-
By default behavior, `convert python` uses `fetch` pipeline to download source code from the upstream. One of downside of this is that it [puts SHA digest](https://github.com/wolfi-dev/wolfictl/issues…
-
- [ ] `py3-botocore` contains a world-writable file: `usr/lib/python3.12/site-packages/botocore/data/bedrock-runtime/2023-09-30/waiters-2.json`
- [ ] `kube-fluentd-operator` contains a world-writable…
-
Currently, with Dockerfiles you can just use a base image and add more stuff that you want.
Example:
```dockerfile
FROM cgr.dev/chainguard/wolfi-base # can be any image
apk add custom-package
…
-
### Is your feature request related to a problem? Please describe.
I'm currently encountering frustration trying to bring zot up on OpenShift Local on my laptop due to permissions issues.
Specific…
-
### Expected Behavior
```bash
$ curl localhost:8080/hello
Hello World
```
### Actual Behaviour
JVM:
```powershell
> java -jar .\demo-0.1.jar
__ __ _ _
…
-
**Description of the false positive**
This shouldn't be included because there is an adequate guard protecting against a path traversal payload.
**Code samples or links to source code**
```java…
-
seen with teleport 16.0.3 - https://github.com/wolfi-dev/os/pull/22915
```
usr/local/bin/teleport [🚨 CRITICAL]
------------------------------------------------------------------------------------…
-
**Please provide a set of steps on how to reproduce the issue**
```shell
syft cgr.dev/chainguard/wolfi-base:latest
NAME VERSION TYPE
apk-tools 2.12.10 …
-
I was looking for a complete list of the action-names that we use in the `pipeline.uses` in melange files (For example: https://github.com/wolfi-dev/os/blob/main/bash.yaml#L42-L44), but didn't find an…
-
When a package is installed it should not have any dangling symlinks.
Any dangling symlinks represent either pure broken package or missing dependency.
I saw such a thing today with google-cloud-s…