{"repro_id":"REPRO-2026-00152","version":8,"title":"apko: symlink-following path traversal writes files outside the build root","repro_type":"security","status":"published","severity":"high","description":"apko's package install path uses `dirFS`, which **follows symlinks**.\n\nA crafted `.apk` package can install a `TypeSymlink` tar entry whose target\npoints *outside the build root*. A later directory-creation or file-write tar\nentry then resolves *through* that planted symlink, so the write lands outside\nthe build root.\n\nAn attacker who controls the contents of an `.apk` package that apko installs\ncan therefore write files outside the intended build root directory during\n`apk install`.","root_cause":"# Root Cause Analysis: CVE-2026-42574\n\n## Summary\n\nCVE-2026-42574 is a path-traversal vulnerability in `chainguard.dev/apko` caused by the `dirFS` implementation following attacker-controlled symlinks during filesystem operations. A crafted `.apk` package can plant a symlink inside the build root whose target points outside the intended directory; a subsequent tar entry whose path resolves through that symlink causes file writes or directory creations to land outside the build root, allowing arbitrary filesystem modification during package installation.\n\n## Impact\n\n- **Package/component affected**: `chainguard.dev/apko/pkg/apk/fs` (`dirFS`)\n- **Affected versions**: `0.14.8` through `< 1.2.5`\n- **Fixed versions**: `1.2.5`\n- **Risk level**: High (CVSS 7.5)\n- **Consequences**: An attacker who controls the contents of an `.apk` package processed by apko can write files or create directories anywhere on the host filesystem reachable by the apko process, leading to arbitrary code execution, information disclosure, or container image poisoning.\n\n## Root Cause\n\nThe vulnerable `dirFS` type (`pkg/apk/fs/rwosfs.go`) implements a directory-backed filesystem by joining caller-supplied paths with a base directory. Before the fix, `sanitizePath` used `filepath.Clean(filepath.Join(f.base, clean))` to validate paths. This check is purely lexical — it ensures the cleaned path remains under `f.base` but does **not** prevent the operating system from resolving symlinks when `os.WriteFile`, `os.MkdirAll`, or `os.OpenFile` is later called with the validated path.\n\nBecause `os.WriteFile(\"base/evil/pwned\", ...)` follows the symlink `base/evil -> ../outside`, the write lands at `outside/pwned` even though `sanitizePath` permitted `\"evil/pwned\"` as in-bounds. The same issue affects `MkdirAll`, `OpenFile`, `Chmod`, `Chown`, and other `dirFS` methods.\n\nThe fix commit `f5a96e1299ac81c7ea9441705ec467688086f442` replaces `sanitizePath` and raw `os.*` calls with `os.Root`, which sandboxes every filesystem operation so that symlink traversal outside the root directory is rejected by the Go standard library at the syscall level.\n\n## Reproduction Steps\n\nThe reproduction is fully automated by `repro/reproduction_steps.sh`.\n\nWhat the script does:\n1. Writes a self-contained Go program (`repro/main.go`) that imports `chainguard.dev/apko/pkg/apk/fs`.\n2. The program creates a temporary sandbox with a `base` directory and an `outside` directory.\n3. It initializes `apkfs.DirFS` on `base`, plants a symlink `evil -> ../outside`, and calls `fsys.WriteFile(\"evil/pwned\", []byte(\"malicious-content\"), 0644)`.\n4. The program writes a JSON report capturing whether the file was created outside the base directory and what error (if any) was returned.\n5. The script compiles and runs the program against the vulnerable module version `v1.2.4` and the fixed version `v1.2.5`.\n6. It compares the JSON reports: on the vulnerable build the outside file exists with attacker-controlled content; on the fixed build the write is blocked and the outside file is absent.\n\nExpected evidence:\n- **Vulnerable (`v1.2.4`)**: `report.file_exists == true`, `report.file_content == \"malicious-content\"`. The `write_error` field shows `\"file does not exist\"` (the memFS overlay fails, but the on-disk write through the symlink already succeeded).\n- **Fixed (`v1.2.5`)**: `report.file_exists == false`, `write_error` shows `\"openat evil/pwned: path escapes from parent\"` (blocked by `os.Root`).\n\n## Evidence\n\n- `repro/runtime_manifest.json` — contains the full JSON reports from both runs, including concrete sandbox paths, file contents, and error messages.\n- `logs/vuln_report.json` — detailed report from the vulnerable run.\n- `logs/fix_report.json` — detailed report from the fixed run.\n\nKey excerpts from `runtime_manifest.json`:\n\n```json\n{\n  \"vulnerable_report\": {\n    \"outside_file\": \"/tmp/apko-repro-310748142/outside/pwned\",\n    \"write_error\": \"file does not exist\",\n    \"file_exists\": true,\n    \"file_content\": \"malicious-content\"\n  },\n  \"fixed_report\": {\n    \"outside_file\": \"/tmp/apko-repro-3615258946/outside/pwned\",\n    \"write_error\": \"openat evil/pwned: path escapes from parent\",\n    \"file_exists\": false\n  }\n}\n```\n\nEnvironment: Go 1.24.7 (linux/amd64), `chainguard.dev/apko` fetched from the Go module proxy.\n\n## Recommendations / Next Steps\n\n- **Fix approach**: Adopt `os.Root` (Go 1.25+) for all filesystem operations scoped to a directory, as done in commit `f5a96e1299ac81c7ea9441705ec467688086f442`. `os.Root` prevents both direct `..` traversal and symlink-following escapes without requiring manual path resolution.\n- **Upgrade guidance**: Upgrade `chainguard.dev/apko` to `v1.2.5` or later.\n- **Testing recommendations**: Add fuzz-style tests that plant symlinks with absolute, relative (`../outside`), and chained targets, then attempt `WriteFile`, `MkdirAll`, `OpenFile(O_CREATE)`, `Link`, and `Mknod` through them. Ensure all attempts are rejected and no files appear outside the root.\n\n## Additional Notes\n\n- **Idempotency**: `repro/reproduction_steps.sh` was executed twice consecutively with identical results.\n- **Edge cases**: The reproduction exercises the `WriteFile` path, which is the simplest demonstration of the `dirFS` symlink-follow vulnerability. The same root cause affects `MkdirAll`, `OpenFile`, `Chmod`, `Chown`, and `Mknod`. The fix commit added explicit tests for all of these variants.\n- **Limitations**: The reproduction uses the public `apkfs.DirFS` API directly rather than the full `apko build` CLI workflow, because the CLI requires a signed APK repository, index, and YAML configuration. The `dirFS` layer is the shared component used by the package-install path, so a direct `dirFS` reproduction is the most reliable and minimal demonstration of the bug.\n","ghsa_id":"GHSA-qq3r-w4hj-gjp6","cve_id":"CVE-2026-42574","cwe_id":"CWE-22 (Path Traversal)","source_url":"https://github.com/chainguard-dev/apko","package":{"name":"apko","ecosystem":"go","affected_versions":">= 0.14.8, < 1.2.5","fixed_version":"1.2.5"},"reproduced_at":"2026-05-22T18:30:25.601631+00:00","duration_secs":1223.7092287540436,"tool_calls":236,"turns":168,"handoffs":3,"total_cost_usd":2.2169778499999993,"agent_costs":{"repro":1.0223743299999997,"support":0.04753993,"vuln_variant":1.14706359},"cost_breakdown":{"repro":{"accounts/fireworks/models/kimi-k2p6":1.0223743299999997},"support":{"accounts/fireworks/models/kimi-k2p6":0.04753993},"vuln_variant":{"accounts/fireworks/models/kimi-k2p6":1.14706359}},"quality":{"idempotent_verified":false,"community_verifications":0},"published_at":"2026-05-22T18:30:29.256609+00:00","retracted":false,"artifacts":[{"path":"repro/rca_report.md","filename":"rca_report.md","size":5796,"category":"analysis"},{"path":"repro/reproduction_steps.sh","filename":"reproduction_steps.sh","size":3590,"category":"reproduction_script"},{"path":"vuln_variant/rca_report.md","filename":"rca_report.md","size":7935,"category":"analysis"},{"path":"vuln_variant/reproduction_steps.sh","filename":"reproduction_steps.sh","size":6458,"category":"reproduction_script"},{"path":"bundle/context.json","filename":"context.json","size":2987,"category":"other"},{"path":"bundle/metadata.json","filename":"metadata.json","size":666,"category":"other"},{"path":"bundle/ticket.md","filename":"ticket.md","size":3473,"category":"ticket"},{"path":"repro/go.mod","filename":"go.mod","size":592,"category":"other"},{"path":"repro/main.go","filename":"main.go","size":1845,"category":"other"},{"path":"repro/runtime_manifest.json","filename":"runtime_manifest.json","size":723,"category":"other"},{"path":"repro/validation_verdict.json","filename":"validation_verdict.json","size":1686,"category":"other"},{"path":"repro/go.sum","filename":"go.sum","size":4182,"category":"other"},{"path":"vuln_variant/root_cause_equivalence.json","filename":"root_cause_equivalence.json","size":2079,"category":"other"},{"path":"vuln_variant/patch_analysis.md","filename":"patch_analysis.md","size":5972,"category":"documentation"},{"path":"vuln_variant/variant_manifest.json","filename":"variant_manifest.json","size":2764,"category":"other"},{"path":"vuln_variant/runtime_manifest.json","filename":"runtime_manifest.json","size":1694,"category":"other"},{"path":"vuln_variant/validation_verdict.json","filename":"validation_verdict.json","size":2807,"category":"other"},{"path":"vuln_variant/source_identity.json","filename":"source_identity.json","size":652,"category":"other"},{"path":"vuln_variant/test_env/go.mod","filename":"go.mod","size":689,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/go.mod","filename":"go.mod","size":6613,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/NEWS.md","filename":"NEWS.md","size":10167,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/release.md","filename":"release.md","size":2744,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/hack/update-golden.sh","filename":"update-golden.sh","size":506,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/hack/ci/01-publish.sh","filename":"01-publish.sh","size":944,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/hack/ci/00-build.sh","filename":"00-build.sh","size":600,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/hack/update-packages.sh","filename":"update-packages.sh","size":953,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/hack/test-certificates.sh","filename":"test-certificates.sh","size":3527,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/hack/make-devenv.sh","filename":"make-devenv.sh","size":1988,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/hack/ci-tests.sh","filename":"ci-tests.sh","size":420,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/hack/run-devenv.sh","filename":"run-devenv.sh","size":409,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/config/task.yaml","filename":"task.yaml","size":1895,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/Makefile","filename":"Makefile","size":4838,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/apk.md","filename":"apk.md","size":304,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/.github/dependabot.yml","filename":"dependabot.yml","size":250,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.github/workflows/examples-test.yaml","filename":"examples-test.yaml","size":4417,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.github/workflows/release.yaml","filename":"release.yaml","size":4816,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.github/workflows/codeql.yaml","filename":"codeql.yaml","size":2450,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.github/workflows/zizmor.yaml","filename":"zizmor.yaml","size":1185,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.github/workflows/build.yaml","filename":"build.yaml","size":2187,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.github/workflows/build-samples.yml","filename":"build-samples.yml","size":14790,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.github/workflows/verify.yaml","filename":"verify.yaml","size":1460,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.github/workflows/go-tests.yaml","filename":"go-tests.yaml","size":1281,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.github/workflows/actionlint.yaml","filename":"actionlint.yaml","size":1489,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/README.md","filename":"README.md","size":4967,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/main.go","filename":"main.go","size":1044,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/LICENSE","filename":"LICENSE","size":11357,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.gitignore","filename":".gitignore","size":357,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/wolfi-go.yaml","filename":"wolfi-go.yaml","size":291,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/include.yaml","filename":"include.yaml","size":35,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/apko-devenv.yaml","filename":"apko-devenv.yaml","size":1067,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/options.yaml","filename":"options.yaml","size":247,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/alpine-base-rootless.yaml","filename":"alpine-base-rootless.yaml","size":397,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/package-certificates.yaml","filename":"package-certificates.yaml","size":464,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/on_top_of_base/README.md","filename":"README.md","size":776,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/on_top_of_base/build.sh","filename":"build.sh","size":1276,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/on_top_of_base/base_image.yaml","filename":"base_image.yaml","size":390,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/certificates.yaml","filename":"certificates.yaml","size":3785,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/alias-only.yaml","filename":"alias-only.yaml","size":130,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/alpine-amd64.yaml","filename":"alpine-amd64.yaml","size":146,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/alpine-python3.yaml","filename":"alpine-python3.yaml","size":280,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/nginx.yaml","filename":"nginx.yaml","size":904,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/alpine-base.yaml","filename":"alpine-base.yaml","size":278,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/overlay.yaml","filename":"overlay.yaml","size":69,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/abseil-regression.yaml","filename":"abseil-regression.yaml","size":222,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/alpine-slim.yaml","filename":"alpine-slim.yaml","size":307,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/nginx-rootless.yaml","filename":"nginx-rootless.yaml","size":804,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/wolfi-base.yaml","filename":"wolfi-base.yaml","size":204,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/examples/old-glibc.yaml","filename":"old-glibc.yaml","size":405,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.editorconfig","filename":".editorconfig","size":184,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/go.sum","filename":"go.sum","size":35566,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.ko.yaml","filename":".ko.yaml","size":784,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/header.tmpl","filename":"header.tmpl","size":565,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/.goreleaser.yaml","filename":".goreleaser.yaml","size":974,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/docs/build-process.md","filename":"build-process.md","size":4243,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/docs/layering.md","filename":"layering.md","size":25231,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/docs/apko_file.md","filename":"apko_file.md","size":8644,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/docs/sbom-composition.md","filename":"sbom-composition.md","size":7185,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/docs/busybox.md","filename":"busybox.md","size":1613,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/docs/faq.md","filename":"faq.md","size":1087,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/.chainguard/source.yaml","filename":"source.yaml","size":406,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/CODE_OF_CONDUCT.md","filename":"CODE_OF_CONDUCT.md","size":5224,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/gen-jsonschema/main.go","filename":"main.go","size":828,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/gen-jsonschema/generate.go","filename":"generate.go","size":667,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/ldsocache_test.go","filename":"ldsocache_test.go","size":5653,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/README.md","filename":"README.md","size":65,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/LICENSE","filename":"LICENSE","size":11357,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/.gitignore","filename":".gitignore","size":264,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/ld.so.conf.d/b.conf","filename":"b.conf","size":8,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/ld.so.conf.d/a.conf","filename":"a.conf","size":8,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/ld.so.conf.glob","filename":"ld.so.conf.glob","size":28,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/ld.so.cache","filename":"ld.so.cache","size":3103,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/ld.so.conf.simple","filename":"ld.so.conf.simple","size":5,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/libroot/etc/ld.so.conf.d/sdk-v1.conf","filename":"sdk-v1.conf","size":22,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/libroot/etc/ld.so.conf.d/sdk-v2.conf","filename":"sdk-v2.conf","size":22,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/libroot/etc/ld.so.conf.d/libc.conf","filename":"libc.conf","size":64,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/libroot/etc/ld.so.conf","filename":"ld.so.conf","size":34,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/libroot/usr/lib/libfoo.so.1","filename":"libfoo.so.1","size":39,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/libroot/usr/local/sdk-v2/lib/libsdk.so.1.3.1","filename":"libsdk.so.1.3.1","size":39,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/libroot/usr/local/lib64/.emptydir","filename":".emptydir","size":0,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/testdata/libroot/usr/local/sdk-v1/lib/libsdk.so.1.2.3","filename":"libsdk.so.1.2.3","size":39,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/ldso-cache/ldsocache.go","filename":"ldsocache.go","size":16016,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/install-keys.go","filename":"install-keys.go","size":1134,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/lock.go","filename":"lock.go","size":12676,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/commands.go","filename":"commands.go","size":2482,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/show-config.go","filename":"show-config.go","size":2949,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/build-cpio.go","filename":"build-cpio.go","size":3786,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/lock_test.go","filename":"lock_test.go","size":3317,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/build-minirootfs.go","filename":"build-minirootfs.go","size":3699,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/flags.go","filename":"flags.go","size":1741,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/options.go","filename":"options.go","size":481,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/clean.go","filename":"clean.go","size":3802,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/publish.go","filename":"publish.go","size":9655,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/build.go","filename":"build.go","size":13181,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/show-packages.go","filename":"show-packages.go","size":7100,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/build_test.go","filename":"build_test.go","size":4794,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/publish_test.go","filename":"publish_test.go","size":7489,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/dot.go","filename":"dot.go","size":17471,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/apko-discover.yaml","filename":"apko-discover.yaml","size":278,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/metadata/aarch64/APKINDEX","filename":"APKINDEX","size":1259,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/metadata/x86_64/APKINDEX","filename":"APKINDEX","size":1256,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/oci-layout","filename":"oci-layout","size":37,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/sboms/sbom-aarch64.spdx.json","filename":"sbom-aarch64.spdx.json","size":5533,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/sboms/sbom-index.spdx.json","filename":"sbom-index.spdx.json","size":4225,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/sboms/sbom-x86_64.spdx.json","filename":"sbom-x86_64.spdx.json","size":5531,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/blobs/sha256/583625b6164fff3b017f62b9fcd60cb53fff18a7e89ee538212134a13fc29fb1","filename":"583625b6164fff3b017f62b9fcd60cb53fff18a7e89ee538212134a13fc29fb1","size":4123,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/blobs/sha256/bf74ddaf55d32ec9672a0a40efc6cb1bf0a167763c18fc22586c8a301167822f","filename":"bf74ddaf55d32ec9672a0a40efc6cb1bf0a167763c18fc22586c8a301167822f","size":4126,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/blobs/sha256/2ef91a9967f2e1759ea49a8c01cf6a45dd9f9af71fe09bcf2b86175bc4a71314","filename":"2ef91a9967f2e1759ea49a8c01cf6a45dd9f9af71fe09bcf2b86175bc4a71314","size":402,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/blobs/sha256/5a99438a9ced8193f1d71209d0b558fdc0b184aee5cf258e5f7aa9a6ab0f0671","filename":"5a99438a9ced8193f1d71209d0b558fdc0b184aee5cf258e5f7aa9a6ab0f0671","size":402,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/blobs/sha256/65eba664f408f8a2b2cf6b190255c8b0e8cb16a85d773089ae184ac35d782464","filename":"65eba664f408f8a2b2cf6b190255c8b0e8cb16a85d773089ae184ac35d782464","size":524,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/blobs/sha256/2580c204e7b254c8988c5cd1840cd58246afafb2479190b6cb3f448341003a5f","filename":"2580c204e7b254c8988c5cd1840cd58246afafb2479190b6cb3f448341003a5f","size":524,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image/index.json","filename":"index.json","size":491,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/top_image/oci-layout","filename":"oci-layout","size":37,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/top_image/blobs/sha256/52a254489d2b6d123a52b293b7032cca79834ce9f0176151c52754a0c7b1d1ea","filename":"52a254489d2b6d123a52b293b7032cca79834ce9f0176151c52754a0c7b1d1ea","size":785,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/top_image/blobs/sha256/3c6b4bb5b39be26700e6baff9d83a53bba4a0d994e22638d11a4c104bc9e39c9","filename":"3c6b4bb5b39be26700e6baff9d83a53bba4a0d994e22638d11a4c104bc9e39c9","size":631,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/top_image/blobs/sha256/583625b6164fff3b017f62b9fcd60cb53fff18a7e89ee538212134a13fc29fb1","filename":"583625b6164fff3b017f62b9fcd60cb53fff18a7e89ee538212134a13fc29fb1","size":4123,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/top_image/blobs/sha256/bf74ddaf55d32ec9672a0a40efc6cb1bf0a167763c18fc22586c8a301167822f","filename":"bf74ddaf55d32ec9672a0a40efc6cb1bf0a167763c18fc22586c8a301167822f","size":4126,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/top_image/blobs/sha256/ff58773a945b386b75663553a7f451c4f6116ec6fac9c22ef41ebaf27704a566","filename":"ff58773a945b386b75663553a7f451c4f6116ec6fac9c22ef41ebaf27704a566","size":2945,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/top_image/blobs/sha256/7bd766d91d366d79c001436814bdfd629ef6da668805945c414cb074ddb7f0ed","filename":"7bd766d91d366d79c001436814bdfd629ef6da668805945c414cb074ddb7f0ed","size":2955,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/top_image/blobs/sha256/9743477d70b66d27d627eb7dc1a548dee98ad742b195e24545b73a1c7113aea8","filename":"9743477d70b66d27d627eb7dc1a548dee98ad742b195e24545b73a1c7113aea8","size":631,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/top_image/blobs/sha256/e83f38a3553148f2189193b4908cce3576907dacddc14617d0e8d22370c80cce","filename":"e83f38a3553148f2189193b4908cce3576907dacddc14617d0e8d22370c80cce","size":785,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/top_image/index.json","filename":"index.json","size":565,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/packages/melange.rsa.pub","filename":"melange.rsa.pub","size":800,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/packages/aarch64/replayout-1.0.0-r0.apk","filename":"replayout-1.0.0-r0.apk","size":2955,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/packages/aarch64/pretend-baselayout-1.0.0-r0.apk","filename":"pretend-baselayout-1.0.0-r0.apk","size":2930,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/packages/aarch64/custom-ca-certs-2-1.0.0-r0.apk","filename":"custom-ca-certs-2-1.0.0-r0.apk","size":4549,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/packages/aarch64/APKINDEX.tar.gz","filename":"APKINDEX.tar.gz","size":1133,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/packages/aarch64/custom-ca-certs-1-1.0.0-r0.apk","filename":"custom-ca-certs-1-1.0.0-r0.apk","size":7001,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/packages/x86_64/replayout-1.0.0-r0.apk","filename":"replayout-1.0.0-r0.apk","size":2961,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/packages/x86_64/pretend-baselayout-1.0.0-r0.apk","filename":"pretend-baselayout-1.0.0-r0.apk","size":2930,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/packages/x86_64/custom-ca-certs-2-1.0.0-r0.apk","filename":"custom-ca-certs-2-1.0.0-r0.apk","size":4548,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/packages/x86_64/APKINDEX.tar.gz","filename":"APKINDEX.tar.gz","size":1138,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/packages/x86_64/custom-ca-certs-1-1.0.0-r0.apk","filename":"custom-ca-certs-1-1.0.0-r0.apk","size":6998,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/base_image.apko.yaml","filename":"base_image.apko.yaml","size":250,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/custom-ca-certs-1.melange.yaml","filename":"custom-ca-certs-1.melange.yaml","size":3734,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/golden/oci-layout","filename":"oci-layout","size":37,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/golden/sboms/sbom-aarch64.spdx.json","filename":"sbom-aarch64.spdx.json","size":7013,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/golden/sboms/sbom-index.spdx.json","filename":"sbom-index.spdx.json","size":4218,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/golden/sboms/sbom-x86_64.spdx.json","filename":"sbom-x86_64.spdx.json","size":7011,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/golden/blobs/sha256/7e0f9d62f6cab4785e18a55f17d03f20ffb776881f1f46258efd9458f7cdaf08","filename":"7e0f9d62f6cab4785e18a55f17d03f20ffb776881f1f46258efd9458f7cdaf08","size":3079,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/golden/blobs/sha256/6c815259150f37d000417f9a93f41bddf74dff905c745986069d4b03e954ac1d","filename":"6c815259150f37d000417f9a93f41bddf74dff905c745986069d4b03e954ac1d","size":658,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/golden/blobs/sha256/124c885f834cfaf1329987457a9651a68c4fb9733d4462ae6288b98011277858","filename":"124c885f834cfaf1329987457a9651a68c4fb9733d4462ae6288b98011277858","size":560,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/golden/blobs/sha256/fbb854f9d5a601a36c4dc8cc82e5b21e91b11cdd4aab5035340e4f517c5a8eb1","filename":"fbb854f9d5a601a36c4dc8cc82e5b21e91b11cdd4aab5035340e4f517c5a8eb1","size":658,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/golden/blobs/sha256/69f0237c7f8cf0b8a329d1bf1d6870c870c4ec323e39d3a6da59596632d0f2f4","filename":"69f0237c7f8cf0b8a329d1bf1d6870c870c4ec323e39d3a6da59596632d0f2f4","size":560,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/golden/blobs/sha256/c7557730da0e2d7fb242d8d1ac6dcf7e3a2439732aa5981270b4f3a02454b738","filename":"c7557730da0e2d7fb242d8d1ac6dcf7e3a2439732aa5981270b4f3a02454b738","size":3072,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/golden/index.json","filename":"index.json","size":649,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/apko.lock.json","filename":"apko.lock.json","size":3269,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/apko-discover.lock.json","filename":"apko-discover.lock.json","size":5287,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/melange.rsa.pub","filename":"melange.rsa.pub","size":800,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/bar/bar.txt","filename":"bar.txt","size":4,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/image_on_top.apko.yaml","filename":"image_on_top.apko.yaml","size":244,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/melange.rsa","filename":"melange.rsa","size":3243,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/foo/foo.txt","filename":"foo.txt","size":4,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/private_packages/packages/aarch64/APKINDEX.tar.gz","filename":"APKINDEX.tar.gz","size":936,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/private_packages/packages/aarch64/package-x-1.0.0-r0.apk","filename":"package-x-1.0.0-r0.apk","size":2261,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/private_packages/packages/aarch64/package-y-1.0.0-r0.apk","filename":"package-y-1.0.0-r0.apk","size":2266,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/private_packages/packages/aarch64/APKINDEX.json","filename":"APKINDEX.json","size":1309,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/private_packages/packages/x86_64/APKINDEX.tar.gz","filename":"APKINDEX.tar.gz","size":935,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/private_packages/packages/x86_64/package-x-1.0.0-r0.apk","filename":"package-x-1.0.0-r0.apk","size":2274,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/private_packages/packages/x86_64/package-y-1.0.0-r0.apk","filename":"package-y-1.0.0-r0.apk","size":2258,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/private_packages/packages/x86_64/APKINDEX.json","filename":"APKINDEX.json","size":1307,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/private_packages/package-y.melange.yaml","filename":"package-y.melange.yaml","size":499,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/private_packages/private_pkg_key.rsa.pub","filename":"private_pkg_key.rsa.pub","size":799,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/private_packages/private_pkg_key.rsa","filename":"private_pkg_key.rsa","size":3242,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/private_packages/package-x.melange.yaml","filename":"package-x.melange.yaml","size":507,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/empty-layering.yaml","filename":"empty-layering.yaml","size":230,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/pretend-baselayout.melange.yaml","filename":"pretend-baselayout.melange.yaml","size":497,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/apko-certs.yaml","filename":"apko-certs.yaml","size":265,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/layering.yaml","filename":"layering.yaml","size":327,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/image_on_top.apko.lock.json","filename":"image_on_top.apko.lock.json","size":1997,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/replayout.melange.yaml","filename":"replayout.melange.yaml","size":588,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/apko.yaml","filename":"apko.yaml","size":186,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/apko.pre-0.13.lock.json","filename":"apko.pre-0.13.lock.json","size":2868,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/regenerate_golden_top_image.sh","filename":"regenerate_golden_top_image.sh","size":474,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/testdata/custom-ca-certs-2.melange.yaml","filename":"custom-ca-certs-2.melange.yaml","size":2077,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/cli/clean_test.go","filename":"clean_test.go","size":4211,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/internal/tools.go","filename":"tools.go","size":758,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/options/options.go","filename":"options.go","size":5321,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/lock/lock.go","filename":"lock.go","size":3229,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/lock/lock_test.go","filename":"lock_test.go","size":1151,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/cpio/layer.go","filename":"layer.go","size":2726,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/options/options_test.go","filename":"options_test.go","size":1273,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/options/options.go","filename":"options.go","size":5185,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/generator.go","filename":"generator.go","size":2040,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/spdx_test.go","filename":"spdx_test.go","size":10093,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/expected_image_sboms/both-describes-methods.spdx.json","filename":"both-describes-methods.spdx.json","size":3510,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/expected_image_sboms/package-deduplicating.spdx.json","filename":"package-deduplicating.spdx.json","size":5168,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/expected_image_sboms/no-supplier.spdx.json","filename":"no-supplier.spdx.json","size":2140,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/expected_image_sboms/unbound-package-dedupe.spdx.json","filename":"unbound-package-dedupe.spdx.json","size":6460,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/expected_image_sboms/describes-relationship.spdx.json","filename":"describes-relationship.spdx.json","size":4254,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/expected_image_sboms/custom-license.spdx.json","filename":"custom-license.spdx.json","size":7018,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/apk_sboms/libattr1-2.5.1-r2.spdx.json","filename":"libattr1-2.5.1-r2.spdx.json","size":2134,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/apk_sboms/unbound-config-1.23.0-r0.spdx.json","filename":"unbound-config-1.23.0-r0.spdx.json","size":3008,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/apk_sboms/unbound-libs-1.23.0-r0.spdx.json","filename":"unbound-libs-1.23.0-r0.spdx.json","size":2994,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/apk_sboms/test-pkg-describes-1.0.0-r0.spdx.json","filename":"test-pkg-describes-1.0.0-r0.spdx.json","size":3200,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/apk_sboms/logstash-8-compat-8.15.3-r4.spdx.json","filename":"logstash-8-compat-8.15.3-r4.spdx.json","size":2996,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/apk_sboms/font-ubuntu-0.869-r1.spdx.json","filename":"font-ubuntu-0.869-r1.spdx.json","size":6099,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/apk_sboms/_generate.sh","filename":"_generate.sh","size":598,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/apk_sboms/test-pkg-both-1.0.0-r0.spdx.json","filename":"test-pkg-both-1.0.0-r0.spdx.json","size":2614,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/apk_sboms/logstash-8-8.15.3-r4.spdx.json","filename":"logstash-8-8.15.3-r4.spdx.json","size":2947,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/testdata/apk_sboms/unbound-1.23.0-r0.spdx.json","filename":"unbound-1.23.0-r0.spdx.json","size":2959,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/generator/spdx/spdx.go","filename":"spdx.go","size":22900,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/sbom/sbom.go","filename":"sbom.go","size":898,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/paths/paths_test.go","filename":"paths_test.go","size":2645,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/paths/paths.go","filename":"paths.go","size":2632,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apko/version.go","filename":"version.go","size":1527,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/limitio/limitio.go","filename":"limitio.go","size":2731,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/vcs/vcs.go","filename":"vcs.go","size":4802,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/vcs/vcs_unit_test.go","filename":"vcs_unit_test.go","size":7292,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/types/package_test.go","filename":"package_test.go","size":4178,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/types/package.go","filename":"package.go","size":4518,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/auth/auth_test.go","filename":"auth_test.go","size":1598,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/auth/chainguard.go","filename":"chainguard.go","size":3370,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/auth/auth.go","filename":"auth.go","size":4601,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/README.md","filename":"README.md","size":3721,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/fs/rwosfs_test.go","filename":"rwosfs_test.go","size":17085,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/fs/apkfs_test.go","filename":"apkfs_test.go","size":3164,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/fs/apkfs.go","filename":"apkfs.go","size":7061,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/fs/memfs_test.go","filename":"memfs_test.go","size":13030,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/fs/rwosfs.go","filename":"rwosfs.go","size":20736,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/fs/doc.go","filename":"doc.go","size":1348,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/fs/sub.go","filename":"sub.go","size":3991,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/fs/memfs.go","filename":"memfs.go","size":17228,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/fs/fs.go","filename":"fs.go","size":2820,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/fs/testdata/hello-2.12-r0.apk","filename":"hello-2.12-r0.apk","size":69589,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/expandapk/expandapk_test.go","filename":"expandapk_test.go","size":13432,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/expandapk/utility.go","filename":"utility.go","size":873,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/expandapk/split_test.go","filename":"split_test.go","size":1040,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/expandapk/const.go","filename":"const.go","size":80,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/expandapk/split.go","filename":"split.go","size":3459,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/expandapk/options.go","filename":"options.go","size":1927,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/expandapk/expandapk.go","filename":"expandapk.go","size":16852,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/expandapk/tarfs/tarfs.go","filename":"tarfs.go","size":5534,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/common_test_unix.go","filename":"common_test_unix.go","size":655,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/apkindex.go","filename":"apkindex.go","size":8876,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/package_getter_test.go","filename":"package_getter_test.go","size":10931,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/transport_test.go","filename":"transport_test.go","size":4864,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/install_test.go","filename":"install_test.go","size":14760,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/const.go","filename":"const.go","size":1382,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/repo.go","filename":"repo.go","size":37919,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/common_test_nonunix.go","filename":"common_test_nonunix.go","size":681,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/world.go","filename":"world.go","size":1912,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/implementation_test.go","filename":"implementation_test.go","size":34538,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/package_getter.go","filename":"package_getter.go","size":11794,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/limited_transport.go","filename":"limited_transport.go","size":1845,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/index.go","filename":"index.go","size":15746,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/cache_test.go","filename":"cache_test.go","size":2641,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/transport.go","filename":"transport.go","size":3375,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/apkindex_test.go","filename":"apkindex_test.go","size":8192,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/implementation.go","filename":"implementation.go","size":38266,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/options.go","filename":"options.go","size":4627,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/shameful_global_caches.go","filename":"shameful_global_caches.go","size":3344,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/installed_test.go","filename":"installed_test.go","size":30668,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/installed.go","filename":"installed.go","size":14649,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/arch.go","filename":"arch.go","size":846,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/install.go","filename":"install.go","size":11796,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/package_test.go","filename":"package_test.go","size":2793,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/repository_test.go","filename":"repository_test.go","size":774,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/releases.go","filename":"releases.go","size":2781,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/common_test.go","filename":"common_test.go","size":2691,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/world_test.go","filename":"world_test.go","size":1405,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/errors.go","filename":"errors.go","size":1741,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/cache.go","filename":"cache.go","size":14257,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/common.go","filename":"common.go","size":1032,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/resolveapk.go","filename":"resolveapk.go","size":2027,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/util.go","filename":"util.go","size":850,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/version.go","filename":"version.go","size":15089,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/path_traversal_test.go","filename":"path_traversal_test.go","size":3749,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/executor.go","filename":"executor.go","size":788,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/version_test.go","filename":"version_test.go","size":37374,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/hello-wolfi-2.12.1-r0.apk","filename":"hello-wolfi-2.12.1-r0.apk","size":72791,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/signing/APKINDEX.tar.gz","filename":"APKINDEX.tar.gz","size":3969,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/signing/keys/chainguard-60912bbc46bfc8ed6bda0b50db3a8a5f3c4344d6bc8549ec9b84d96140b475d1.rsa.pub","filename":"chainguard-60912bbc46bfc8ed6bda0b50db3a8a5f3c4344d6bc8549ec9b84d96140b475d1.rsa.pub","size":800,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/signing/keys/chainguard-61cb6bccd1f584b007db7be51ebce2b0530a54cc5a94e7650b570d113d537cf3.rsa.pub","filename":"chainguard-61cb6bccd1f584b007db7be51ebce2b0530a54cc5a94e7650b570d113d537cf3.rsa.pub","size":800,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/signing/keys/chainguard-0106f58bac88057c2ff5c2829850df492717a876ed700443550353c7ab23f5a0.rsa.pub","filename":"chainguard-0106f58bac88057c2ff5c2829850df492717a876ed700443550353c7ab23f5a0.rsa.pub","size":800,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/installed/bad-top-level-perms","filename":"bad-top-level-perms","size":417,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/installed/wolfi-base","filename":"wolfi-base","size":12129,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/installed/redis-operator-compat","filename":"redis-operator-compat","size":12426,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/alpine-316/alpine-baselayout-3.2.0-r23.apk","filename":"alpine-baselayout-3.2.0-r23.apk","size":11012,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/alpine-316/APKINDEX.tar.gz","filename":"APKINDEX.tar.gz","size":655754,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/alpine-316/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub","filename":"alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub","size":451,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/root/usr/lib/apk/db/installed","filename":"installed","size":14100,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/root/usr/lib/apk/db/scripts.tar","filename":"scripts.tar","size":11264,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/root/usr/lib/apk/db/triggers","filename":"triggers","size":76,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/README.md","filename":"README.md","size":1287,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/hello-0.1.0-r0.apk","filename":"hello-0.1.0-r0.apk","size":499,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/rsa256-signed/test-rsa256.rsa.pub","filename":"test-rsa256.rsa.pub","size":800,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/rsa256-signed/rebuild.sh","filename":"rebuild.sh","size":479,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/rsa256-signed/APKINDEX.tar.gz","filename":"APKINDEX.tar.gz","size":1047,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/APKINDEX.tar.gz","filename":"APKINDEX.tar.gz","size":806,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/replaces/replaces-0.0.1-r0.apk","filename":"replaces-0.0.1-r0.apk","size":1477,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/replaces/melange.yaml","filename":"melange.yaml","size":416,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/alpine-317/alpine-baselayout-3.2.0-r23.apk","filename":"alpine-baselayout-3.2.0-r23.apk","size":11012,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/alpine-317/alpine-baselayout-3.4.0-r0.apk","filename":"alpine-baselayout-3.4.0-r0.apk","size":11012,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/alpine-317/APKINDEX.tar.gz","filename":"APKINDEX.tar.gz","size":661049,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/extracted/.SIGN.RSA.main@tainer.com-abcdef12.rsa.pub","filename":".SIGN.RSA.main@tainer.com-abcdef12.rsa.pub","size":256,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/extracted/APKINDEX","filename":"APKINDEX","size":505,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/testdata/extracted/DESCRIPTION","filename":"DESCRIPTION","size":23,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/repo_test.go","filename":"repo_test.go","size":40703,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/package.go","filename":"package.go","size":5375,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/apk/repository.go","filename":"repository.go","size":2305,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/client/client.go","filename":"client.go","size":2088,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/signature/rsa.go","filename":"rsa.go","size":2658,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/apk/docs/CACHE.md","filename":"CACHE.md","size":2372,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/s6/s6.go","filename":"s6.go","size":809,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/s6/supervision_tree.go","filename":"supervision_tree.go","size":1300,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/baseimg/base_image.go","filename":"base_image.go","size":4798,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/vfs/fsmode_darwin.go","filename":"fsmode_darwin.go","size":718,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/vfs/fsmode_linux.go","filename":"fsmode_linux.go","size":717,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/vfs/fsmode.go","filename":"fsmode.go","size":751,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/vfs/vfs_unit_test.go","filename":"vfs_unit_test.go","size":3467,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/vfs/dirfs.go","filename":"dirfs.go","size":1604,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/vfs/testdata/etc/motd","filename":"motd","size":12,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/vfs/dirfs_unit_test.go","filename":"dirfs_unit_test.go","size":2178,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/vfs/vfs.go","filename":"vfs.go","size":6618,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/passwd/passwd_test.go","filename":"passwd_test.go","size":2518,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/passwd/doc.go","filename":"doc.go","size":721,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/passwd/group.go","filename":"group.go","size":3669,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/passwd/passwd.go","filename":"passwd.go","size":3868,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/passwd/testdata/group","filename":"group","size":782,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/passwd/testdata/passwd","filename":"passwd","size":1752,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/passwd/group_test.go","filename":"group_test.go","size":2792,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/tarfs/fs_test.go","filename":"fs_test.go","size":4545,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/pkg/tarfs/fs.go","filename":"fs.go","size":25362,"category":"other"},{"path":"vuln_variant/test_env/apko_v1.2.4/CONTRIBUTING.md","filename":"CONTRIBUTING.md","size":2089,"category":"documentation"},{"path":"vuln_variant/test_env/apko_v1.2.4/.golangci.yml","filename":".golangci.yml","size":1199,"category":"other"},{"path":"vuln_variant/test_env/variant_test.go","filename":"variant_test.go","size":4373,"category":"other"},{"path":"vuln_variant/test_env/variant_main.go","filename":"variant_main.go","size":4540,"category":"other"},{"path":"vuln_variant/test_env/go.sum","filename":"go.sum","size":4025,"category":"other"},{"path":"logs/fix_report.json","filename":"fix_report.json","size":299,"category":"other"},{"path":"logs/vuln_variant/fixed_results.json","filename":"fixed_results.json","size":1467,"category":"other"},{"path":"logs/vuln_variant/source_identity.txt","filename":"source_identity.txt","size":113,"category":"other"},{"path":"logs/vuln_variant/fixed_stderr.log","filename":"fixed_stderr.log","size":837,"category":"log"},{"path":"logs/vuln_variant/vuln_stderr.log","filename":"vuln_stderr.log","size":837,"category":"log"},{"path":"logs/vuln_variant/vuln_results.json","filename":"vuln_results.json","size":1231,"category":"other"},{"path":"logs/vuln_report.json","filename":"vuln_report.json","size":313,"category":"other"}]}