b66f2b0ba", + "snapshot_bytes": 23330816, + "snapshot_file": "drill.sqlite", + "native_parent_private": true, + "native_uid": 10001, + "pod_name": "informed-decision-5557446c88-lvm88", + "pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/drill-copy.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/drill-copy.json new file mode 100644 index 00000000..caa20f22 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/drill-copy.json @@ -0,0 +1,36 @@ +{ + "phase": "drill-copy", + "all_checks_pass": true, + "raw_output_withheld": true, + "native_approval_verified_by_root": { + "approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c", + "disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f", + "accepted_at": "2026-10-11T10:40:55Z", + "verified_at": "2026-10-11T11:12:17.399753+00:00" + }, + "native_authenticated_grant": false, + "snapshot_file": "drill.sqlite", + "snapshot_bytes": 23330816, + "snapshot_sha256": "97d7dfb8fce4f720456468ff169f5e2b2bcb1edc328687b1a6c1225b66f2b0ba", + "snapshot_readonly": { + "schema_version": 5, + "lifecycle": { + "records": 17, + "events": 59, + "pending": 0 + }, + "outbox": { + "delivered": 344 + }, + "submissions": { + "confirmed": 44 + }, + "integrity": "ok", + "read_only_pre_open": true, + "store_constructed": false + }, + "pod_name": "informed-decision-5557446c88-lvm88", + "pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662", + "off_cluster_private_copy_verified": true, + "snapshot_contents_output": false +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/fresh-scan-full.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/fresh-scan-full.json new file mode 100644 index 00000000..8c02213d --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/fresh-scan-full.json @@ -0,0 +1,2338 @@ +{ + "SchemaVersion": 2, + "Trivy": { + "Version": "0.74.0" + }, + "ReportID": "01a12a94-4912-7435-81dc-e54820845251", + "CreatedAt": "2026-10-11T10:48:43.538280566Z", + "ArtifactID": "sha256:622becc3ebd97cb66b6e7c36f35bf931a7decd9464b65851123c1cc8c998d75b", + "ArtifactName": "/artifact/image.tar", + "ArtifactType": "container_image", + "Metadata": { + "Size": 89032704, + "OS": { + "Family": "alpine", + "Name": "3.24.1" + }, + "ImageID": "sha256:622becc3ebd97cb66b6e7c36f35bf931a7decd9464b65851123c1cc8c998d75b", + "DiffIDs": [ + "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c", + "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd", + "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366", + "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe", + "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1", + "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c", + "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59", + "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02", + "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3", + "sha256:115811e30e0bde3e5a482191a32028a4323bacde928f17e808760ad2899407d6", + "sha256:08f4420173dc9f73d520ab9f1a08adeb802ab64d1e1a2f419af11ba2302b05ea" + ], + "ImageConfig": { + "architecture": "amd64", + "container": "21ba693e742e213525b526f83be1ea03cfbd875a87b6bce473e01fb8c38a5b91", + "created": "2026-10-11T09:37:06.27375084Z", + "docker_version": "27.5.1", + "history": [ + { + "created": "2026-06-16T00:01:29.967161902Z", + "created_by": "ADD alpine-minirootfs-3.24.1-x86_64.tar.gz / # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-06-16T00:01:29.967161902Z", + "created_by": "CMD [\"/bin/sh\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV LANG=C.UTF-8", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "RUN /bin/sh -c set -eux; \tapk add --no-cache \t\tca-certificates \t\ttzdata \t; # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PYTHON_VERSION=3.12.14", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:05:24.224544843Z", + "created_by": "ENV PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-01T00:10:30.672225972Z", + "created_by": "RUN /bin/sh -c set -eux; \t\tapk add --no-cache --virtual .build-deps \t\tbluez-dev \t\tbzip2-dev \t\tdpkg-dev dpkg \t\tfindutils \t\tg++ \t\tgcc \t\tgdbm-dev \t\tgnupg \t\tlibc-dev \t\tlibffi-dev \t\tlibnsl-dev \t\tlibtirpc-dev \t\tlinux-headers \t\tmake \t\tncurses-dev \t\topenssl-dev \t\tpax-utils \t\treadline-dev \t\tsqlite-dev \t\ttar \t\ttcl-dev \t\ttk \t\ttk-dev \t\tutil-linux-dev \t\txz \t\txz-dev \t\tzlib-dev \t; \t\twget -O python.tar.xz \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz\"; \techo \"$PYTHON_SHA256 *python.tar.xz\" | sha256sum -c -; \twget -O python.tar.xz.asc \"https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc\"; \tGNUPGHOME=\"$(mktemp -d)\"; export GNUPGHOME; \tgpg --batch --keyserver hkps://keys.openpgp.org --recv-keys \"$GPG_KEY\"; \tgpg --batch --verify python.tar.xz.asc python.tar.xz; \tgpgconf --kill all; \trm -rf \"$GNUPGHOME\" python.tar.xz.asc; \tmkdir -p /usr/src/python; \ttar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; \trm python.tar.xz; \t\tcd /usr/src/python; \tgnuArch=\"$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)\"; \t./configure \t\t--build=\"$gnuArch\" \t\t--enable-loadable-sqlite-extensions \t\t--enable-option-checking=fatal \t\t--enable-shared \t\t$(test \"${gnuArch%%-*}\" != 'riscv64' \u0026\u0026 echo '--with-lto') \t\t--with-ensurepip \t; \tnproc=\"$(nproc)\"; \tEXTRA_CFLAGS=\"-DTHREAD_STACK_SIZE=0x100000\"; \tLDFLAGS=\"${LDFLAGS:-} -Wl,--strip-all\"; \tarch=\"$(apk --print-arch)\"; \tcase \"$arch\" in \t\tx86_64|aarch64) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer\"; \t\t\t;; \t\tx86) \t\t\t;; \t\t*) \t\t\tEXTRA_CFLAGS=\"${EXTRA_CFLAGS:-} -fno-omit-frame-pointer\"; \t\t\t;; \tesac; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-}\" \t; \trm python; \tmake -j \"$nproc\" \t\t\"EXTRA_CFLAGS=${EXTRA_CFLAGS:-}\" \t\t\"LDFLAGS=${LDFLAGS:-} -Wl,-rpath='\\$\\$ORIGIN/../lib'\" \t\tpython \t; \tmake install; \t\tcd /; \trm -rf /usr/src/python; \t\tfind /usr/local -depth \t\t\\( \t\t\t\\( -type d -a \\( -name test -o -name tests -o -name idle_test \\) \\) \t\t\t-o \\( -type f -a \\( -name '*.pyc' -o -name '*.pyo' -o -name 'libpython*.a' \\) \\) \t\t\\) -exec rm -rf '{}' + \t; \t\tfind /usr/local -type f -executable -not \\( -name '*tkinter*' \\) -exec scanelf --needed --nobanner --format '%n#p' '{}' ';' \t\t| tr ',' '\\n' \t\t| sort -u \t\t| awk 'system(\"[ -e /usr/local/lib/\" $1 \" ]\") == 0 { next } { print \"so:\" $1 }' \t\t| xargs -rt apk add --no-network --virtual .python-rundeps \t; \tapk del --no-network .build-deps; \t\texport PYTHONDONTWRITEBYTECODE=1; \tpython3 --version; \tpip3 --version # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:10:30.782726003Z", + "created_by": "RUN /bin/sh -c set -eux; \tfor src in idle3 pip3 pydoc3 python3 python3-config; do \t\tdst=\"$(echo \"$src\" | tr -d 3)\"; \t\t[ -s \"/usr/local/bin/$src\" ]; \t\t[ ! -e \"/usr/local/bin/$dst\" ]; \t\tln -svT \"$src\" \"/usr/local/bin/$dst\"; \tdone # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-09-01T00:10:30.782726003Z", + "created_by": "CMD [\"python3\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-11T00:49:47.962156876+02:00", + "created_by": "ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-09-11T00:49:47.962156876+02:00", + "created_by": "RUN /bin/sh -c apk add --no-cache 'libuuid\u003e=2.42.3-r1' \u0026\u0026 addgroup -S -g 10001 informed \u0026\u0026 adduser -S -u 10001 -G informed -H informed # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:55.351944978+02:00", + "created_by": "COPY /opt/venv /opt/venv # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.462092072+02:00", + "created_by": "RUN /bin/sh -c rm -rf /usr/local/bin/pip* /usr/local/lib/python3.12/site-packages/pip* /usr/local/lib/python3.12/site-packages/setuptools* /usr/local/lib/python3.12/site-packages/pkg_resources /opt/venv/bin/pip* /opt/venv/lib/python3.12/site-packages/pip* /opt/venv/lib/python3.12/site-packages/setuptools* /opt/venv/lib/python3.12/site-packages/pkg_resources # buildkit", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "WORKDIR /app", + "comment": "buildkit.dockerfile.v0" + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "USER 10001:10001", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "EXPOSE [8080/tcp 8081/tcp]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-05T01:03:56.675216821+02:00", + "created_by": "ENTRYPOINT [\"informed-decision-container\"]", + "comment": "buildkit.dockerfile.v0", + "empty_layer": true + }, + { + "created": "2026-10-11T01:15:11.991443676Z", + "created_by": "/bin/sh -c #(nop) ARG SOURCE_REVISION", + "empty_layer": true + }, + { + "created": "2026-10-11T01:21:04.716126392Z", + "created_by": "/bin/sh -c #(nop) LABEL org.opencontainers.image.revision=3e4bcb26f8eeaa8c64345c565477b5ac8ccbb168 org.opencontainers.image.base.digest=sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173 social.coulomb.source.policy.sha256=9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62 social.coulomb.release.scope=INFD-WP-0009-T04/purpose-overlay-v1", + "empty_layer": true + }, + { + "created": "2026-10-11T01:21:04.787527697Z", + "created_by": "/bin/sh -c #(nop) COPY file:2be9cb36e7253e15733673359cda8caa22986b6888822a008c1b360d909994e0 in /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py " + }, + { + "created": "2026-10-11T09:37:05.094824861Z", + "created_by": "/bin/sh -c #(nop) ARG SOURCE_REVISION=uncommitted-T05-local-preparation", + "empty_layer": true + }, + { + "created": "2026-10-11T09:37:05.210154454Z", + "created_by": "/bin/sh -c #(nop) ARG SOURCE_CONTEXT_SHA256", + "empty_layer": true + }, + { + "created": "2026-10-11T09:37:05.349758525Z", + "created_by": "/bin/sh -c #(nop) USER 0:0", + "empty_layer": true + }, + { + "created": "2026-10-11T09:37:05.460271111Z", + "created_by": "/bin/sh -c #(nop) COPY multi:e4d183fdf93ea6320911bb7398e4860a1b9b96fe0768cfd3d0260955517dd272 in /tmp/infd-zlib/x86_64/ " + }, + { + "created": "2026-10-11T09:37:06.14850806Z", + "created_by": "|2 SOURCE_CONTEXT_SHA256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d SOURCE_REVISION=9b4bb25d325698ae543e7e8a8a3c3592db1f58fc /bin/sh -c echo '63aeea03c15a2f9018f81805cfc8aa926bdf5cd68921f22149c2fbb5d0ee9f47 /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk' | sha256sum -c - \u0026\u0026 echo '24fc2ccb08f3125429a38b31bd6c76a7b394c6236df0975760dc8259e50dfbd5 /tmp/infd-zlib/x86_64/APKINDEX.tar.gz' | sha256sum -c - \u0026\u0026 apk verify /tmp/infd-zlib/x86_64/zlib-1.3.2-r1.apk /tmp/infd-zlib/x86_64/APKINDEX.tar.gz \u0026\u0026 apk upgrade --no-logfile --no-network --no-cache --no-preupgrade --repositories-file /dev/null --repository /tmp/infd-zlib zlib \u0026\u0026 apk info --exists 'zlib=1.3.2-r1' \u0026\u0026 rm -rf /tmp/infd-zlib" + }, + { + "created": "2026-10-11T09:37:06.218269088Z", + "created_by": "/bin/sh -c #(nop) USER 10001:10001", + "empty_layer": true + }, + { + "created": "2026-10-11T09:37:06.27375084Z", + "created_by": "/bin/sh -c #(nop) LABEL org.opencontainers.image.revision=9b4bb25d325698ae543e7e8a8a3c3592db1f58fc org.opencontainers.image.base.digest=sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a social.coulomb.source.context.sha256=c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d social.coulomb.source.policy.sha256=9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62 social.coulomb.release.scope=INFD-WP-0009-T05/zlib-85091-r1", + "empty_layer": true + } + ], + "os": "linux", + "rootfs": { + "type": "layers", + "diff_ids": [ + "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c", + "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd", + "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366", + "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe", + "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1", + "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c", + "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59", + "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02", + "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3", + "sha256:115811e30e0bde3e5a482191a32028a4323bacde928f17e808760ad2899407d6", + "sha256:08f4420173dc9f73d520ab9f1a08adeb802ab64d1e1a2f419af11ba2302b05ea" + ] + }, + "config": { + "Entrypoint": [ + "informed-decision-container" + ], + "Env": [ + "PATH=/opt/venv/bin:/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "LANG=C.UTF-8", + "GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305", + "PYTHON_VERSION=3.12.14", + "PYTHON_SHA256=5c8462af5790baf43a321a1559dbe0db06d1be4300fb85fb53c40060668e548a", + "PYTHONDONTWRITEBYTECODE=1", + "PYTHONUNBUFFERED=1" + ], + "Image": "sha256:b0f10723d8eb4962d7eb1a0cc1d1b24c3113d1f67576916d85080f2f2d46c2e7", + "Labels": { + "org.opencontainers.image.base.digest": "sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a", + "org.opencontainers.image.revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc", + "social.coulomb.release.scope": "INFD-WP-0009-T05/zlib-85091-r1", + "social.coulomb.source.context.sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d", + "social.coulomb.source.policy.sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62" + }, + "User": "10001:10001", + "WorkingDir": "/app", + "ExposedPorts": { + "8080/tcp": {}, + "8081/tcp": {} + } + } + }, + "Layers": [ + { + "Size": 8697856, + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + { + "Size": 1538048, + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + { + "Size": 47150592, + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + { + "Size": 5120, + "DiffID": "sha256:4098ad033525263f92a8a9c51865596025d47018e078c0b1f7d9cd5663fc1ffe" + }, + { + "Size": 131584, + "DiffID": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + { + "Size": 30705664, + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + { + "Size": 12288, + "DiffID": "sha256:361430a1113969743b99e237b20f023d5497493bcf96fb91af99ac0a0dbc4a59" + }, + { + "Size": 1536, + "DiffID": "sha256:cfc5939674d67f60b4411c24dfcde5622b712eeb7376cd0941a2751da80a6b02" + }, + { + "Size": 15360, + "DiffID": "sha256:21ff9188cb29ca95fe9be11355f70ab5586e8499e33b52a253d953fb3b75aea3" + }, + { + "Size": 588288, + "DiffID": "sha256:115811e30e0bde3e5a482191a32028a4323bacde928f17e808760ad2899407d6" + }, + { + "Size": 186368, + "DiffID": "sha256:08f4420173dc9f73d520ab9f1a08adeb802ab64d1e1a2f419af11ba2302b05ea" + } + ] + }, + "Results": [ + { + "Target": "/artifact/image.tar (alpine 3.24.1)", + "Class": "os-pkgs", + "Type": "alpine", + "Packages": [ + { + "ID": ".python-rundeps@20260901.001029", + "Name": ".python-rundeps", + "Identifier": { + "PURL": "pkg:apk/alpine/.python-rundeps@20260901.001029?arch=noarch\u0026distro=3.24.1", + "UID": "62fa84f88695c077" + }, + "Version": "20260901.001029", + "Arch": "noarch", + "DependsOn": [ + "gdbm@1.26-r0", + "libbz2@1.0.8-r6", + "libcrypto3@3.5.8-r0", + "libffi@3.5.2-r1", + "libncursesw@6.6_p20260516-r0", + "libnsl@2.0.1-r2", + "libpanelw@6.6_p20260516-r0", + "libssl3@3.5.8-r0", + "libtirpc@1.3.5-r1", + "libuuid@2.42.3-r1", + "musl@1.2.6-r2", + "readline@8.3.3-r1", + "sqlite-libs@3.53.4-r0", + "xz-libs@5.8.3-r0", + "zlib@1.3.2-r1" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:51d0c1e7d88a414345799f0309185c625013ef32", + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-baselayout@3.7.2-r1", + "Name": "alpine-baselayout", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "1b9c543300f8073e" + }, + "Version": "3.7.2-r1", + "Arch": "x86_64", + "SrcName": "alpine-baselayout", + "SrcVersion": "3.7.2-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "alpine-baselayout-data@3.7.2-r1", + "busybox-binsh@1.37.0-r31" + ], + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:f0fcfdc2f4da058af6473bc45c4eab62916225b2", + "InstalledFiles": [ + "etc/motd", + "etc/crontabs/root", + "etc/modprobe.d/aliases.conf", + "etc/modprobe.d/blacklist.conf", + "etc/modprobe.d/i386.conf", + "etc/profile.d/20locale.sh", + "etc/profile.d/README", + "etc/profile.d/color_prompt.sh.disabled", + "usr/lib/sysctl.d/00-alpine.conf", + "var/lock", + "var/run", + "var/spool/mail", + "var/spool/cron/crontabs" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-baselayout-data@3.7.2-r1", + "Name": "alpine-baselayout-data", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "fcc3cd90122d8aa7" + }, + "Version": "3.7.2-r1", + "Arch": "x86_64", + "SrcName": "alpine-baselayout", + "SrcVersion": "3.7.2-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c6f9bded17d844b6f1b0bb5766d2c35c0d5c8508", + "InstalledFiles": [ + "etc/fstab", + "etc/group", + "etc/hostname", + "etc/hosts", + "etc/inittab", + "etc/modules", + "etc/mtab", + "etc/nsswitch.conf", + "etc/passwd", + "etc/profile", + "etc/protocols", + "etc/services", + "etc/shadow", + "etc/shells", + "etc/sysctl.conf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-keys@2.6-r0", + "Name": "alpine-keys", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "cb1f6c8fa74713e0" + }, + "Version": "2.6-r0", + "Arch": "x86_64", + "SrcName": "alpine-keys", + "SrcVersion": "2.6-r0", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:d8d6b80e53c059a77e4915da78ba964f3ffea240", + "InstalledFiles": [ + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", + "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", + "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", + "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", + "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", + "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", + "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", + "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", + "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", + "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", + "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", + "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", + "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", + "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", + "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", + "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", + "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "alpine-release@3.24.1-r0", + "Name": "alpine-release", + "Identifier": { + "PURL": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "6cfad6f36e1f31aa" + }, + "Version": "3.24.1-r0", + "Arch": "x86_64", + "SrcName": "alpine-base", + "SrcVersion": "3.24.1-r0", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "alpine-keys@2.6-r0" + ], + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:bc6912a25cdc7733e0035ed509eceaa4026946e3", + "InstalledFiles": [ + "etc/alpine-release", + "etc/issue", + "etc/os-release", + "etc/secfixes.d/alpine", + "usr/lib/os-release" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "apk-tools@3.0.6-r0", + "Name": "apk-tools", + "Identifier": { + "PURL": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "b37730591f24ae44" + }, + "Version": "3.0.6-r0", + "Arch": "x86_64", + "SrcName": "apk-tools", + "SrcVersion": "3.0.6-r0", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "ca-certificates-bundle@20260611-r0", + "libapk@3.0.6-r0", + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2", + "zlib@1.3.2-r1" + ], + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:043333589798a1f52e09ae63f026c6c8fa676d34", + "InstalledFiles": [ + "sbin/apk" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "busybox@1.37.0-r31", + "Name": "busybox", + "Identifier": { + "PURL": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "771020c43c8440bf" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:b5405ebc02f7dd8be95b6265c54b243d5456ab8f", + "InstalledFiles": [ + "bin/busybox", + "etc/securetty", + "etc/busybox-paths.d/busybox", + "etc/logrotate.d/acpid", + "etc/network/if-up.d/dad", + "etc/udhcpc/udhcpc.conf", + "usr/share/udhcpc/default.script" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "busybox-binsh@1.37.0-r31", + "Name": "busybox-binsh", + "Identifier": { + "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "1ec8a3d5d2b63297" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "busybox@1.37.0-r31" + ], + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:5cbd14acc6f1804c5bac6c77dc2c492f010b0fc7", + "InstalledFiles": [ + "bin/sh" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ca-certificates@20260611-r0", + "Name": "ca-certificates", + "Identifier": { + "PURL": "pkg:apk/alpine/ca-certificates@20260611-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "2a3c316ee83c6198" + }, + "Version": "20260611-r0", + "Arch": "x86_64", + "SrcName": "ca-certificates", + "SrcVersion": "20260611-r0", + "Licenses": [ + "MPL-2.0", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "busybox-binsh@1.37.0-r31", + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + "Digest": "sha1:8f2a04abeb54b331e2970a0a0dffb7bd6bdde567", + "InstalledFiles": [ + "etc/ca-certificates.conf", + "etc/apk/protected_paths.d/ca-certificates.list", + "etc/ca-certificates/update.d/certhash", + "usr/bin/c_rehash", + "usr/sbin/update-ca-certificates", + "usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", + "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", + "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", + "usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", + "usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", + "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", + "usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", + "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", + "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", + "usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", + "usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", + "usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", + "usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", + "usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", + "usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", + "usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", + "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", + "usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", + "usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", + "usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", + "usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", + "usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", + "usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", + "usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", + "usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", + "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", + "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", + "usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", + "usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", + "usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", + "usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", + "usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", + "usr/share/ca-certificates/mozilla/Izenpe.com.crt", + "usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", + "usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", + "usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", + "usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", + "usr/share/ca-certificates/mozilla/OISTE_Server_Root_ECC_G1.crt", + "usr/share/ca-certificates/mozilla/OISTE_Server_Root_RSA_G1.crt", + "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", + "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", + "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", + "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", + "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", + "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", + "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", + "usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", + "usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", + "usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", + "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", + "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", + "usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", + "usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", + "usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", + "usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", + "usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", + "usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt", + "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", + "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", + "usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", + "usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", + "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", + "usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt", + "usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", + "usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", + "usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", + "usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", + "usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", + "usr/share/ca-certificates/mozilla/e-Szigno_TLS_Root_CA_2023.crt", + "usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", + "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", + "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", + "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", + "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", + "usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", + "usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ca-certificates-bundle@20260611-r0", + "Name": "ca-certificates-bundle", + "Identifier": { + "PURL": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "20337c2ea28bef28" + }, + "Version": "20260611-r0", + "Arch": "x86_64", + "SrcName": "ca-certificates", + "SrcVersion": "20260611-r0", + "Licenses": [ + "MPL-2.0", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c9534a03750bdfae341f10969016090fc11febbd", + "InstalledFiles": [ + "etc/ssl/cert.pem", + "etc/ssl/certs/ca-certificates.crt", + "etc/ssl1.1/cert.pem", + "etc/ssl1.1/certs" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "gdbm@1.26-r0", + "Name": "gdbm", + "Identifier": { + "PURL": "pkg:apk/alpine/gdbm@1.26-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "5eb1a3f86262ca77" + }, + "Version": "1.26-r0", + "Arch": "x86_64", + "SrcName": "gdbm", + "SrcVersion": "1.26-r0", + "Licenses": [ + "GPL-3.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:619493d8124fe49a8ee1d8f7a1372cf7e3977337", + "InstalledFiles": [ + "usr/lib/libgdbm.so.6", + "usr/lib/libgdbm.so.6.0.0", + "usr/lib/libgdbm_compat.so.4", + "usr/lib/libgdbm_compat.so.4.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "keyutils-libs@1.6.3-r4", + "Name": "keyutils-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64\u0026distro=3.24.1", + "UID": "a1a29120eb342032" + }, + "Version": "1.6.3-r4", + "Arch": "x86_64", + "SrcName": "keyutils", + "SrcVersion": "1.6.3-r4", + "Licenses": [ + "GPL-2.0-or-later", + "LGPL-2.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:b7331c96f077fc3522ee4361a441d1097204cd90", + "InstalledFiles": [ + "usr/lib/libkeyutils.so.1", + "usr/lib/libkeyutils.so.1.10" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "krb5-conf@1.0-r2", + "Name": "krb5-conf", + "Identifier": { + "PURL": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "e7cf94ba8b6dbc33" + }, + "Version": "1.0-r2", + "Arch": "x86_64", + "SrcName": "krb5-conf", + "SrcVersion": "1.0-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:40a11e0690a59e110367b62a80661024e9942a2d", + "InstalledFiles": [ + "etc/krb5.conf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "krb5-libs@1.22.2-r1", + "Name": "krb5-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/krb5-libs@1.22.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "958f8b4a4f087dac" + }, + "Version": "1.22.2-r1", + "Arch": "x86_64", + "SrcName": "krb5", + "SrcVersion": "1.22.2-r1", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "keyutils-libs@1.6.3-r4", + "krb5-conf@1.0-r2", + "libcom_err@1.47.4-r0", + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "libverto@0.3.2-r2", + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:ef02346e21b817ff379e4601e5b1fc9760e5e31a", + "InstalledFiles": [ + "usr/lib/libgssapi_krb5.so.2", + "usr/lib/libgssapi_krb5.so.2.2", + "usr/lib/libgssrpc.so.4", + "usr/lib/libgssrpc.so.4.2", + "usr/lib/libk5crypto.so.3", + "usr/lib/libk5crypto.so.3.1", + "usr/lib/libkadm5clnt_mit.so.12", + "usr/lib/libkadm5clnt_mit.so.12.0", + "usr/lib/libkadm5srv_mit.so.12", + "usr/lib/libkadm5srv_mit.so.12.0", + "usr/lib/libkdb5.so.10", + "usr/lib/libkdb5.so.10.0", + "usr/lib/libkrad.so.0", + "usr/lib/libkrad.so.0.0", + "usr/lib/libkrb5.so.3", + "usr/lib/libkrb5.so.3.3", + "usr/lib/libkrb5support.so.0", + "usr/lib/libkrb5support.so.0.1", + "usr/lib/krb5/plugins/kdb/db2.so", + "usr/lib/krb5/plugins/preauth/otp.so", + "usr/lib/krb5/plugins/preauth/spake.so", + "usr/lib/krb5/plugins/preauth/test.so", + "usr/lib/krb5/plugins/tls/k5tls.so" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libapk@3.0.6-r0", + "Name": "libapk", + "Identifier": { + "PURL": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "779641db16cf6477" + }, + "Version": "3.0.6-r0", + "Arch": "x86_64", + "SrcName": "apk-tools", + "SrcVersion": "3.0.6-r0", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "musl@1.2.6-r2", + "zlib@1.3.2-r1" + ], + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:523a8f58104589f74f743d501c81bf6517155378", + "InstalledFiles": [ + "usr/lib/libapk.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libbz2@1.0.8-r6", + "Name": "libbz2", + "Identifier": { + "PURL": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64\u0026distro=3.24.1", + "UID": "48e17539404e2d56" + }, + "Version": "1.0.8-r6", + "Arch": "x86_64", + "SrcName": "bzip2", + "SrcVersion": "1.0.8-r6", + "Licenses": [ + "bzip-2-1.0.6" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:08566ba5c7af97c25474be8b24e8b48f0116b67d", + "InstalledFiles": [ + "usr/lib/libbz2.so.1", + "usr/lib/libbz2.so.1.0.8" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libcom_err@1.47.4-r0", + "Name": "libcom_err", + "Identifier": { + "PURL": "pkg:apk/alpine/libcom_err@1.47.4-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "3fc35a3f66d192af" + }, + "Version": "1.47.4-r0", + "Arch": "x86_64", + "SrcName": "e2fsprogs", + "SrcVersion": "1.47.4-r0", + "Licenses": [ + "GPL-2.0-or-later", + "LGPL-2.0-or-later", + "BSD-3-Clause", + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:4b9fb5899ea0b1c0cfbb2a2c5952704437d4ecef", + "InstalledFiles": [ + "usr/lib/libcom_err.so.2", + "usr/lib/libcom_err.so.2.1" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libcrypto3@3.5.8-r0", + "Name": "libcrypto3", + "Identifier": { + "PURL": "pkg:apk/alpine/libcrypto3@3.5.8-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "4299bba2ba9c96aa" + }, + "Version": "3.5.8-r0", + "Arch": "x86_64", + "SrcName": "openssl", + "SrcVersion": "3.5.8-r0", + "Licenses": [ + "Apache-2.0" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:1b3b9fc0c136f4936932bcb2ec21499f0ae5dfd3", + "InstalledFiles": [ + "etc/ssl/ct_log_list.cnf", + "etc/ssl/ct_log_list.cnf.dist", + "etc/ssl/openssl.cnf", + "etc/ssl/openssl.cnf.dist", + "usr/lib/libcrypto.so.3", + "usr/lib/engines-3/afalg.so", + "usr/lib/engines-3/capi.so", + "usr/lib/engines-3/loader_attic.so", + "usr/lib/engines-3/padlock.so", + "usr/lib/ossl-modules/legacy.so" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libffi@3.5.2-r1", + "Name": "libffi", + "Identifier": { + "PURL": "pkg:apk/alpine/libffi@3.5.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "d3eaa921287b1ccd" + }, + "Version": "3.5.2-r1", + "Arch": "x86_64", + "SrcName": "libffi", + "SrcVersion": "3.5.2-r1", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:2f7b261f7fcecc4eebd8b330e7f6fb80713bfe3a", + "InstalledFiles": [ + "usr/lib/libffi.so.8", + "usr/lib/libffi.so.8.2.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libintl@1.0-r0", + "Name": "libintl", + "Identifier": { + "PURL": "pkg:apk/alpine/libintl@1.0-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "25c18808d8fc87e0" + }, + "Version": "1.0-r0", + "Arch": "x86_64", + "SrcName": "gettext", + "SrcVersion": "1.0-r0", + "Licenses": [ + "LGPL-2.1-or-later" + ], + "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:282d6642ccac87237e43a864159d73cf5abe7550", + "InstalledFiles": [ + "usr/lib/libintl.so.8", + "usr/lib/libintl.so.8.4.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libncursesw@6.6_p20260516-r0", + "Name": "libncursesw", + "Identifier": { + "PURL": "pkg:apk/alpine/libncursesw@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e8939f45e2191bcc" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "DependsOn": [ + "musl@1.2.6-r2", + "ncurses-terminfo-base@6.6_p20260516-r0" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:9f318e6e324d6827274829194cf6ac6afbaded12", + "InstalledFiles": [ + "usr/lib/libncursesw.so.6", + "usr/lib/libncursesw.so.6.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libnsl@2.0.1-r2", + "Name": "libnsl", + "Identifier": { + "PURL": "pkg:apk/alpine/libnsl@2.0.1-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "3d893c60d41da67b" + }, + "Version": "2.0.1-r2", + "Arch": "x86_64", + "SrcName": "libnsl", + "SrcVersion": "2.0.1-r2", + "Licenses": [ + "LGPL-2.0-or-later" + ], + "DependsOn": [ + "libintl@1.0-r0", + "libtirpc@1.3.5-r1", + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:5194adbf26560b52be318481a7af294ab05fd795", + "InstalledFiles": [ + "usr/lib/libnsl.so.3", + "usr/lib/libnsl.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libpanelw@6.6_p20260516-r0", + "Name": "libpanelw", + "Identifier": { + "PURL": "pkg:apk/alpine/libpanelw@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "ef1ad9bb256b373" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "DependsOn": [ + "libncursesw@6.6_p20260516-r0", + "musl@1.2.6-r2", + "ncurses-terminfo-base@6.6_p20260516-r0" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:149bdc434232ed11fc5bb975ba519a07154a6f56", + "InstalledFiles": [ + "usr/lib/libpanelw.so.6", + "usr/lib/libpanelw.so.6.6" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libssl3@3.5.8-r0", + "Name": "libssl3", + "Identifier": { + "PURL": "pkg:apk/alpine/libssl3@3.5.8-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "f290ab59b88b1c4a" + }, + "Version": "3.5.8-r0", + "Arch": "x86_64", + "SrcName": "openssl", + "SrcVersion": "3.5.8-r0", + "Licenses": [ + "Apache-2.0" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:5f9b1e55d821953d2e2b1db322dad70a3b5041ea", + "InstalledFiles": [ + "usr/lib/libssl.so.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libtirpc@1.3.5-r1", + "Name": "libtirpc", + "Identifier": { + "PURL": "pkg:apk/alpine/libtirpc@1.3.5-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "471c8d955ca03be5" + }, + "Version": "1.3.5-r1", + "Arch": "x86_64", + "SrcName": "libtirpc", + "SrcVersion": "1.3.5-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "krb5-libs@1.22.2-r1", + "libtirpc-conf@1.3.5-r1", + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:c32865bd86a8b8829d152279cabbc5ac6d430eb2", + "InstalledFiles": [ + "usr/lib/libtirpc.so.3", + "usr/lib/libtirpc.so.3.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libtirpc-conf@1.3.5-r1", + "Name": "libtirpc-conf", + "Identifier": { + "PURL": "pkg:apk/alpine/libtirpc-conf@1.3.5-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "3437392c14aad33f" + }, + "Version": "1.3.5-r1", + "Arch": "x86_64", + "SrcName": "libtirpc", + "SrcVersion": "1.3.5-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:0c17d9988dc986c90e22f79778df047eca9973ff", + "InstalledFiles": [ + "etc/bindresvport.blacklist", + "etc/netconfig" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libuuid@2.42.3-r1", + "Name": "libuuid", + "Identifier": { + "PURL": "pkg:apk/alpine/libuuid@2.42.3-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "c444e9cdd1bdda40" + }, + "Version": "2.42.3-r1", + "Arch": "x86_64", + "SrcName": "util-linux", + "SrcVersion": "2.42.3-r1", + "Licenses": [ + "BSD-3-Clause" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:f9b4a8a412a0c07a489e46fb5db41f9d0dc84d4ec38a4e2c6ab9531f44e0d9f1" + }, + "Digest": "sha1:8f041ef637ad75f381cc0c034f2afbbb0303264e", + "InstalledFiles": [ + "usr/lib/libuuid.so.1", + "usr/lib/libuuid.so.1.3.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "libverto@0.3.2-r2", + "Name": "libverto", + "Identifier": { + "PURL": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "9df4321a283a6cf6" + }, + "Version": "0.3.2-r2", + "Arch": "x86_64", + "SrcName": "libverto", + "SrcVersion": "0.3.2-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:73233059338142e4ac6d8fb8bb0074e93da75dc1", + "InstalledFiles": [ + "usr/lib/libverto.so.1", + "usr/lib/libverto.so.1.0.0" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "musl@1.2.6-r2", + "Name": "musl", + "Identifier": { + "PURL": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "1f8cb44befe503d4" + }, + "Version": "1.2.6-r2", + "Arch": "x86_64", + "SrcName": "musl", + "SrcVersion": "1.2.6-r2", + "Licenses": [ + "MIT" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:0f7e5827e4e1a73631beda27b78431a8ba240e05", + "InstalledFiles": [ + "lib/ld-musl-x86_64.so.1", + "lib/libc.musl-x86_64.so.1" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "musl-utils@1.2.6-r2", + "Name": "musl-utils", + "Identifier": { + "PURL": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64\u0026distro=3.24.1", + "UID": "4497482ec1d943e1" + }, + "Version": "1.2.6-r2", + "Arch": "x86_64", + "SrcName": "musl", + "SrcVersion": "1.2.6-r2", + "Licenses": [ + "MIT", + "BSD-2-Clause", + "GPL-2.0-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2", + "scanelf@1.3.9-r1" + ], + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:75ada3c48d63ec5d87c42fdf934a3fdd11298dc5", + "InstalledFiles": [ + "sbin/ldconfig", + "usr/bin/getconf", + "usr/bin/getent", + "usr/bin/iconv", + "usr/bin/ldd" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ncurses-terminfo-base@6.6_p20260516-r0", + "Name": "ncurses-terminfo-base", + "Identifier": { + "PURL": "pkg:apk/alpine/ncurses-terminfo-base@6.6_p20260516-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "e7fac5c6a6e9ae8" + }, + "Version": "6.6_p20260516-r0", + "Arch": "x86_64", + "SrcName": "ncurses", + "SrcVersion": "6.6_p20260516-r0", + "Licenses": [ + "X-11" + ], + "Maintainer": "Milan P. Stanić \u003cmps@arvanta.net\u003e", + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:9d551d828e9c8ee52c5801c1d6046828ebf15752", + "InstalledFiles": [ + "etc/terminfo/a/alacritty", + "etc/terminfo/a/ansi", + "etc/terminfo/d/dumb", + "etc/terminfo/g/gnome", + "etc/terminfo/g/gnome-256color", + "etc/terminfo/k/konsole", + "etc/terminfo/k/konsole-256color", + "etc/terminfo/k/konsole-linux", + "etc/terminfo/l/linux", + "etc/terminfo/p/putty", + "etc/terminfo/p/putty-256color", + "etc/terminfo/r/rxvt", + "etc/terminfo/r/rxvt-256color", + "etc/terminfo/s/screen", + "etc/terminfo/s/screen-256color", + "etc/terminfo/s/st-0.6", + "etc/terminfo/s/st-0.7", + "etc/terminfo/s/st-0.8", + "etc/terminfo/s/st-0.8.5", + "etc/terminfo/s/st-16color", + "etc/terminfo/s/st-256color", + "etc/terminfo/s/st-direct", + "etc/terminfo/s/sun", + "etc/terminfo/t/terminator", + "etc/terminfo/t/terminology", + "etc/terminfo/t/terminology-0.6.1", + "etc/terminfo/t/terminology-1.0.0", + "etc/terminfo/t/terminology-1.8.1", + "etc/terminfo/t/tmux", + "etc/terminfo/t/tmux-256color", + "etc/terminfo/v/vt100", + "etc/terminfo/v/vt102", + "etc/terminfo/v/vt200", + "etc/terminfo/v/vt220", + "etc/terminfo/v/vt52", + "etc/terminfo/v/vte", + "etc/terminfo/v/vte-256color", + "etc/terminfo/x/xterm", + "etc/terminfo/x/xterm-256color", + "etc/terminfo/x/xterm-color", + "etc/terminfo/x/xterm-xfree86" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "readline@8.3.3-r1", + "Name": "readline", + "Identifier": { + "PURL": "pkg:apk/alpine/readline@8.3.3-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "f50058781c93e1f2" + }, + "Version": "8.3.3-r1", + "Arch": "x86_64", + "SrcName": "readline", + "SrcVersion": "8.3.3-r1", + "Licenses": [ + "GPL-3.0-or-later" + ], + "Maintainer": "qaqland \u003cqaq@qaq.land\u003e", + "DependsOn": [ + "libncursesw@6.6_p20260516-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:945b16e378bc00e44d89d4de8124bba7647fdf4d", + "InstalledFiles": [ + "etc/inputrc", + "usr/lib/libreadline.so.8", + "usr/lib/libreadline.so.8.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "scanelf@1.3.9-r1", + "Name": "scanelf", + "Identifier": { + "PURL": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "936394657a1626fb" + }, + "Version": "1.3.9-r1", + "Arch": "x86_64", + "SrcName": "pax-utils", + "SrcVersion": "1.3.9-r1", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:013f903d0ba219673aebbdd04f74bb5ed82b01f0", + "InstalledFiles": [ + "usr/bin/scanelf" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "sqlite-libs@3.53.4-r0", + "Name": "sqlite-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "8b10aee2ccc192de" + }, + "Version": "3.53.4-r0", + "Arch": "x86_64", + "SrcName": "sqlite", + "SrcVersion": "3.53.4-r0", + "Licenses": [ + "blessing" + ], + "Maintainer": "Jingyun Hua \u003chuajingyun@loongson.cn\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:f7630ceb37c232b6609861aeab6cdb9cd120e6fa", + "InstalledFiles": [ + "usr/lib/libsqlite3.so.0", + "usr/lib/libsqlite3.so.3.53.4" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "ssl_client@1.37.0-r31", + "Name": "ssl_client", + "Identifier": { + "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64\u0026distro=3.24.1", + "UID": "d42e31f15a4ce47a" + }, + "Version": "1.37.0-r31", + "Arch": "x86_64", + "SrcName": "busybox", + "SrcVersion": "1.37.0-r31", + "Licenses": [ + "GPL-2.0-only" + ], + "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", + "DependsOn": [ + "libcrypto3@3.5.8-r0", + "libssl3@3.5.8-r0", + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c" + }, + "Digest": "sha1:c220f4a5125a313af733e98def94132bb1e9d40d", + "InstalledFiles": [ + "usr/bin/ssl_client" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "tzdata@2026c-r0", + "Name": "tzdata", + "Identifier": { + "PURL": "pkg:apk/alpine/tzdata@2026c-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "52c6b50eff629f9d" + }, + "Version": "2026c-r0", + "Arch": "x86_64", + "SrcName": "tzdata", + "SrcVersion": "2026c-r0", + "Licenses": [ + "Public-Domain" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "Layer": { + "DiffID": "sha256:3ca4be2c6e9ac0223715355253725381000486c2b45bfcb22cf571b6a85a12dd" + }, + "Digest": "sha1:61f7544ecd8dd63eac23fe3e645702fda92ef02a", + "InstalledFiles": [ + "usr/share/zoneinfo/CET", + "usr/share/zoneinfo/CST6CDT", + "usr/share/zoneinfo/Cuba", + "usr/share/zoneinfo/EET", + "usr/share/zoneinfo/EST", + "usr/share/zoneinfo/EST5EDT", + "usr/share/zoneinfo/Egypt", + "usr/share/zoneinfo/Eire", + "usr/share/zoneinfo/Factory", + "usr/share/zoneinfo/GB", + "usr/share/zoneinfo/GB-Eire", + "usr/share/zoneinfo/GMT", + "usr/share/zoneinfo/GMT+0", + "usr/share/zoneinfo/GMT-0", + "usr/share/zoneinfo/GMT0", + "usr/share/zoneinfo/Greenwich", + "usr/share/zoneinfo/HST", + "usr/share/zoneinfo/Hongkong", + "usr/share/zoneinfo/Iceland", + "usr/share/zoneinfo/Iran", + "usr/share/zoneinfo/Israel", + "usr/share/zoneinfo/Jamaica", + "usr/share/zoneinfo/Japan", + "usr/share/zoneinfo/Kwajalein", + "usr/share/zoneinfo/Libya", + "usr/share/zoneinfo/MET", + "usr/share/zoneinfo/MST", + "usr/share/zoneinfo/MST7MDT", + "usr/share/zoneinfo/NZ", + "usr/share/zoneinfo/NZ-CHAT", + "usr/share/zoneinfo/Navajo", + "usr/share/zoneinfo/PRC", + "usr/share/zoneinfo/PST8PDT", + "usr/share/zoneinfo/Poland", + "usr/share/zoneinfo/Portugal", + "usr/share/zoneinfo/ROC", + "usr/share/zoneinfo/ROK", + "usr/share/zoneinfo/Singapore", + "usr/share/zoneinfo/Turkey", + "usr/share/zoneinfo/UCT", + "usr/share/zoneinfo/UTC", + "usr/share/zoneinfo/Universal", + "usr/share/zoneinfo/W-SU", + "usr/share/zoneinfo/WET", + "usr/share/zoneinfo/Zulu", + "usr/share/zoneinfo/iso3166.tab", + "usr/share/zoneinfo/leap-seconds.list", + "usr/share/zoneinfo/posixrules", + "usr/share/zoneinfo/zone.tab", + "usr/share/zoneinfo/zone1970.tab", + "usr/share/zoneinfo/Africa/Abidjan", + "usr/share/zoneinfo/Africa/Accra", + "usr/share/zoneinfo/Africa/Addis_Ababa", + "usr/share/zoneinfo/Africa/Algiers", + "usr/share/zoneinfo/Africa/Asmara", + "usr/share/zoneinfo/Africa/Asmera", + "usr/share/zoneinfo/Africa/Bamako", + "usr/share/zoneinfo/Africa/Bangui", + "usr/share/zoneinfo/Africa/Banjul", + "usr/share/zoneinfo/Africa/Bissau", + "usr/share/zoneinfo/Africa/Blantyre", + "usr/share/zoneinfo/Africa/Brazzaville", + "usr/share/zoneinfo/Africa/Bujumbura", + "usr/share/zoneinfo/Africa/Cairo", + "usr/share/zoneinfo/Africa/Casablanca", + "usr/share/zoneinfo/Africa/Ceuta", + "usr/share/zoneinfo/Africa/Conakry", + "usr/share/zoneinfo/Africa/Dakar", + "usr/share/zoneinfo/Africa/Dar_es_Salaam", + "usr/share/zoneinfo/Africa/Djibouti", + "usr/share/zoneinfo/Africa/Douala", + "usr/share/zoneinfo/Africa/El_Aaiun", + "usr/share/zoneinfo/Africa/Freetown", + "usr/share/zoneinfo/Africa/Gaborone", + "usr/share/zoneinfo/Africa/Harare", + "usr/share/zoneinfo/Africa/Johannesburg", + "usr/share/zoneinfo/Africa/Juba", + "usr/share/zoneinfo/Africa/Kampala", + "usr/share/zoneinfo/Africa/Khartoum", + "usr/share/zoneinfo/Africa/Kigali", + "usr/share/zoneinfo/Africa/Kinshasa", + "usr/share/zoneinfo/Africa/Lagos", + "usr/share/zoneinfo/Africa/Libreville", + "usr/share/zoneinfo/Africa/Lome", + "usr/share/zoneinfo/Africa/Luanda", + "usr/share/zoneinfo/Africa/Lubumbashi", + "usr/share/zoneinfo/Africa/Lusaka", + "usr/share/zoneinfo/Africa/Malabo", + "usr/share/zoneinfo/Africa/Maputo", + "usr/share/zoneinfo/Africa/Maseru", + "usr/share/zoneinfo/Africa/Mbabane", + "usr/share/zoneinfo/Africa/Mogadishu", + "usr/share/zoneinfo/Africa/Monrovia", + "usr/share/zoneinfo/Africa/Nairobi", + "usr/share/zoneinfo/Africa/Ndjamena", + "usr/share/zoneinfo/Africa/Niamey", + "usr/share/zoneinfo/Africa/Nouakchott", + "usr/share/zoneinfo/Africa/Ouagadougou", + "usr/share/zoneinfo/Africa/Porto-Novo", + "usr/share/zoneinfo/Africa/Sao_Tome", + "usr/share/zoneinfo/Africa/Timbuktu", + "usr/share/zoneinfo/Africa/Tripoli", + "usr/share/zoneinfo/Africa/Tunis", + "usr/share/zoneinfo/Africa/Windhoek", + "usr/share/zoneinfo/America/Adak", + "usr/share/zoneinfo/America/Anchorage", + "usr/share/zoneinfo/America/Anguilla", + "usr/share/zoneinfo/America/Antigua", + "usr/share/zoneinfo/America/Araguaina", + "usr/share/zoneinfo/America/Aruba", + "usr/share/zoneinfo/America/Asuncion", + "usr/share/zoneinfo/America/Atikokan", + "usr/share/zoneinfo/America/Atka", + "usr/share/zoneinfo/America/Bahia", + "usr/share/zoneinfo/America/Bahia_Banderas", + "usr/share/zoneinfo/America/Barbados", + "usr/share/zoneinfo/America/Belem", + "usr/share/zoneinfo/America/Belize", + "usr/share/zoneinfo/America/Blanc-Sablon", + "usr/share/zoneinfo/America/Boa_Vista", + "usr/share/zoneinfo/America/Bogota", + "usr/share/zoneinfo/America/Boise", + "usr/share/zoneinfo/America/Buenos_Aires", + "usr/share/zoneinfo/America/Cambridge_Bay", + "usr/share/zoneinfo/America/Campo_Grande", + "usr/share/zoneinfo/America/Cancun", + "usr/share/zoneinfo/America/Caracas", + "usr/share/zoneinfo/America/Catamarca", + "usr/share/zoneinfo/America/Cayenne", + "usr/share/zoneinfo/America/Cayman", + "usr/share/zoneinfo/America/Chicago", + "usr/share/zoneinfo/America/Chihuahua", + "usr/share/zoneinfo/America/Ciudad_Juarez", + "usr/share/zoneinfo/America/Coral_Harbour", + "usr/share/zoneinfo/America/Cordoba", + "usr/share/zoneinfo/America/Costa_Rica", + "usr/share/zoneinfo/America/Coyhaique", + "usr/share/zoneinfo/America/Creston", + "usr/share/zoneinfo/America/Cuiaba", + "usr/share/zoneinfo/America/Curacao", + "usr/share/zoneinfo/America/Danmarkshavn", + "usr/share/zoneinfo/America/Dawson", + "usr/share/zoneinfo/America/Dawson_Creek", + "usr/share/zoneinfo/America/Denver", + "usr/share/zoneinfo/America/Detroit", + "usr/share/zoneinfo/America/Dominica", + "usr/share/zoneinfo/America/Edmonton", + "usr/share/zoneinfo/America/Eirunepe", + "usr/share/zoneinfo/America/El_Salvador", + "usr/share/zoneinfo/America/Ensenada", + "usr/share/zoneinfo/America/Fort_Nelson", + "usr/share/zoneinfo/America/Fort_Wayne", + "usr/share/zoneinfo/America/Fortaleza", + "usr/share/zoneinfo/America/Glace_Bay", + "usr/share/zoneinfo/America/Godthab", + "usr/share/zoneinfo/America/Goose_Bay", + "usr/share/zoneinfo/America/Grand_Turk", + "usr/share/zoneinfo/America/Grenada", + "usr/share/zoneinfo/America/Guadeloupe", + "usr/share/zoneinfo/America/Guatemala", + "usr/share/zoneinfo/America/Guayaquil", + "usr/share/zoneinfo/America/Guyana", + "usr/share/zoneinfo/America/Halifax", + "usr/share/zoneinfo/America/Havana", + "usr/share/zoneinfo/America/Hermosillo", + "usr/share/zoneinfo/America/Indianapolis", + "usr/share/zoneinfo/America/Inuvik", + "usr/share/zoneinfo/America/Iqaluit", + "usr/share/zoneinfo/America/Jamaica", + "usr/share/zoneinfo/America/Jujuy", + "usr/share/zoneinfo/America/Juneau", + "usr/share/zoneinfo/America/Knox_IN", + "usr/share/zoneinfo/America/Kralendijk", + "usr/share/zoneinfo/America/La_Paz", + "usr/share/zoneinfo/America/Lima", + "usr/share/zoneinfo/America/Los_Angeles", + "usr/share/zoneinfo/America/Louisville", + "usr/share/zoneinfo/America/Lower_Princes", + "usr/share/zoneinfo/America/Maceio", + "usr/share/zoneinfo/America/Managua", + "usr/share/zoneinfo/America/Manaus", + "usr/share/zoneinfo/America/Marigot", + "usr/share/zoneinfo/America/Martinique", + "usr/share/zoneinfo/America/Matamoros", + "usr/share/zoneinfo/America/Mazatlan", + "usr/share/zoneinfo/America/Mendoza", + "usr/share/zoneinfo/America/Menominee", + "usr/share/zoneinfo/America/Merida", + "usr/share/zoneinfo/America/Metlakatla", + "usr/share/zoneinfo/America/Mexico_City", + "usr/share/zoneinfo/America/Miquelon", + "usr/share/zoneinfo/America/Moncton", + "usr/share/zoneinfo/America/Monterrey", + "usr/share/zoneinfo/America/Montevideo", + "usr/share/zoneinfo/America/Montreal", + "usr/share/zoneinfo/America/Montserrat", + "usr/share/zoneinfo/America/Nassau", + "usr/share/zoneinfo/America/New_York", + "usr/share/zoneinfo/America/Nipigon", + "usr/share/zoneinfo/America/Nome", + "usr/share/zoneinfo/America/Noronha", + "usr/share/zoneinfo/America/Nuuk", + "usr/share/zoneinfo/America/Ojinaga", + "usr/share/zoneinfo/America/Panama", + "usr/share/zoneinfo/America/Pangnirtung", + "usr/share/zoneinfo/America/Paramaribo", + "usr/share/zoneinfo/America/Phoenix", + "usr/share/zoneinfo/America/Port-au-Prince", + "usr/share/zoneinfo/America/Port_of_Spain", + "usr/share/zoneinfo/America/Porto_Acre", + "usr/share/zoneinfo/America/Porto_Velho", + "usr/share/zoneinfo/America/Puerto_Rico", + "usr/share/zoneinfo/America/Punta_Arenas", + "usr/share/zoneinfo/America/Rainy_River", + "usr/share/zoneinfo/America/Rankin_Inlet", + "usr/share/zoneinfo/America/Recife", + "usr/share/zoneinfo/America/Regina", + "usr/share/zoneinfo/America/Resolute", + "usr/share/zoneinfo/America/Rio_Branco", + "usr/share/zoneinfo/America/Rosario", + "usr/share/zoneinfo/America/Santa_Isabel", + "usr/share/zoneinfo/America/Santarem", + "usr/share/zoneinfo/America/Santiago", + "usr/share/zoneinfo/America/Santo_Domingo", + "usr/share/zoneinfo/America/Sao_Paulo", + "usr/share/zoneinfo/America/Scoresbysund", + "usr/share/zoneinfo/America/Shiprock", + "usr/share/zoneinfo/America/Sitka", + "usr/share/zoneinfo/America/St_Barthelemy", + "usr/share/zoneinfo/America/St_Johns", + "usr/share/zoneinfo/America/St_Kitts", + "usr/share/zoneinfo/America/St_Lucia", + "usr/share/zoneinfo/America/St_Thomas", + "usr/share/zoneinfo/America/St_Vincent", + "usr/share/zoneinfo/America/Swift_Current", + "usr/share/zoneinfo/America/Tegucigalpa", + "usr/share/zoneinfo/America/Thule", + "usr/share/zoneinfo/America/Thunder_Bay", + "usr/share/zoneinfo/America/Tijuana", + "usr/share/zoneinfo/America/Toronto", + "usr/share/zoneinfo/America/Tortola", + "usr/share/zoneinfo/America/Vancouver", + "usr/share/zoneinfo/America/Virgin", + "usr/share/zoneinfo/America/Whitehorse", + "usr/share/zoneinfo/America/Winnipeg", + "usr/share/zoneinfo/America/Yakutat", + "usr/share/zoneinfo/America/Yellowknife", + "usr/share/zoneinfo/America/Argentina/Buenos_Aires", + "usr/share/zoneinfo/America/Argentina/Catamarca", + "usr/share/zoneinfo/America/Argentina/ComodRivadavia", + "usr/share/zoneinfo/America/Argentina/Cordoba", + "usr/share/zoneinfo/America/Argentina/Jujuy", + "usr/share/zoneinfo/America/Argentina/La_Rioja", + "usr/share/zoneinfo/America/Argentina/Mendoza", + "usr/share/zoneinfo/America/Argentina/Rio_Gallegos", + "usr/share/zoneinfo/America/Argentina/Salta", + "usr/share/zoneinfo/America/Argentina/San_Juan", + "usr/share/zoneinfo/America/Argentina/San_Luis", + "usr/share/zoneinfo/America/Argentina/Tucuman", + "usr/share/zoneinfo/America/Argentina/Ushuaia", + "usr/share/zoneinfo/America/Indiana/Indianapolis", + "usr/share/zoneinfo/America/Indiana/Knox", + "usr/share/zoneinfo/America/Indiana/Marengo", + "usr/share/zoneinfo/America/Indiana/Petersburg", + "usr/share/zoneinfo/America/Indiana/Tell_City", + "usr/share/zoneinfo/America/Indiana/Vevay", + "usr/share/zoneinfo/America/Indiana/Vincennes", + "usr/share/zoneinfo/America/Indiana/Winamac", + "usr/share/zoneinfo/America/Kentucky/Louisville", + "usr/share/zoneinfo/America/Kentucky/Monticello", + "usr/share/zoneinfo/America/North_Dakota/Beulah", + "usr/share/zoneinfo/America/North_Dakota/Center", + "usr/share/zoneinfo/America/North_Dakota/New_Salem", + "usr/share/zoneinfo/Antarctica/Casey", + "usr/share/zoneinfo/Antarctica/Davis", + "usr/share/zoneinfo/Antarctica/DumontDUrville", + "usr/share/zoneinfo/Antarctica/Macquarie", + "usr/share/zoneinfo/Antarctica/Mawson", + "usr/share/zoneinfo/Antarctica/McMurdo", + "usr/share/zoneinfo/Antarctica/Palmer", + "usr/share/zoneinfo/Antarctica/Rothera", + "usr/share/zoneinfo/Antarctica/South_Pole", + "usr/share/zoneinfo/Antarctica/Syowa", + "usr/share/zoneinfo/Antarctica/Troll", + "usr/share/zoneinfo/Antarctica/Vostok", + "usr/share/zoneinfo/Arctic/Longyearbyen", + "usr/share/zoneinfo/Asia/Aden", + "usr/share/zoneinfo/Asia/Almaty", + "usr/share/zoneinfo/Asia/Amman", + "usr/share/zoneinfo/Asia/Anadyr", + "usr/share/zoneinfo/Asia/Aqtau", + "usr/share/zoneinfo/Asia/Aqtobe", + "usr/share/zoneinfo/Asia/Ashgabat", + "usr/share/zoneinfo/Asia/Ashkhabad", + "usr/share/zoneinfo/Asia/Atyrau", + "usr/share/zoneinfo/Asia/Baghdad", + "usr/share/zoneinfo/Asia/Bahrain", + "usr/share/zoneinfo/Asia/Baku", + "usr/share/zoneinfo/Asia/Bangkok", + "usr/share/zoneinfo/Asia/Barnaul", + "usr/share/zoneinfo/Asia/Beirut", + "usr/share/zoneinfo/Asia/Bishkek", + "usr/share/zoneinfo/Asia/Brunei", + "usr/share/zoneinfo/Asia/Calcutta", + "usr/share/zoneinfo/Asia/Chita", + "usr/share/zoneinfo/Asia/Choibalsan", + "usr/share/zoneinfo/Asia/Chongqing", + "usr/share/zoneinfo/Asia/Chungking", + "usr/share/zoneinfo/Asia/Colombo", + "usr/share/zoneinfo/Asia/Dacca", + "usr/share/zoneinfo/Asia/Damascus", + "usr/share/zoneinfo/Asia/Dhaka", + "usr/share/zoneinfo/Asia/Dili", + "usr/share/zoneinfo/Asia/Dubai", + "usr/share/zoneinfo/Asia/Dushanbe", + "usr/share/zoneinfo/Asia/Famagusta", + "usr/share/zoneinfo/Asia/Gaza", + "usr/share/zoneinfo/Asia/Harbin", + "usr/share/zoneinfo/Asia/Hebron", + "usr/share/zoneinfo/Asia/Ho_Chi_Minh", + "usr/share/zoneinfo/Asia/Hong_Kong", + "usr/share/zoneinfo/Asia/Hovd", + "usr/share/zoneinfo/Asia/Irkutsk", + "usr/share/zoneinfo/Asia/Istanbul", + "usr/share/zoneinfo/Asia/Jakarta", + "usr/share/zoneinfo/Asia/Jayapura", + "usr/share/zoneinfo/Asia/Jerusalem", + "usr/share/zoneinfo/Asia/Kabul", + "usr/share/zoneinfo/Asia/Kamchatka", + "usr/share/zoneinfo/Asia/Karachi", + "usr/share/zoneinfo/Asia/Kashgar", + "usr/share/zoneinfo/Asia/Kathmandu", + "usr/share/zoneinfo/Asia/Katmandu", + "usr/share/zoneinfo/Asia/Khandyga", + "usr/share/zoneinfo/Asia/Kolkata", + "usr/share/zoneinfo/Asia/Krasnoyarsk", + "usr/share/zoneinfo/Asia/Kuala_Lumpur", + "usr/share/zoneinfo/Asia/Kuching", + "usr/share/zoneinfo/Asia/Kuwait", + "usr/share/zoneinfo/Asia/Macao", + "usr/share/zoneinfo/Asia/Macau", + "usr/share/zoneinfo/Asia/Magadan", + "usr/share/zoneinfo/Asia/Makassar", + "usr/share/zoneinfo/Asia/Manila", + "usr/share/zoneinfo/Asia/Muscat", + "usr/share/zoneinfo/Asia/Nicosia", + "usr/share/zoneinfo/Asia/Novokuznetsk", + "usr/share/zoneinfo/Asia/Novosibirsk", + "usr/share/zoneinfo/Asia/Omsk", + "usr/share/zoneinfo/Asia/Oral", + "usr/share/zoneinfo/Asia/Phnom_Penh", + "usr/share/zoneinfo/Asia/Pontianak", + "usr/share/zoneinfo/Asia/Pyongyang", + "usr/share/zoneinfo/Asia/Qatar", + "usr/share/zoneinfo/Asia/Qostanay", + "usr/share/zoneinfo/Asia/Qyzylorda", + "usr/share/zoneinfo/Asia/Rangoon", + "usr/share/zoneinfo/Asia/Riyadh", + "usr/share/zoneinfo/Asia/Saigon", + "usr/share/zoneinfo/Asia/Sakhalin", + "usr/share/zoneinfo/Asia/Samarkand", + "usr/share/zoneinfo/Asia/Seoul", + "usr/share/zoneinfo/Asia/Shanghai", + "usr/share/zoneinfo/Asia/Singapore", + "usr/share/zoneinfo/Asia/Srednekolymsk", + "usr/share/zoneinfo/Asia/Taipei", + "usr/share/zoneinfo/Asia/Tashkent", + "usr/share/zoneinfo/Asia/Tbilisi", + "usr/share/zoneinfo/Asia/Tehran", + "usr/share/zoneinfo/Asia/Tel_Aviv", + "usr/share/zoneinfo/Asia/Thimbu", + "usr/share/zoneinfo/Asia/Thimphu", + "usr/share/zoneinfo/Asia/Tokyo", + "usr/share/zoneinfo/Asia/Tomsk", + "usr/share/zoneinfo/Asia/Ujung_Pandang", + "usr/share/zoneinfo/Asia/Ulaanbaatar", + "usr/share/zoneinfo/Asia/Ulan_Bator", + "usr/share/zoneinfo/Asia/Urumqi", + "usr/share/zoneinfo/Asia/Ust-Nera", + "usr/share/zoneinfo/Asia/Vientiane", + "usr/share/zoneinfo/Asia/Vladivostok", + "usr/share/zoneinfo/Asia/Yakutsk", + "usr/share/zoneinfo/Asia/Yangon", + "usr/share/zoneinfo/Asia/Yekaterinburg", + "usr/share/zoneinfo/Asia/Yerevan", + "usr/share/zoneinfo/Atlantic/Azores", + "usr/share/zoneinfo/Atlantic/Bermuda", + "usr/share/zoneinfo/Atlantic/Canary", + "usr/share/zoneinfo/Atlantic/Cape_Verde", + "usr/share/zoneinfo/Atlantic/Faeroe", + "usr/share/zoneinfo/Atlantic/Faroe", + "usr/share/zoneinfo/Atlantic/Jan_Mayen", + "usr/share/zoneinfo/Atlantic/Madeira", + "usr/share/zoneinfo/Atlantic/Reykjavik", + "usr/share/zoneinfo/Atlantic/South_Georgia", + "usr/share/zoneinfo/Atlantic/St_Helena", + "usr/share/zoneinfo/Atlantic/Stanley", + "usr/share/zoneinfo/Australia/ACT", + "usr/share/zoneinfo/Australia/Adelaide", + "usr/share/zoneinfo/Australia/Brisbane", + "usr/share/zoneinfo/Australia/Broken_Hill", + "usr/share/zoneinfo/Australia/Canberra", + "usr/share/zoneinfo/Australia/Currie", + "usr/share/zoneinfo/Australia/Darwin", + "usr/share/zoneinfo/Australia/Eucla", + "usr/share/zoneinfo/Australia/Hobart", + "usr/share/zoneinfo/Australia/LHI", + "usr/share/zoneinfo/Australia/Lindeman", + "usr/share/zoneinfo/Australia/Lord_Howe", + "usr/share/zoneinfo/Australia/Melbourne", + "usr/share/zoneinfo/Australia/NSW", + "usr/share/zoneinfo/Australia/North", + "usr/share/zoneinfo/Australia/Perth", + "usr/share/zoneinfo/Australia/Queensland", + "usr/share/zoneinfo/Australia/South", + "usr/share/zoneinfo/Australia/Sydney", + "usr/share/zoneinfo/Australia/Tasmania", + "usr/share/zoneinfo/Australia/Victoria", + "usr/share/zoneinfo/Australia/West", + "usr/share/zoneinfo/Australia/Yancowinna", + "usr/share/zoneinfo/Brazil/Acre", + "usr/share/zoneinfo/Brazil/DeNoronha", + "usr/share/zoneinfo/Brazil/East", + "usr/share/zoneinfo/Brazil/West", + "usr/share/zoneinfo/Canada/Atlantic", + "usr/share/zoneinfo/Canada/Central", + "usr/share/zoneinfo/Canada/Eastern", + "usr/share/zoneinfo/Canada/Mountain", + "usr/share/zoneinfo/Canada/Newfoundland", + "usr/share/zoneinfo/Canada/Pacific", + "usr/share/zoneinfo/Canada/Saskatchewan", + "usr/share/zoneinfo/Canada/Yukon", + "usr/share/zoneinfo/Chile/Continental", + "usr/share/zoneinfo/Chile/EasterIsland", + "usr/share/zoneinfo/Etc/GMT", + "usr/share/zoneinfo/Etc/GMT+0", + "usr/share/zoneinfo/Etc/GMT+1", + "usr/share/zoneinfo/Etc/GMT+10", + "usr/share/zoneinfo/Etc/GMT+11", + "usr/share/zoneinfo/Etc/GMT+12", + "usr/share/zoneinfo/Etc/GMT+2", + "usr/share/zoneinfo/Etc/GMT+3", + "usr/share/zoneinfo/Etc/GMT+4", + "usr/share/zoneinfo/Etc/GMT+5", + "usr/share/zoneinfo/Etc/GMT+6", + "usr/share/zoneinfo/Etc/GMT+7", + "usr/share/zoneinfo/Etc/GMT+8", + "usr/share/zoneinfo/Etc/GMT+9", + "usr/share/zoneinfo/Etc/GMT-0", + "usr/share/zoneinfo/Etc/GMT-1", + "usr/share/zoneinfo/Etc/GMT-10", + "usr/share/zoneinfo/Etc/GMT-11", + "usr/share/zoneinfo/Etc/GMT-12", + "usr/share/zoneinfo/Etc/GMT-13", + "usr/share/zoneinfo/Etc/GMT-14", + "usr/share/zoneinfo/Etc/GMT-2", + "usr/share/zoneinfo/Etc/GMT-3", + "usr/share/zoneinfo/Etc/GMT-4", + "usr/share/zoneinfo/Etc/GMT-5", + "usr/share/zoneinfo/Etc/GMT-6", + "usr/share/zoneinfo/Etc/GMT-7", + "usr/share/zoneinfo/Etc/GMT-8", + "usr/share/zoneinfo/Etc/GMT-9", + "usr/share/zoneinfo/Etc/GMT0", + "usr/share/zoneinfo/Etc/Greenwich", + "usr/share/zoneinfo/Etc/UCT", + "usr/share/zoneinfo/Etc/UTC", + "usr/share/zoneinfo/Etc/Universal", + "usr/share/zoneinfo/Etc/Zulu", + "usr/share/zoneinfo/Europe/Amsterdam", + "usr/share/zoneinfo/Europe/Andorra", + "usr/share/zoneinfo/Europe/Astrakhan", + "usr/share/zoneinfo/Europe/Athens", + "usr/share/zoneinfo/Europe/Belfast", + "usr/share/zoneinfo/Europe/Belgrade", + "usr/share/zoneinfo/Europe/Berlin", + "usr/share/zoneinfo/Europe/Bratislava", + "usr/share/zoneinfo/Europe/Brussels", + "usr/share/zoneinfo/Europe/Bucharest", + "usr/share/zoneinfo/Europe/Budapest", + "usr/share/zoneinfo/Europe/Busingen", + "usr/share/zoneinfo/Europe/Chisinau", + "usr/share/zoneinfo/Europe/Copenhagen", + "usr/share/zoneinfo/Europe/Dublin", + "usr/share/zoneinfo/Europe/Gibraltar", + "usr/share/zoneinfo/Europe/Guernsey", + "usr/share/zoneinfo/Europe/Helsinki", + "usr/share/zoneinfo/Europe/Isle_of_Man", + "usr/share/zoneinfo/Europe/Istanbul", + "usr/share/zoneinfo/Europe/Jersey", + "usr/share/zoneinfo/Europe/Kaliningrad", + "usr/share/zoneinfo/Europe/Kiev", + "usr/share/zoneinfo/Europe/Kirov", + "usr/share/zoneinfo/Europe/Kyiv", + "usr/share/zoneinfo/Europe/Lisbon", + "usr/share/zoneinfo/Europe/Ljubljana", + "usr/share/zoneinfo/Europe/London", + "usr/share/zoneinfo/Europe/Luxembourg", + "usr/share/zoneinfo/Europe/Madrid", + "usr/share/zoneinfo/Europe/Malta", + "usr/share/zoneinfo/Europe/Mariehamn", + "usr/share/zoneinfo/Europe/Minsk", + "usr/share/zoneinfo/Europe/Monaco", + "usr/share/zoneinfo/Europe/Moscow", + "usr/share/zoneinfo/Europe/Nicosia", + "usr/share/zoneinfo/Europe/Oslo", + "usr/share/zoneinfo/Europe/Paris", + "usr/share/zoneinfo/Europe/Podgorica", + "usr/share/zoneinfo/Europe/Prague", + "usr/share/zoneinfo/Europe/Riga", + "usr/share/zoneinfo/Europe/Rome", + "usr/share/zoneinfo/Europe/Samara", + "usr/share/zoneinfo/Europe/San_Marino", + "usr/share/zoneinfo/Europe/Sarajevo", + "usr/share/zoneinfo/Europe/Saratov", + "usr/share/zoneinfo/Europe/Simferopol", + "usr/share/zoneinfo/Europe/Skopje", + "usr/share/zoneinfo/Europe/Sofia", + "usr/share/zoneinfo/Europe/Stockholm", + "usr/share/zoneinfo/Europe/Tallinn", + "usr/share/zoneinfo/Europe/Tirane", + "usr/share/zoneinfo/Europe/Tiraspol", + "usr/share/zoneinfo/Europe/Ulyanovsk", + "usr/share/zoneinfo/Europe/Uzhgorod", + "usr/share/zoneinfo/Europe/Vaduz", + "usr/share/zoneinfo/Europe/Vatican", + "usr/share/zoneinfo/Europe/Vienna", + "usr/share/zoneinfo/Europe/Vilnius", + "usr/share/zoneinfo/Europe/Volgograd", + "usr/share/zoneinfo/Europe/Warsaw", + "usr/share/zoneinfo/Europe/Zagreb", + "usr/share/zoneinfo/Europe/Zaporozhye", + "usr/share/zoneinfo/Europe/Zurich", + "usr/share/zoneinfo/Indian/Antananarivo", + "usr/share/zoneinfo/Indian/Chagos", + "usr/share/zoneinfo/Indian/Christmas", + "usr/share/zoneinfo/Indian/Cocos", + "usr/share/zoneinfo/Indian/Comoro", + "usr/share/zoneinfo/Indian/Kerguelen", + "usr/share/zoneinfo/Indian/Mahe", + "usr/share/zoneinfo/Indian/Maldives", + "usr/share/zoneinfo/Indian/Mauritius", + "usr/share/zoneinfo/Indian/Mayotte", + "usr/share/zoneinfo/Indian/Reunion", + "usr/share/zoneinfo/Mexico/BajaNorte", + "usr/share/zoneinfo/Mexico/BajaSur", + "usr/share/zoneinfo/Mexico/General", + "usr/share/zoneinfo/Pacific/Apia", + "usr/share/zoneinfo/Pacific/Auckland", + "usr/share/zoneinfo/Pacific/Bougainville", + "usr/share/zoneinfo/Pacific/Chatham", + "usr/share/zoneinfo/Pacific/Chuuk", + "usr/share/zoneinfo/Pacific/Easter", + "usr/share/zoneinfo/Pacific/Efate", + "usr/share/zoneinfo/Pacific/Enderbury", + "usr/share/zoneinfo/Pacific/Fakaofo", + "usr/share/zoneinfo/Pacific/Fiji", + "usr/share/zoneinfo/Pacific/Funafuti", + "usr/share/zoneinfo/Pacific/Galapagos", + "usr/share/zoneinfo/Pacific/Gambier", + "usr/share/zoneinfo/Pacific/Guadalcanal", + "usr/share/zoneinfo/Pacific/Guam", + "usr/share/zoneinfo/Pacific/Honolulu", + "usr/share/zoneinfo/Pacific/Johnston", + "usr/share/zoneinfo/Pacific/Kanton", + "usr/share/zoneinfo/Pacific/Kiritimati", + "usr/share/zoneinfo/Pacific/Kosrae", + "usr/share/zoneinfo/Pacific/Kwajalein", + "usr/share/zoneinfo/Pacific/Majuro", + "usr/share/zoneinfo/Pacific/Marquesas", + "usr/share/zoneinfo/Pacific/Midway", + "usr/share/zoneinfo/Pacific/Nauru", + "usr/share/zoneinfo/Pacific/Niue", + "usr/share/zoneinfo/Pacific/Norfolk", + "usr/share/zoneinfo/Pacific/Noumea", + "usr/share/zoneinfo/Pacific/Pago_Pago", + "usr/share/zoneinfo/Pacific/Palau", + "usr/share/zoneinfo/Pacific/Pitcairn", + "usr/share/zoneinfo/Pacific/Pohnpei", + "usr/share/zoneinfo/Pacific/Ponape", + "usr/share/zoneinfo/Pacific/Port_Moresby", + "usr/share/zoneinfo/Pacific/Rarotonga", + "usr/share/zoneinfo/Pacific/Saipan", + "usr/share/zoneinfo/Pacific/Samoa", + "usr/share/zoneinfo/Pacific/Tahiti", + "usr/share/zoneinfo/Pacific/Tarawa", + "usr/share/zoneinfo/Pacific/Tongatapu", + "usr/share/zoneinfo/Pacific/Truk", + "usr/share/zoneinfo/Pacific/Wake", + "usr/share/zoneinfo/Pacific/Wallis", + "usr/share/zoneinfo/Pacific/Yap", + "usr/share/zoneinfo/US/Alaska", + "usr/share/zoneinfo/US/Aleutian", + "usr/share/zoneinfo/US/Arizona", + "usr/share/zoneinfo/US/Central", + "usr/share/zoneinfo/US/East-Indiana", + "usr/share/zoneinfo/US/Eastern", + "usr/share/zoneinfo/US/Hawaii", + "usr/share/zoneinfo/US/Indiana-Starke", + "usr/share/zoneinfo/US/Michigan", + "usr/share/zoneinfo/US/Mountain", + "usr/share/zoneinfo/US/Pacific", + "usr/share/zoneinfo/US/Samoa" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "xz-libs@5.8.3-r0", + "Name": "xz-libs", + "Identifier": { + "PURL": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64\u0026distro=3.24.1", + "UID": "1ae658a5f132a091" + }, + "Version": "5.8.3-r0", + "Arch": "x86_64", + "SrcName": "xz", + "SrcVersion": "5.8.3-r0", + "Licenses": [ + "GPL-2.0-or-later", + "0BSD", + "Public-Domain", + "LGPL-2.1-or-later" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:e5ccda0fbf6b54d343e024156d876553ba57d3926d7196584b3a1ce4df016366" + }, + "Digest": "sha1:4c92c5be0c5bef404e93c880eba9037a9b147347", + "InstalledFiles": [ + "usr/lib/liblzma.so.5", + "usr/lib/liblzma.so.5.8.3" + ], + "AnalyzedBy": "apk" + }, + { + "ID": "zlib@1.3.2-r1", + "Name": "zlib", + "Identifier": { + "PURL": "pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64\u0026distro=3.24.1", + "UID": "1c01476a88d60a66" + }, + "Version": "1.3.2-r1", + "Arch": "x86_64", + "SrcName": "zlib", + "SrcVersion": "1.3.2-r1", + "Licenses": [ + "Zlib" + ], + "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", + "DependsOn": [ + "musl@1.2.6-r2" + ], + "Layer": { + "DiffID": "sha256:08f4420173dc9f73d520ab9f1a08adeb802ab64d1e1a2f419af11ba2302b05ea" + }, + "Digest": "sha1:4f525c8cc204f84b8b4ca40db3be389958f056c6", + "InstalledFiles": [ + "usr/lib/libz.so.1", + "usr/lib/libz.so.1.3.2" + ], + "AnalyzedBy": "apk" + } + ] + }, + { + "Target": "Python", + "Class": "lang-pkgs", + "Type": "python-pkg", + "Packages": [ + { + "Name": "PyJWT", + "Identifier": { + "PURL": "pkg:pypi/pyjwt@2.15.1", + "UID": "d3f5f9a421b8abc9" + }, + "Version": "2.15.1", + "Licenses": [ + "MIT" + ], + "Layer": { + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/pyjwt-2.15.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "cffi", + "Identifier": { + "PURL": "pkg:pypi/cffi@2.1.1", + "UID": "21042e2f37e33c05" + }, + "Version": "2.1.1", + "Licenses": [ + "MIT-0" + ], + "Layer": { + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/cffi-2.1.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "cryptography", + "Identifier": { + "PURL": "pkg:pypi/cryptography@50.0.1", + "UID": "dcb3df6383fe2a60" + }, + "Version": "50.0.1", + "Licenses": [ + "Apache-2.0 OR BSD-3-Clause" + ], + "Layer": { + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/cryptography-50.0.1.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "informed-decision", + "Identifier": { + "PURL": "pkg:pypi/informed-decision@0.2.0", + "UID": "7989f2afae8ff568" + }, + "Version": "0.2.0", + "Layer": { + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/informed_decision-0.2.0.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "pycparser", + "Identifier": { + "PURL": "pkg:pypi/pycparser@3.0", + "UID": "e5a4d03f15a695ff" + }, + "Version": "3.0", + "Licenses": [ + "BSD-3-Clause" + ], + "Layer": { + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/pycparser-3.0.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + }, + { + "Name": "waitress", + "Identifier": { + "PURL": "pkg:pypi/waitress@3.0.2", + "UID": "806e218e1c1e85f" + }, + "Version": "3.0.2", + "Licenses": [ + "ZPL-2.1" + ], + "Layer": { + "DiffID": "sha256:648451a0dda84ad04681e32b5ecc7cd5d3a4f0ad84f783e9598d72bc69620d5c" + }, + "FilePath": "opt/venv/lib/python3.12/site-packages/waitress-3.0.2.dist-info/METADATA", + "AnalyzedBy": "python-pkg" + } + ] + } + ] +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/fresh-scan-receipt.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/fresh-scan-receipt.json new file mode 100644 index 00000000..e2cd599e --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/fresh-scan-receipt.json @@ -0,0 +1,68 @@ +{ + "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23", + "artifact_source_revision": "9b4bb25d325698ae543e7e8a8a3c3592db1f58fc", + "scanner": "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969", + "full_allseverity_scan": true, + "no_suppression": true, + "exit_code": 0, + "completed_at": "2026-10-11T10:48:46.790940+00:00", + "db_metadata": { + "Version": 2, + "NextUpdate": "2026-10-11T18:59:50.889010572Z", + "UpdatedAt": "2026-10-10T18:59:50.889010923Z", + "DownloadedAt": "2026-10-10T23:32:32.380033131Z" + }, + "db_sha256": "03cacb40452ceb74afdfca072cb82f79ee884dfac006ef24a4dfdad133b0f917", + "full_report_sha256": "42473695abfb99cb32ae29e607120996d339683da7987e9a91117aab9a7e5c00", + "public_archive_sha256": "d24993af69028c6ac43640ee17dcccdc3e962cda4bc28dc8000b4ac77728bc2d", + "archive_config_and_11_layers_verified": true, + "started_at": "2026-10-11T10:48:21.420853+00:00", + "command": [ + "docker", + "--config", + "/tmp/infd-zlib-fresh-rescan-20261011T104821420853Z/empty-docker-config", + "--host", + "unix:///var/run/docker.sock", + "run", + "--rm", + "--user", + "1000:1000", + "--network", + "none", + "--cpus", + "1", + "--memory", + "1g", + "--read-only", + "--tmpfs", + "/tmp:rw,nosuid,nodev,noexec,size=268435456", + "--cap-drop", + "ALL", + "--security-opt", + "no-new-privileges", + "-v", + "/tmp/infd-zlib-published-9b4bb25d/image.tar:/artifact/image.tar:ro", + "-v", + "/tmp/infd-zlib-fresh-rescan-20261011T104821420853Z/scanner-cache:/cache", + "-v", + "/tmp/infd-zlib-fresh-rescan-20261011T104821420853Z:/output", + "aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969", + "image", + "--input", + "/artifact/image.tar", + "--cache-dir", + "/cache", + "--skip-db-update", + "--skip-java-db-update", + "--scanners", + "vuln", + "--format", + "json", + "--output", + "/output/trivy-full.json" + ], + "raw_output_withheld": true, + "native_actions": false, + "native_database_read": false, + "credential_read": false +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/informed-decision-closure-consistency.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/informed-decision-closure-consistency.json new file mode 100644 index 00000000..4a9febd4 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/informed-decision-closure-consistency.json @@ -0,0 +1,182 @@ +{ + "repo_slug": "informed-decision", + "repo_path": "/home/worsch/informed-decision", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager warning: GOAL.md: durable flavors use INTENT.md; GOAL.md is the project-flavor purpose document", + "file_path": "GOAL.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-33", + "message": "WORK-RECORDS.md is missing or stale \u2014 regenerate via fix-consistency (CUST-WP-0061-T04 generated work-record index)", + "file_path": "WORK-RECORDS.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T02' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T02", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T03' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T03", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T04' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T04", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T05' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T05", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T06' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T06", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T07' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T07", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T08' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T08", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T09' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T09", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-11", + "message": "Task 'INFD-WP-ADHOC-2026-10-11-T10' has no state_hub_task_id", + "file_path": "workplans/ADHOC-2026-10-11.md#INFD-WP-ADHOC-2026-10-11-T10", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-04", + "message": "Status drift in 'infd-wp-0009': file='finished' db='active' (file wins)", + "file_path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md", + "db_id": "77eaeabf-0644-595f-b3d5-1168e6a294c4", + "file_value": "finished", + "db_value": "active", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-10", + "message": "Task status drift 'INFD-WP-0009-T05': file='done' db='progress' (file wins)", + "file_path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md#INFD-WP-0009-T05", + "db_id": "1743596f-8558-5a6b-afef-4dd5c1e9c0ae", + "file_value": "done", + "db_value": "progress", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-22", + "message": "Task description drift 'INFD-WP-0009-T05': file content differs from DB (file wins)", + "file_path": "workplans/INFD-WP-0009-lifecycle-consumer-pin-repair.md#INFD-WP-0009-T05", + "db_id": "1743596f-8558-5a6b-afef-4dd5c1e9c0ae", + "file_value": "Owner follow-through `INFD-RISK-20261011-ZLIB-85091` tracks actual published\nbase and purpose-overlay scan finding CVE-2", + "db_value": "Owner follow-through `INFD-RISK-20261011-ZLIB-85091` tracks actual published\nbase and purpose-overlay scan finding CVE-2", + "fixable": true + }, + { + "severity": "WARN", + "check_id": "C-28", + "message": "3 unread message(s) lack thread_id for supersession tracking: access-engine:9b15c762, access-engine:ea7d5873, access-engine:7fcb1eb7", + "file_path": "", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 11/11", + "C-17 cleared: pushed 1 backlogged commit(s)", + "C-33 fixed: regenerated WORK-RECORDS.md", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T02' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T03' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T04' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T05' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T06' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T07' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T08' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T09' in finished workstream \u2014 not created", + "C-11 skipped: task 'INFD-WP-ADHOC-2026-10-11-T10' in finished workstream \u2014 not created", + "C-04 fixed: workstream 77eaeabf\u2026 status \u2192 'finished'", + "C-10 fixed: task 1743596f\u2026 status \u2192 'done'", + "C-22 fixed: task 1743596f\u2026 description updated", + "brief: .custodian-brief.md updated", + "push: pushed" + ], + "summary": { + "fail": 0, + "automation_error": 0, + "warn": 15, + "info": 0 + }, + "result": "warn" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/manifest.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/manifest.json new file mode 100644 index 00000000..b06c6a5a --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/manifest.json @@ -0,0 +1,82 @@ +[ + { + "path": "drill-backup.json", + "sha256": "53ea89341b3ed9d62b6db11070c19a3f1a97aa705ca5e69f75e5badb6d0f085e" + }, + { + "path": "drill-copy.json", + "sha256": "06011d148a022d7249f85e794455f297bf8193e19480762b667c8a42afa30e4e" + }, + { + "path": "offline-verify.json", + "sha256": "4cf2df2c91877c87be8eebb279640473bb3627fe93ed4467467058e8f7baa7ab" + }, + { + "path": "cleanup-offline.json", + "sha256": "ee89cddb506e65959c96b8da453443cd77e3a5cce927e0102acf56f28c38408c" + }, + { + "path": "cutover-backup.json", + "sha256": "3d7a79ddb6f29368284a2d87ffbf350e27a0548750e29e8a532ad9736b3e2cc7" + }, + { + "path": "cutover-copy.json", + "sha256": "14f008e0b8a7b1447847c3c02f1a07ffa13285832f91a6c5a795200f1c68c12f" + }, + { + "path": "release.json", + "sha256": "05cb8b520c9414b5f3a39b2fa5f9b6bf07e93145390fd252c7ddf8cd618687d7" + }, + { + "path": "verify.json", + "sha256": "efe87612f116839340a8e4c777ee7a66f806c8b8ded7f4a13451ec858c838f9a" + }, + { + "path": "canonical-provider-verification.json", + "sha256": "bee994ec4a965f2dccdd252feeb4b527f523fad172db8999849e7c9bc2b12794" + }, + { + "path": "fresh-scan-receipt.json", + "sha256": "0336de3a48d9e1af3e0d74ef7c4a4c01c3a0ac4418a1d84856e87c424dda6db1" + }, + { + "path": "fresh-scan-full.json", + "sha256": "42473695abfb99cb32ae29e607120996d339683da7987e9a91117aab9a7e5c00" + }, + { + "path": "confirmed-root-authority.json", + "sha256": "0d64760ba43581a19ec74489e655e89af150083aa59cea2414c12faa76912e88" + }, + { + "path": "approved-native-preflight.json", + "sha256": "90a8222c400c8e21e4850111fd91c22be9d33c3de9e3351da2bb49c69c3d40eb" + }, + { + "path": "root-clock-diagnosis.json", + "sha256": "6e3cf5fee7471a58016652b7aa8a11756b40e0c8c75c5b74292fad8e11ec6ffe" + }, + { + "path": "prephase-refusal-first.json", + "sha256": "ea63e675da65771a2971030e2b9f55b5c466f70209718be3d0bad8e0b314843d" + }, + { + "path": "prephase-refusal-second.json", + "sha256": "ea63e675da65771a2971030e2b9f55b5c466f70209718be3d0bad8e0b314843d" + }, + { + "path": "prephase-refusal-traced.json", + "sha256": "2932b60db10ce8295b376e6b5964ce695a489699782dd03eb02d9cff9c25bfb6" + }, + { + "path": "root-authority-helper-before-clock-correction.py", + "sha256": "64afd31c9776bd38c84f82972800fe59cbfb34b5315e9cb56aa25f5eb0e4c96d" + }, + { + "path": "root-authority-helper-final.py", + "sha256": "0e4fde2db800d0055c5ef94bd4efcb4f29207dfdb7fbab5df370bac0c65aa42a" + }, + { + "path": "approved-local-image-readiness.json", + "sha256": "285bd23bc05a41fe9942e399527594da896f9a2160af757c9b7ffa9e006fbf37" + } +] diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/offline-verify.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/offline-verify.json new file mode 100644 index 00000000..d49cec11 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/offline-verify.json @@ -0,0 +1,68 @@ +{ + "all_checks_pass": true, + "offline_volume": "infd-zlib-r1-restore-20261011", + "offline_readonly": { + "integrity": "ok", + "lifecycle": { + "events": 59, + "pending": 0, + "records": 17 + }, + "outbox": { + "delivered": 344 + }, + "read_only_pre_open": true, + "schema_version": 5, + "store_constructed": false, + "submissions": { + "confirmed": 44 + } + }, + "offline_post_admin_readonly": { + "integrity": "ok", + "lifecycle": { + "events": 59, + "pending": 0, + "records": 17 + }, + "outbox": { + "delivered": 344 + }, + "read_only_pre_open": true, + "schema_version": 5, + "store_constructed": false, + "submissions": { + "confirmed": 44 + } + }, + "original_snapshot_hash_unchanged": true, + "created_volume_identity": { + "Name": "infd-zlib-r1-restore-20261011", + "Labels": { + "informed-decision.attempt": "643de582-9501-45dd-bac1-754b8524f5b9", + "informed-decision.case": "infd-zlib-20261011-r1", + "informed-decision.use": "offline-restore-only" + }, + "Driver": "local", + "Scope": "local", + "CreatedAt": "2026-10-11T13:16:36+02:00" + }, + "admin_counts": { + "schema_version": 5, + "lifecycle": { + "records": 17, + "events": 59, + "pending": 0 + }, + "outbox": { + "delivered": 344 + }, + "submissions": { + "confirmed": 44 + } + }, + "network": "none", + "runtime_tokens_or_config_mounted": false, + "service_entrypoint_started": false, + "original_snapshot_retained": true +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/prephase-refusal-first.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/prephase-refusal-first.json new file mode 100644 index 00000000..962502d8 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/prephase-refusal-first.json @@ -0,0 +1,6 @@ +{ + "all_checks_pass": false, + "phase": "drill-backup", + "status": "phase_receipt_unverified", + "raw_output_withheld": true +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/prephase-refusal-second.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/prephase-refusal-second.json new file mode 100644 index 00000000..962502d8 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/prephase-refusal-second.json @@ -0,0 +1,6 @@ +{ + "all_checks_pass": false, + "phase": "drill-backup", + "status": "phase_receipt_unverified", + "raw_output_withheld": true +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/prephase-refusal-traced.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/prephase-refusal-traced.json new file mode 100644 index 00000000..89da9733 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/prephase-refusal-traced.json @@ -0,0 +1,33 @@ +{ + "all_checks_pass": false, + "phase": "drill-backup", + "status": "prephase_receipt_unverified", + "exception_locations": [ + { + "file": "actuator.py", + "line": 321, + "exception_type": "ValueError" + }, + { + "file": "actuator.py", + "line": 23, + "exception_type": "ValueError" + }, + { + "file": "actuator.py", + "line": 325, + "exception_type": "ValueError" + }, + { + "file": "actuator.py", + "line": 397, + "exception_type": "ValueError" + }, + { + "file": "actuator.py", + "line": 399, + "exception_type": "SystemExit" + } + ], + "raw_output_withheld": true +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/railiance-platform-closure-consistency.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/railiance-platform-closure-consistency.json new file mode 100644 index 00000000..f80e4c8e --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/railiance-platform-closure-consistency.json @@ -0,0 +1,398 @@ +{ + "repo_slug": "railiance-platform", + "repo_path": "/home/worsch/railiance-platform", + "issues": [ + { + "severity": "WARN", + "check_id": "C-35", + "message": "Repo Manager missing: README.md: README.md is required for flavor tooling", + "file_path": "README.md", + "db_id": "", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-23", + "message": "Lifecycle drift in 'rpf-wp-0053': workplan status 'proposed' has an active task \u2014 report only (ADR-007: do not auto-promote proposed)", + "file_path": "workplans/RPF-WP-0053-coulomb-paired-backup-admission.md", + "db_id": "cb55e474-c7a5-5c6f-bd72-ce65f853e3e3", + "file_value": "proposed", + "db_value": "proposed", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0005", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub", + "file_path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0006", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0005' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0005", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0006' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0006", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0004' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0004", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0007' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0007", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-20", + "message": "Workplan dependency target 'RAILIANCE-WP-0008' is not linked to State Hub", + "file_path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "db_id": "", + "file_value": "RAILIANCE-WP-0008", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0003@retired-20260826' (id=665b3b9b\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "665b3b9b-608a-4be4-84b6-dcb8261ff57b", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0004@retired-20260826' (id=e57e487b\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "e57e487b-8557-439d-8093-0457c73ede93", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0005@retired-20260826' (id=2731fece\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "2731fece-6c49-45b8-ab8a-4ea6c04ac603", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0006@retired-20260826' (id=96c8a93d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "96c8a93d-7a5a-4fa9-8f7b-865119551da3", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0007@retired-20260826' (id=4d7ce243\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "4d7ce243-f40a-4249-a46a-a24f75d6fe4c", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0008@retired-20260826' (id=671898ef\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "671898ef-2378-4814-b8f6-066148cdad46", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0009@retired-20260826' (id=b059c81d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "b059c81d-96f1-451f-896f-a05cd73744a1", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0010@retired-20260826' (id=f364d405\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "f364d405-a85d-4b89-b600-1964ab436cad", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0029@retired-20260826' (id=038bc3c0\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "038bc3c0-4492-5b91-95eb-ae515ca205df", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0024@retired-20260826' (id=88c4ef7f\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "88c4ef7f-0af8-580e-90dc-a2bae2675a4d", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0023@retired-20260826' (id=ec52fbe6\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "ec52fbe6-571b-570e-884b-c7a32ff7bcc8", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0025@retired-20260826' (id=2422d4e7\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "2422d4e7-2125-591e-8e95-80ecc6e09da0", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "FAIL", + "check_id": "C-07", + "message": "Non-closed DB workstream 'railiance-wp-0027@retired-20260826' (id=6f8a6cbc\u2026) has no backing workplan file \u2014 ADR-001 violation", + "file_path": "", + "db_id": "6f8a6cbc-c076-5f0a-ade2-281a7ec71360", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0026@retired-20260826' (id=73878f8d\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "73878f8d-d8bb-5845-8a5c-91cdd83c1066", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0016@retired-20260826' (id=857ca302\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "857ca302-bb94-5d41-a649-1aa966368df4", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0022@retired-20260826' (id=a7977cbf\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "a7977cbf-ab43-56b7-b7a9-ceb52382b341", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-platform-railiance-wp-0011@retired-20260826' (id=3f9fd8de\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "3f9fd8de-7235-4486-aaa7-634dba2bb6fa", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0028@retired-20260826' (id=022dda1f\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "022dda1f-8772-57ad-862e-672924455f11", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0017@retired-20260826' (id=16e8f234\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "16e8f234-9305-5ff3-af82-4639215a0c54", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "INFO", + "check_id": "C-08", + "message": "Closed DB workstream 'railiance-wp-0015@retired-20260826' (id=1c73af72\u2026, status=finished) has no backing workplan file", + "file_path": "", + "db_id": "1c73af72-fd4b-5ab6-8ff7-a3c302bf55a5", + "file_value": "", + "db_value": "", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-PL-WP-0002' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0002", + "db_value": "RPF-WP", + "fixable": false + }, + { + "severity": "WARN", + "check_id": "C-26", + "message": "Workplan id 'RAIL-PL-WP-0001' uses prefix 'RAIL-PL-WP' but repo canonical prefix is 'RPF-WP' \u2014 new plans must conform", + "file_path": "workplans/archived/RAIL-PL-WP-0001-platform-baseline.md", + "db_id": "", + "file_value": "RAIL-PL-WP-0001", + "db_value": "RPF-WP", + "fixable": false + } + ], + "fixes_applied": [ + "bindings: synced 59/59", + "C-17 cleared: pushed 1 backlogged commit(s)", + "push: pushed" + ], + "summary": { + "fail": 3, + "automation_error": 0, + "warn": 18, + "info": 17 + }, + "result": "fail" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/release.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/release.json new file mode 100644 index 00000000..c7fa5113 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/release.json @@ -0,0 +1,46 @@ +{ + "phase": "release", + "all_checks_pass": true, + "raw_output_withheld": true, + "native_approval_verified_by_root": { + "approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c", + "disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f", + "accepted_at": "2026-10-11T10:40:55Z", + "verified_at": "2026-10-11T11:18:37.429056+00:00" + }, + "native_authenticated_grant": false, + "live_readonly_schema_integrity_counts": { + "schema_version": 5, + "lifecycle": { + "records": 17, + "events": 59, + "pending": 0 + }, + "outbox": { + "delivered": 344 + }, + "submissions": { + "confirmed": 44 + }, + "integrity": "ok", + "read_only_pre_open": true, + "store_constructed": false + }, + "live_counts_may_include_concurrent_commits": true, + "pod_name": "informed-decision-5557446c88-lvm88", + "pod_uid": "c4cb1550-feda-4097-9de4-d891a657b662", + "operation_requested": true, + "source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "resources": [ + { + "group": "apps", + "kind": "Deployment", + "name": "informed-decision", + "namespace": "informed-decision" + } + ], + "prune": false, + "rollout_verified": false, + "latest_live_database_retained": true, + "client_diff_sha256": "d61acc1da118dbd1dee8a94080c8b48a2e12f4b144704b2cb49f3443c49a3587" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/root-authority-helper-before-clock-correction.py b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/root-authority-helper-before-clock-correction.py new file mode 100644 index 00000000..c05efd05 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/root-authority-helper-before-clock-correction.py @@ -0,0 +1,42 @@ +import datetime,hashlib,json,os,stat,subprocess +from pathlib import Path +base=Path('/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release') +revision='312ab97e876e17341bf16f9e95397e14c2ac2720' +program='''import json,re,urllib.request +from datetime import datetime,timezone +from api.services.memo_dispatch import ORIGIN,NoRedirect,token_file +ident='infd-20261011-zlib-remediation-r1';expected='review-2cf690a6-8c46-4faa-826c-a24a88d53dea' +try: + request=urllib.request.Request(ORIGIN+'/v1/decisions/'+ident+'/outcomes?version=1',headers={'Authorization':'Bearer '+token_file('/var/run/secrets/state-hub/informed-decision/lifecycle-token')}) + opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect()) + with opener.open(request,timeout=20) as response: + raw=response.read(1024*1024+1) + if response.code!=200 or len(raw)>1024*1024:raise ValueError('response_refused') + value=json.loads(raw);review=value['review'];rows=value['dispositions'] + if not isinstance(review,dict) or review.get('memo_id')!=expected or review.get('stale') is not False or review.get('intake_state')!='ready' or not isinstance(rows,list):raise ValueError('review_refused') + if len(rows)!=1:print(json.dumps({'status':'approval_pending','disposition_count':len(rows)}));raise SystemExit(3) + row=rows[0];d=row['disposition'];founder={'kind':'person','sub':'uid=platform-root,ou=people,dc=netkingdom,dc=local'} + if row.get('submission_state')!='confirmed' or d.get('verb')!='accept':print(json.dumps({'status':'approval_not_confirmed_accept'}));raise SystemExit(3) + if d.get('actor')!=founder or d.get('memo_version')!=1 or d.get('memo_id')!=expected or not re.fullmatch('[a-f0-9-]{36}',d.get('approval_id','')) or not re.fullmatch('disp-[a-f0-9-]{36}',d.get('id','')):raise ValueError('founder_refused') + accepted=datetime.fromisoformat(d['at'].replace('Z','+00:00'));now=datetime.now(timezone.utc) + if accepted.tzinfo is None or accepted>now:raise ValueError('time_refused') + normalized={'memo_id':ident,'request_identity_origin':'fixed_authenticated_request_route','review':{'memo_id':expected,'intake_state':'ready','stale':False},'dispositions':[{'submission_state':'confirmed','disposition':{k:d[k] for k in ['id','at','memo_id','memo_version','verb','approval_id','actor']}}],'observed_at':now.isoformat()} + print(json.dumps({'status':'confirmed_founder_acceptance','normalized_outcome':normalized}),flush=True) +except SystemExit:raise +except Exception:print(json.dumps({'status':'native_readback_unverified'}),flush=True);raise SystemExit(1) from None +''' +run=subprocess.run(['ssh','railiance01','kubectl -n state-hub exec -i deployment/state-hub-memo-dispatch -c dispatcher -- python -'],input=program,text=True,capture_output=True,timeout=60) +try:result=json.loads(run.stdout) +except Exception:raise SystemExit('Native readback unverified; raw transport suppressed') +if run.returncode or result.get('status')!='confirmed_founder_acceptance':print(json.dumps({'status':result.get('status','native_readback_unverified'),'native_action':False}));raise SystemExit(3) +outcome=result['normalized_outcome'];d=outcome['dispositions'][0]['disposition'] +raw=(json.dumps(outcome,sort_keys=True,indent=2)+'\n').encode() +receipt=json.loads((base/'root-authority-receipt-template.json').read_text()) +receipt.update(memo_sha256=hashlib.sha256((base/'memo.json').read_bytes()).hexdigest(),source_revision=revision,executor_plan_sha256=hashlib.sha256((base/'execution/execution-plan.json').read_bytes()).hexdigest(),native_outcome_sha256=hashlib.sha256(raw).hexdigest(),activation='APPROVED',verified_at=outcome['observed_at'],review_memo_id=outcome['review']['memo_id'],approval_id=d['approval_id'],disposition_id=d['id'],accepted_at=d['at'],bounded_outage_rollback_pre_authorized=True) +for path,data in [(Path('/tmp/security-infd-zlib-native-outcome-latest.json'),raw),(Path('/tmp/security-infd-zlib-root-authority.json'),(json.dumps(receipt,indent=2)+'\n').encode())]: + if path.exists(): + info=path.lstat() + if not stat.S_ISREG(info.st_mode) or info.st_uid!=os.getuid() or info.st_nlink!=1:raise SystemExit('Authority custody refused') + fd=os.open(path,os.O_CREAT|os.O_TRUNC|os.O_WRONLY|os.O_NOFOLLOW,0o600);os.fchmod(fd,0o600) + with os.fdopen(fd,'wb') as f:f.write(data);f.flush();os.fsync(f.fileno()) +print(json.dumps({'status':'confirmed_founder_acceptance','approval_id':d['approval_id'],'disposition_id':d['id'],'accepted_at':d['at'],'source_revision':revision,'verified_at':receipt['verified_at'],'native_action':False})) diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/root-authority-helper-final.py b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/root-authority-helper-final.py new file mode 100644 index 00000000..6a344326 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/root-authority-helper-final.py @@ -0,0 +1,42 @@ +import datetime,hashlib,json,os,stat,subprocess +from pathlib import Path +base=Path('/home/worsch/informed-decision/docs/evidence/2026-10-11-zlib-image-release') +revision='312ab97e876e17341bf16f9e95397e14c2ac2720' +program='''import json,re,urllib.request +from datetime import datetime,timezone +from api.services.memo_dispatch import ORIGIN,NoRedirect,token_file +ident='infd-20261011-zlib-remediation-r1';expected='review-2cf690a6-8c46-4faa-826c-a24a88d53dea' +try: + request=urllib.request.Request(ORIGIN+'/v1/decisions/'+ident+'/outcomes?version=1',headers={'Authorization':'Bearer '+token_file('/var/run/secrets/state-hub/informed-decision/lifecycle-token')}) + opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect()) + with opener.open(request,timeout=20) as response: + raw=response.read(1024*1024+1) + if response.code!=200 or len(raw)>1024*1024:raise ValueError('response_refused') + value=json.loads(raw);review=value['review'];rows=value['dispositions'] + if not isinstance(review,dict) or review.get('memo_id')!=expected or review.get('stale') is not False or review.get('intake_state')!='ready' or not isinstance(rows,list):raise ValueError('review_refused') + if len(rows)!=1:print(json.dumps({'status':'approval_pending','disposition_count':len(rows)}));raise SystemExit(3) + row=rows[0];d=row['disposition'];founder={'kind':'person','sub':'uid=platform-root,ou=people,dc=netkingdom,dc=local'} + if row.get('submission_state')!='confirmed' or d.get('verb')!='accept':print(json.dumps({'status':'approval_not_confirmed_accept'}));raise SystemExit(3) + if d.get('actor')!=founder or d.get('memo_version')!=1 or d.get('memo_id')!=expected or not re.fullmatch('[a-f0-9-]{36}',d.get('approval_id','')) or not re.fullmatch('disp-[a-f0-9-]{36}',d.get('id','')):raise ValueError('founder_refused') + accepted=datetime.fromisoformat(d['at'].replace('Z','+00:00'));now=datetime.now(timezone.utc) + if accepted.tzinfo is None or accepted>now:raise ValueError('time_refused') + normalized={'memo_id':ident,'request_identity_origin':'fixed_authenticated_request_route','review':{'memo_id':expected,'intake_state':'ready','stale':False},'dispositions':[{'submission_state':'confirmed','disposition':{k:d[k] for k in ['id','at','memo_id','memo_version','verb','approval_id','actor']}}],'observed_at':now.isoformat()} + print(json.dumps({'status':'confirmed_founder_acceptance','normalized_outcome':normalized}),flush=True) +except SystemExit:raise +except Exception:print(json.dumps({'status':'native_readback_unverified'}),flush=True);raise SystemExit(1) from None +''' +run=subprocess.run(['ssh','railiance01','kubectl -n state-hub exec -i deployment/state-hub-memo-dispatch -c dispatcher -- python -'],input=program,text=True,capture_output=True,timeout=60) +try:result=json.loads(run.stdout) +except Exception:raise SystemExit('Native readback unverified; raw transport suppressed') +if run.returncode or result.get('status')!='confirmed_founder_acceptance':print(json.dumps({'status':result.get('status','native_readback_unverified'),'native_action':False}));raise SystemExit(3) +outcome=result['normalized_outcome'];d=outcome['dispositions'][0]['disposition'] +raw=(json.dumps(outcome,sort_keys=True,indent=2)+'\n').encode() +receipt=json.loads((base/'root-authority-receipt-template.json').read_text()) +receipt.update(memo_sha256=hashlib.sha256((base/'memo.json').read_bytes()).hexdigest(),source_revision=revision,executor_plan_sha256=hashlib.sha256((base/'execution/execution-plan.json').read_bytes()).hexdigest(),native_outcome_sha256=hashlib.sha256(raw).hexdigest(),activation='APPROVED',verified_at=datetime.datetime.now(datetime.timezone.utc).isoformat(),native_observed_at=outcome['observed_at'],review_memo_id=outcome['review']['memo_id'],approval_id=d['approval_id'],disposition_id=d['id'],accepted_at=d['at'],bounded_outage_rollback_pre_authorized=True) +for path,data in [(Path('/tmp/security-infd-zlib-native-outcome-latest.json'),raw),(Path('/tmp/security-infd-zlib-root-authority.json'),(json.dumps(receipt,indent=2)+'\n').encode())]: + if path.exists(): + info=path.lstat() + if not stat.S_ISREG(info.st_mode) or info.st_uid!=os.getuid() or info.st_nlink!=1:raise SystemExit('Authority custody refused') + fd=os.open(path,os.O_CREAT|os.O_TRUNC|os.O_WRONLY|os.O_NOFOLLOW,0o600);os.fchmod(fd,0o600) + with os.fdopen(fd,'wb') as f:f.write(data);f.flush();os.fsync(f.fileno()) +print(json.dumps({'status':'confirmed_founder_acceptance','approval_id':d['approval_id'],'disposition_id':d['id'],'accepted_at':d['at'],'source_revision':revision,'verified_at':receipt['verified_at'],'native_action':False})) diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/root-clock-diagnosis.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/root-clock-diagnosis.json new file mode 100644 index 00000000..4404ce9b --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/root-clock-diagnosis.json @@ -0,0 +1,5 @@ +{ + "immediate_authority_pass": false, + "delta_seconds": -1.1806, + "static_reason": "fresh root native readback required before every phase" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/verify.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/verify.json new file mode 100644 index 00000000..a23b7d17 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/verify.json @@ -0,0 +1,55 @@ +{ + "phase": "verify", + "all_checks_pass": true, + "raw_output_withheld": true, + "native_approval_verified_by_root": { + "approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c", + "disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f", + "accepted_at": "2026-10-11T10:40:55Z", + "verified_at": "2026-10-11T11:19:17.592644+00:00" + }, + "native_authenticated_grant": false, + "live_readonly_schema_integrity_counts": { + "schema_version": 5, + "lifecycle": { + "records": 17, + "events": 59, + "pending": 0 + }, + "outbox": { + "delivered": 344 + }, + "submissions": { + "confirmed": 44 + }, + "integrity": "ok", + "read_only_pre_open": true, + "store_constructed": false + }, + "live_counts_may_include_concurrent_commits": true, + "installed_zlib_files": { + "lib/apk/db/installed": "f590762196710e25c0e9f72da0642cad8a5dcba0aa9e58a0cbaa65684d15c001", + "usr/lib/libz.so.1.3.2": "ecc8b9dfc45eb7fa29b410ffaca6257873890de53b80fe91735737b49067c5f2" + }, + "zlib_package": "1.3.2-r1", + "installed_purpose_checks": { + "installed_image_purpose_variants": 10, + "binding_forms_allowed": 2, + "advisory_or_malformed_refused": 8, + "synthetic_only": true, + "native_provider": false + }, + "policy_sha256": "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62", + "policy_mode": "0644", + "policy_uid": 0, + "health_statuses": { + "/healthz": 200, + "/readyz": 200 + }, + "native_provider_probe": false, + "pod_name": "informed-decision-68d5f488d8-c576r", + "pod_uid": "1153f806-1e05-4596-baf3-a4fa8adf08be", + "native_rollout_verified": true, + "current_schema5_database_retained": true, + "recovery_verification": false +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-completion-progress-receipt.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completion-progress-receipt.json new file mode 100644 index 00000000..8bf03ee5 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-completion-progress-receipt.json @@ -0,0 +1,6 @@ +{ + "id": "4f1c2046-f7af-47ff-ba4e-1631e86fa6b5", + "workplan_id": "77eaeabf-0644-595f-b3d5-1168e6a294c4", + "task_id": "1743596f-8558-5a6b-afef-4dd5c1e9c0ae", + "status": "native_completed_and_source_closed" +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-confirmed-authority-receipt.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-confirmed-authority-receipt.json new file mode 100644 index 00000000..cb3baa52 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-confirmed-authority-receipt.json @@ -0,0 +1,22 @@ +{ + "proposal_id": "INFD-WP-0009-T05/zlib85091-r1", + "memo_id": "infd-20261011-zlib-remediation-r1", + "memo_version": 1, + "memo_sha256": "5dea0d404e4d13683fbf71d56273c06db7a6a916ab68759a90d7394005eee206", + "source_revision": "312ab97e876e17341bf16f9e95397e14c2ac2720", + "executor_plan_sha256": "d871081999215bd3850ab1173064ed6cb6d7c23b26d9c3d5b3c5940e698d4c61", + "native_outcome_sha256": "1159fd4f0a36da0ca144f005ad8f8780aeb412044253ae1d65705d36047dd7dc", + "activation": "APPROVED", + "authority_mode": "ADMINISTER", + "target": "realm:kubernetes/railiance01/informed-decision", + "verification_method": "root-fixed-origin-native-readback", + "runtime_authenticated_grant": false, + "outcome_query": "/lifecycle/memos/infd-20261011-zlib-remediation-r1/outcomes?version=1", + "verified_at": "2026-10-11T10:43:45.008249+00:00", + "review_memo_id": "review-2cf690a6-8c46-4faa-826c-a24a88d53dea", + "approval_id": "b5ce337c-5d7d-44fa-864d-706b54039f7c", + "disposition_id": "disp-cf61c2cf-4a7d-4672-8bc2-de2e4641916f", + "accepted_at": "2026-10-11T10:40:55Z", + "bounded_outage_rollback_pre_authorized": true, + "note": "Template is not evidence/approval. Root sets scopedpreauthorizationtrue only after actual confirmed founder acceptance of this exact new packet/terms, retains original currentreadback before release." +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-human-flag-closure-receipt.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-human-flag-closure-receipt.json new file mode 100644 index 00000000..86812695 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-human-flag-closure-receipt.json @@ -0,0 +1,5 @@ +{ + "task_id": "1743596f-8558-5a6b-afef-4dd5c1e9c0ae", + "status": "done", + "needs_human": false +} diff --git a/docs/evidence/2026-10-10-security-consolidation/zlib-native-made-decision-receipt.json b/docs/evidence/2026-10-10-security-consolidation/zlib-native-made-decision-receipt.json new file mode 100644 index 00000000..46e41b92 --- /dev/null +++ b/docs/evidence/2026-10-10-security-consolidation/zlib-native-made-decision-receipt.json @@ -0,0 +1,7 @@ +{ + "id": "2b81326f-4c09-5c66-88d1-84af4e5895fd", + "title": "Founder approves exact zlib remediation; protected drill and native rollout verified", + "decision_type": "made", + "status": "resolved", + "decided_at": "2026-10-11T10:40:55Z" +} diff --git a/docs/security-close-down-checklist.md b/docs/security-close-down-checklist.md index 394161f8..efa29e15 100644 --- a/docs/security-close-down-checklist.md +++ b/docs/security-close-down-checklist.md @@ -25,4 +25,4 @@ Add a row whenever you loosen, shortcut or leave unarmed a control. Remove nothi | 16 | Intake doctrine conditions (gate-house C1–C6) | Draft ruling GH-DEC-2026-023 (gate-house `aac350d`, status proposed, awaiting the founder). C1–C6 apply now; R3 (row 9) is the main relaxation (F1), R2 (row 8) also covers C6, R5 (row 11) also covers C5. | Remove the `compact-sitting` exact-record branch once its memos are terminal; re-arm R3 with an access-engine approval-claim check and a signed intake receipt. | gate-house, informed-decision, access-engine | 2026-10-03 | | 17 | Owner reviews and approval recording (canon `delegated-owner-review_v0.1`) | Owner reviews required by CCRs and similar records are written by each owner repo's worker agent from its INTENT.md, not by a human owner. The requesting agent records the founder's resolved hub decision (status, binding confirmations, admission markers) and commits. The founder still decides; `decided_by` is unauthenticated (rows 8, 12). | Reviews and recordings signed by authenticated agent workload identities; recording tooling verifies an authenticated human resolver; human owner review restored for red-lane records if wanted. | the-custodian | 2026-10-07 | | 18 | Ordinary authenticated operator/PDP admission for User Engine application.register | Executed one-use exception USER-CATALOGUE-INFDEC-20261011-R1 under confirmed founder approval b859698b-5d08-4da5-9599-4760c6a799f1 (02:07:09Z). Exact executor b0dbbb97 and transport3e594e0e; packet307c4fc5, grant SHA 72ee846034809f4ae6848eac3a43f2b7390f1df7a67ede50eff7435d1b43f839. Two exact informed-decision catalogue records committed; genuine denial retained, three truthful audits, one consumed ledger and unsent/unclaimed registered event verified. Private grant removed. Ordinary management admission remains unmet; no IAM/human claim/future registration/targeted replay authority. Execution deadline2026-10-12T23:59:59Z does not erase facts. [Outcome](evidence/2026-10-10-security-consolidation/user-catalogue-independent-postapply-verification.json). | Before customer production, supported authenticated operator management with genuine ordinary allow/deny/attribution and unavailable refusal; retire bootstrap use, preserve/reconcile ledger/audits/events. Broader USER-WP-0026-T03/USER-WP-0028-T02 remain live; no human journey completion inferred. | user-engine, access-engine; Custodian tracks | 2026-10-11 | -| 19 | Fresh informed-decision readback during a failed T05 rollout | Proposed only; no exception approved or used. The new INFD-WP-0009-T05/zlib-85091-r1 packet will request manual, supervised rollback to exact image763c/sourcec96 if the candidate makes informed-decision unavailable. Proposed limits: separately confirmed founder consent retained before release, exact same journal/source/Deployment/config/PVC, at most30minutes after release and before2026-10-12T23:59:59Z. Later revocation cannot be checked during the outage. No fallback on401/403, explicit revocation, conflicts or mismatches; no cached authority for backups or release. | Close this one-use entry with actual disposition and trial outcome. Preserve the ordinary fresh-authority gate; do not reuse the outage path after its window, for another trial or for customer production. A future standing recovery mechanism needs independently obtainable authority and its own review. | informed-decision, railiance-platform; Custodian tracks | 2026-10-11 | +| 19 | Fresh informed-decision readback during a failed T05 rollout | Exact new trial INFD-WP-0009-T05/zlib85091-r1 approved under founder acceptance b5ce337c-5d7d-44fa-864d-706b54039f7c at2026-10-11T10:40:55Z. Image f558/source312ab97 verified Ready and actual canonical lifecycle HTTP200 at11:20:25Z, with latest database preserved. Proposed bounded30minute manual outage recovery was expressly accepted but never invoked; trial completed. Original proposed packet and pre-execution refusals remain immutable. [Outcome](evidence/2026-10-10-security-consolidation/zlib-native-completed/canonical-provider-verification.json). | Completed2026-10-11. Ordinary fresh-authority gate retained; no standing cached authority, autonomy promotion, other-trial or customer-production reuse. Any future standing recovery mechanism needs independently obtainable authority and separate review. | informed-decision, railiance-platform; Custodian tracks | 2026-10-11 | diff --git a/docs/security-collaboration-review-2026-10-10.md b/docs/security-collaboration-review-2026-10-10.md index 9304ce26..8a2fc43f 100644 --- a/docs/security-collaboration-review-2026-10-10.md +++ b/docs/security-collaboration-review-2026-10-10.md @@ -502,3 +502,43 @@ INFD Product and Platform independently accepted the exact deployed purpose imag `INFD-WP-0009-T04` is done in source commit `0693c40`; T05 remains live for the inherited fixable MEDIUM zlib finding, due October 18. `INFD-IN-0010` is the unpromoted live handoff for the verifier omission defect before future reuse. WP0009 remains active. The same 13-owner source inventory now totals **47 open plans (45 nonresidual + 2 residual), 101 unfinished tasks**, compared with the previous per-repo sum of 47/102. A previously zeroed cached `_total` was corrected from authoritative per-repo arithmetic; the exact prior snapshot remains retained. Forgejo source acknowledgment is recorded in Net commit `f6856cd` and the separate application-owner design receipt `d349815`. Explicit version selection is committed at `bb9b9b5`, with 43 loader/validator and 22 package compatibility tests passing. Both actual acknowledged types remain unimplemented and reject ordinary admission; canonical 1.1 and all native provider pins stay unchanged. Six-object materialization, authenticated provenance, adapters and first session remain under the existing ORGREF/owner gates. + +### Zlib remediation completed and owner workplan closed + +The founder accepted the distinct T05 packet at10:40:55Z on2026-10-11, approval +`b5ce337c-5d7d-44fa-864d-706b54039f7c`. All eight supervised phases completed: +fresh private backup and verified copy, isolated no-network schema5 restore +compatibility, exact clone cleanup, fresh cutover backup/copy, one-Deployment +manual non-pruning rollout and installed verification. Image `f5588f49…` is +actually deployed at Argo source `312ab97`, generation26Ready1. Installed zlib +is1.3.2-r1; the current full immutable-image scan has zero findings across44 +packages. Schema, integrity and all recorded counts remain intact. Ten installed +purpose fixtures include eight refusals; actual authenticated canonical lifecycle +outcomes returnedHTTP200 at11:20:25Z, with the same Pod/image/source verified +before and after. Database-preserving rollback remained available and unused. + +Three pre-execution refusals occurred before any custody or durable phase +journal existed. Root had used the service clock,1.1806seconds ahead, as its own +verification timestamp. Root-only bookkeeping now uses local verification time +and retains the service timestamp separately. Failed receipts and original +helper bytes remain retained; approved actuator, render, memo and plan bytes did +not change. This refinement is recorded in the same trial, not another scored +success. The earlier sandbox hypothesis was disproven. Checklist19 records the +exact accepted, unused one-trial outage option without a standing authority or +autonomy grant. + +Separate owner returns are recorded under completed Product T10 and Platform +RPF-IN-0010. Product commit `47881fc` closes T05, resolves only +INFD-RISK-20261011-ZLIB-85091 and finishes INFD-WP-0009; Platform `8647587` +records actual native acceptance. Live INFD-IN-0010 and INFD-IN-0009 residual +handoffs remain unpromoted. Original T04 failed/UNCERTAIN evidence remains +unchanged. Safe receipts are in +`docs/evidence/2026-10-10-security-consolidation/zlib-native-completed/`. + +The same13-owner source inventory is now **46 open plans (44 nonresidual and2 +residual),100 unfinished tasks**, compared with the initial49/105. Broader User +Engine human journey/ordinary management, Forgejo type implementation/native +materialization and first session remain in their existing owner records and +ORGREF driver. Three historical Platform C07 aliases still hold13 tasks +(8done/5wait); their diagnosis is retained, with no deletion or artificial +closure. Source totals do not silently include those unbacked historical rows. diff --git a/workplans/CUST-WP-0078-security-collaboration-consolidation.md b/workplans/CUST-WP-0078-security-collaboration-consolidation.md index 1f4bf9f0..a69dce32 100644 --- a/workplans/CUST-WP-0078-security-collaboration-consolidation.md +++ b/workplans/CUST-WP-0078-security-collaboration-consolidation.md @@ -116,3 +116,19 @@ ORGREF-WP-0002 project driver. This is continuing owner work after the bounded coordination wave, not a claim of whole-estate completion. The latest thirteen-owner source count is 48 open plans (46 nonresidual, two residual), 102 unfinished task blocks. + +Final native follow-through checkpoint, 2026-10-11: Policy Nexus hosting and +the exact one-application catalogue exception are deployed and verified under +their distinct founder decisions. Forgejo type1.2 has actual source +acknowledgment; its type implementation and native first session remain with +the existing ORGREF driver and owners. Informed-decision T04 and T05 are +actually verified, and Product `47881fc` finishes INFD-WP-0009; Platform +`8647587` records independent native acceptance. Fixed imagef558 is Ready, +schema5/data retained, fresh full44-package scan zero, and actual authenticated +canonical lifecycle returnsHTTP200. Protected restore drill and exact +non-pruning one-Deployment rollout completed; outage recovery was unused. +Live INFD-IN-0010/0009 handoffs remain unpromoted and original failed evidence +remains intact. The latest same13-owner source count is46open plans +(44nonresidual+2residual),100unfinished tasks. Actual receipts and remaining +owner boundaries are in the updated security collaboration review; this +checkpoint does not claim whole-estate completion.