298 matches found
melange
melange Build apk packages using declarative pipelines. Commonly used to provide custom packages for container images built with apko. The majority of apks are built for use with either the Wolfi or Alpine Linux ecosystems. Key features: Pipeline-oriented builds. Every step of the build pipeline ...
dasel-hardened-container
dasel v3.3.1 hardened container This is a melange package and apko container image for dasel v3.3.1 with a build-time patch for CVE-2026-33320 unbounded YAML alias expansion. The image is built entirely from a locally-produced APK - no prebuilt upstream image is used. Prerequisites...
dasel-melange-apko
dasel v3.3.1 — Melange + apko build, patched for CVE-2026-33320 This repo packages the dasel CLI v3.3.1 as an APK with Melange , builds a minimal container image with apko , and applies a fix for CVE-2026-33320 while staying on the v3.3.1 codebase a patch, not a version bump. The result is a 4 MB...
CVE-2026-54174
melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...
CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution
melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...
CVE-2026-54174
CVE-2026-54174 affects melange (Chainguard's declarative APK package builder), specifically the Apko component (chainguard.dev/apko). Prior to Apko 1.2.9 (corresponding to melange 0.50.4), the tool verified the control section hash (.PKGINFO etc.) against the signed APKINDEX but never verified th...
CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution
melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...
GHSA-XQ85-JG4P-XF7W vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...
GHSA-556C-3R39-WVFX vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...
GHSA-6C49-XC7V-MQVW vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...
GHSA-8264-G9FH-VX2H vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...
GHSA-87CJ-725F-6HR5 vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...
GHSA-8VM6-JVF8-6W38 vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...
GHSA-CG5C-7728-29V7 vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...
GHSA-F3MP-M5HM-H688 vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...
GHSA-4C74-G9CQ-VHC5 vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...
GHSA-F2M7-5M7M-7G2C vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...
GHSA-HRH3-6X34-5FXF vulnerabilities
Vulnerabilities for packages: linux-qemu-melange...