melange

melange 使用声明式流水线构建 apk 软件包。 通常用于为使用 apko 构建的容器镜像提供自定义软件包。大多数 apk 都是为 Wolfi 或 Alpine Linux 生态系统而构建的。 主要特性： 面向流水线的构建。 与传统包管理器（具有不同的阶段）不同，构建流水线的每一步都由你定义和控制。 默认多架构。 使用 QEMU 模拟各种架构，从而无需交叉编译步骤。 为什么 安全软件工厂是 DevOps 的演进，允许用户证明软件设备中所有工件的来源。通过将软件工件构建并捕获到软件包中，DevOps 团队可以像管理镜像的任何其他组件一样管理其软件工件。 在构建采用 apko 的 OC...

CVE-2026-29050

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, an attacker who can influence a melange configuration file — for example through pull-request-driven CI or build-as-a-service scenarios — could set pipeline.uses to a...

CVE-2026-29049

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout pkg/renovate/cache/cache.go. An attacker-controlled URI in a melange config can cau...

CVE-2026-24843

melange allows users to build apk packages using declarative pipelines. In version 0.11.3 to before 0.40.3, an attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The retrieveWorkspace function extracts tar entries...

CVE-2026-24844

melange allows users to build apk packages using declarative pipelines. From version 0.3.0 to before 0.40.3, an attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses $vars. or $inputs. substitutions in...