directory with Syft to enhance SBOM
generating SBOM from unpacked directory
finished Syft SBOM generation
successfully merged Syft scan results with melange SBOM
enhanced all SBOMs with Syft scan results
generating package libsdl3-3.4.0-r0
scanning for ld.so.conf.d files...
scanning for shared object dependencies...
2026/01/03 10:55:31 INFO completed enhanced Syft SBOM generation with merged metadata
  found soname libSDL3.so.0 for usr/lib/libSDL3.so.0
  found lib libm.so.6 for usr/lib/libSDL3.so.0
  found lib libc.so.6 for usr/lib/libSDL3.so.0
  found lib libm.so.6 for usr/lib/libSDL3.so.0.4.0
  found lib libc.so.6 for usr/lib/libSDL3.so.0.4.0
scanning for commands...
scanning for -doc package...
scanning for pkg-config data...
scanning for python modules...
scanning for ruby gems...
scanning for shbang deps...
scanning for kernel dependencies...
  runtime:
    so:libc.so.6
    so:libm.so.6
  provides:
    so-ver:libSDL3.so.0=3.4.0-r0
    so:libSDL3.so.0=0
  installed-size: 4630513
  data.tar.gz digest: a6bc5a5bbdc23e3698c2a1a3ada1d738e566f56ee878f0a9a60122ede2b43b5e
wrote packages/x86_64/libsdl3-3.4.0-r0.apk
generating package libsdl3-dev-3.4.0-r0
scanning for ld.so.conf.d files...
scanning for shared object dependencies...
  found soname libSDL3.so.0 for usr/lib/libSDL3.so
scanning for commands...
scanning for -doc package...
scanning for pkg-config data...
  found pkg-config sdl3 for usr/lib/pkgconfig/sdl3.pc
scanning for python modules...
scanning for ruby gems...
scanning for shbang deps...
scanning for kernel dependencies...
  runtime:
    libsdl3
    so:libSDL3.so.0
  provides:
    pc:sdl3=3.4.0-r0
  installed-size: 3884707
  data.tar.gz digest: 47f60f6c6c548d5ab94504ede59d73101d5af9ca60a0b7b713d99290a651b0c4
wrote packages/x86_64/libsdl3-dev-3.4.0-r0.apk
cleaning Workspace by removing 31 file/directories in /home/build
generating apk index from packages in packages/x86_64
processing package packages/x86_64/libsdl3-dev-3.4.0-r0.apk
processing package packages/x86_64/libsdl3-3.4.0-r0.apk
updating index at packages/x86_64/APKINDEX.tar.gz with new packages: [libsdl3-3.4.0-r0 libsdl3-dev-3.4.0-r0]
qemu: sending shutdown signal
build completed successfully
running malcontent scan...
found 2 APK files to scan
scanning packages/x86_64/libsdl3-3.4.0-r0.apk -> packages/libsdl3-3.4.0-r0/mal-scan.json
running command mal [--format=json --exit-extraction=false --min-risk=critical --min-file-risk=critical --quantity-increases-risk=true --output=packages/libsdl3-3.4.0-r0/mal-scan.json scan packages/x86_64/libsdl3-3.4.0-r0.apk]
command "mal" completed successfully
scanning packages/x86_64/libsdl3-dev-3.4.0-r0.apk -> packages/libsdl3-dev-3.4.0-r0/mal-scan.json
running command mal [--format=json --exit-extraction=false --min-risk=critical --min-file-risk=critical --quantity-increases-risk=true --output=packages/libsdl3-dev-3.4.0-r0/mal-scan.json scan packages/x86_64/libsdl3-dev-3.4.0-r0.apk]
command "mal" completed successfully
malcontent scan completed successfully for 2 APKs in 8s
creating packages tarball...
running command tar [-C packages -cf packages.tar .]
command "tar" completed successfully
packages.tar sha256sum: 2aa252ea1b49c896b26bdebd476ef82f49f108de6430194586b2951b7c2f6752
sha256sum "2aa252ea1b49c896b26bdebd476ef82f49f108de6430194586b2951b7c2f6752" written to /dev/termination-log
Built 2 packages, hash: 2aa252ea1b49c896b26bdebd476ef82f49f108de6430194586b2951b7c2f6752, size: 2647552 bytes
uploading final packages tarball...
running command curl [-s --upload-file packages.tar -H Content-Type: application/octet-stream https://storage.googleapis.com/prod-bundle-staging/wolfi/x86_64/1767437683010890314-libsdl3-3.4.0-r0.tar.gz?Expires=1767480883&GoogleAccessId=ebuild-zasv64d5x1oc4m3epw39yod%40prod-enforce-fabc.iam.gserviceaccount.com&Signature=ZQvLVXBGgReXIef2y0g1qlRQdNaKI3QR6j78De0IeD5u%2BtGHjtwGuDWX8FQhN8NnYrL4cM0aT7IQjyd47dGSQmKBglpu41%2BRnNxJkHH1dlAvl6B42nOk7UdJaaHz7XDX7gsVaMfEDnqQ9ujhTs8zx6Q7kTjVjeOgaRTIlBpFepDReeYUZ%2FRLYyKmtJaOYpEncD9FqBGSWx2sq%2FEFsqtxKGTQCpmlflwpG0WDCMhIwTh7P0BaBtCDc1h70b%2BazwRJyJm912%2FfaGpM5nzljkMd80gx0Yr1PoCKwZPTaFiGtJFXOhRg5sEbvpmV4LerltHt4VXx1W5Zu5vKKh3Eo7WheA%3D%3D]
command "curl" completed successfully
upload completed successfully
parsed env
using enhanced syft sbom melange runner
configuring puller identity "720909c9f5279097d847ad02a2f24ba8f59de36a/a49c7fedc33adf69"...
running command chainctl [auth login --audience apk.cgr.dev --identity 720909c9f5279097d847ad02a2f24ba8f59de36a/a49c7fedc33adf69]
Successfully exchanged token.
Valid! Id: 720909c9f5279097d847ad02a2f24ba8f59de36a/a49c7fedc33adf69
Updates are available for chainctl (current version: 0.2.185; latest: 0.2.187). To install, please run:
    $ chainctl update
command "chainctl" completed successfully
puller identity configured successfully
puller identity configured successfully
running tests...
running command /usr/bin/dind [dockerd] in background
command "/usr/bin/dind" started successfully
running command bash [-c 
  # Retry up to 60 seconds to wait for docker to start.
  worked=false
  for i in $(seq 60); do
    if docker info >/dev/null 2>&1; then
	  worked=true
	  break
    fi
    echo "docker healthcheck failed, docker is not ready, retrying... ($i/60 seconds so far)..."
    sleep 1
  done

  if [ "$worked" = "false" ]; then
    echo "Failed to start docker after 60 seconds"
    exit 1
  fi
]
command "bash" completed successfully
melange devel with runner qemu is testing:
image configuration:
  contents:
    build repositories: []
    runtime repositories: []
    repositories: []
    keyring:      []
    packages:     [ldd-check libsdl3 libsdl3-dev pkgconf]
  accounts:
    runas:  
    users:
      - uid=1000(build) gid=1000
    groups:
      - gid=1000(build) members=[build]
installing wolfi-baselayout (20230201-r24)
installing ca-certificates-bundle (20251003-r0)
installing ld-linux (2.42-r4)
installing libgcc (15.2.0-r6)
installing glibc-locale-posix (2.42-r4)
installing glibc (2.42-r4)
installing zlib (1.3.1-r51)
installing libcrypto3 (3.6.0-r6)
installing libssl3 (3.6.0-r6)
installing apk-tools (2.14.10-r9)
installing libxcrypt (4.5.2-r0)
installing libcrypt1 (2.42-r4)
installing busybox (1.37.0-r50)
installing ncurses-terminfo-base (6.6_p20251230-r0)
installing ncurses (6.6_p20251230-r0)
installing bash (5.3-r3)
installing posix-libc-utils (2.42-r4)
installing ldd-check (0.0.35-r1)
installing libsdl3 (3.4.0-r0)
installing libsdl3-dev (3.4.0-r0)
installing pkgconf (2.5.1-r1)
installing wolfi-keys (1-r12)
installing wolfi-base (1-r7)
populating workspace /tmp/melange-workspace-185725555 from libsdl3
qemu: generating ssh key pairs for ephemeral VM
qemu: generating SSH host key for VM
qemu: generating base initramfs
image configuration:
  contents:
    build repositories: [https://apk.cgr.dev/chainguard]
    runtime repositories: []
    repositories: []
    keyring:      []
    packages:     [microvm-init]
installing wolfi-baselayout (20230201-r24)
installing ca-certificates-bundle (20251003-r0)
installing libgcc (15.2.0-r6)
installing glibc-locale-posix (2.42-r4)
installing glibc (2.42-r4)
installing ld-linux (2.42-r4)
installing gnutar-rmt (1.35-r7)
installing gnutar (1.35-r7)
installing libattr1 (2.5.2-r54)
installing attr (2.5.2-r54)
installing zlib (1.3.1-r51)
installing libzstd1 (1.5.7-r5)
installing xz (5.8.2-r0)
installing libcrypto3 (3.6.0-r6)
installing kmod (34.2-r42)
installing libmnl (1.0.5-r6)
installing libbz2-1 (1.0.8-r21)
installing libelf (0.194-r0)
installing libbpf (1.6.2-r0)
installing libverto (0.3.2-r6)
installing krb5-conf (1.0-r7)
installing libcom_err (1.47.3-r1)
installing keyutils-libs (1.6.3-r37)
installing libssl3 (3.6.0-r6)
installing krb5-libs (1.22.1-r1)
installing libtirpc (1.3.7-r1)
installing libpcre2-8-0 (10.47-r0)
installing libsepol (3.9-r1)
installing libselinux (3.9-r1)
installing libnftnl (1.3.1-r0)
installing xtables (1.8.11-r30)
installing libcap (2.77-r0)
installing iproute2 (6.17.0-r2)
installing libstdc++ (15.2.0-r6)
installing inih (62-r1)
installing liburcu (0.15.5-r0)
installing libblkid (2.41.3-r0)
installing libuuid (2.41.3-r0)
installing xfsprogs-core (6.17.0-r2)
installing xfsprogs (6.17.0-r2)
installing libmount (2.41.3-r0)
installing mount (2.41.3-r0)
installing ncurses-terminfo-base (6.6_p20251230-r0)
installing ncurses (6.6_p20251230-r0)
installing setarch (2.41.3-r0)
installing libfdisk (2.41.3-r0)
installing sqlite-libs (3.51.1-r0)
installing util-linux (2.41.3-r0)
installing libsmartcols (2.41.3-r0)
installing util-linux-misc (2.41.3-r0)
installing libxcrypt (4.5.2-r0)
installing libcrypt1 (2.42-r4)
installing linux-pam (1.7.1-r4)
installing openssh-keygen (10.2_p1-r3)
installing openssh-server-config (10.2_p1-r3)
installing openssh-server (10.2_p1-r3)
installing busybox (1.37.0-r50)
installing microvm-init (0.0.1-r15)
qemu: starting VM
qemu: waiting for SSH
conn read: read tcp 127.0.0.1:33912->127.0.0.1:33195: i/o timeout
qemu: meta-data=/dev/vda               isize=512    agcount=8, agsize=1638400 blks
qemu:          =                       sectsz=4096  attr=2, projid32bit=1
qemu:          =                       crc=1        finobt=1, sparse=1, rmapbt=1
qemu:          =                       reflink=1    bigtime=1 inobtcount=1 nrext64=1
qemu:          =                       exchange=0   metadir=0
qemu: data     =                       bsize=4096   blocks=13107200, imaxpct=25
qemu:          =                       sunit=0      swidth=0 blks
qemu: naming   =version 2              bsize=4096   ascii-ci=0, ftype=1, parent=0
qemu: log      =internal log           bsize=4096   blocks=16384, version=2
qemu:          =                       sectsz=4096  sunit=1 blks, lazy-count=1
qemu: realtime =none                   extsz=4096   blocks=0, rtextents=0
qemu:          =                       rgcount=0    rgsize=0 extents
qemu:          =                       zoned=0      start=0 reserved=0
qemu: Discarding blocks...Done.
qemu: [INIT] Checking for init.d scripts...
qemu: [INIT] No /opt/melange/init.d directory (optional, skipping)
conn read: EOF
qemu: ssh-keygen: generating new host keys: RSA ECDSA 
qemu: Server listening on 0.0.0.0 port 2223.
qemu: Server listening on 0.0.0.0 port 22.

000000) (unknown)
  build-scripts/update-copyright.sh: NOASSERTION (0.000000) (unknown)
could not identify some licenses, please check the configuration
license information check complete
generating enhanced Syft SBOMs merged with melange metadata
invalid license: NOASSERTION
invalid license: NOASSERTION
created base melange SBOMs with build metadata
scanning package directory with Syft to enhance SBOM
generating SBOM from unpacked directory
finished Syft SBOM generation
successfully merged Syft scan results with melange SBOM
scanning package directory with Syft to enhance SBOM
generating SBOM from unpacked directory
finished Syft SBOM generation
successfully merged Syft scan results with melange SBOM
enhanced all SBOMs with Syft scan results
generating package libsdl3-3.4.0-r0
2026/01/03 10:55:19 INFO completed enhanced Syft SBOM generation with merged metadata
scanning for ld.so.conf.d files...
scanning for shared object dependencies...
  found soname libSDL3.so.0 for usr/lib/libSDL3.so.0
  found lib libm.so.6 for usr/lib/libSDL3.so.0
  found lib libc.so.6 for usr/lib/libSDL3.so.0
  found lib ld-linux-aarch64.so.1 for usr/lib/libSDL3.so.0
  found lib libm.so.6 for usr/lib/libSDL3.so.0.4.0
  found lib libc.so.6 for usr/lib/libSDL3.so.0.4.0
  found lib ld-linux-aarch64.so.1 for usr/lib/libSDL3.so.0.4.0
scanning for commands...
scanning for -doc package...
scanning for pkg-config data...
scanning for python modules...
scanning for ruby gems...
scanning for shbang deps...
scanning for kernel dependencies...
  runtime:
    so:ld-linux-aarch64.so.1
    so:libc.so.6
    so:libm.so.6
  provides:
    so-ver:libSDL3.so.0=3.4.0-r0
    so:libSDL3.so.0=0
  installed-size: 4472675
  data.tar.gz digest: 53a487be400cb11f57cbe23dc11ff364f2fa7823dfe15ad07b5f4cfc8e4f95ed
wrote packages/aarch64/libsdl3-3.4.0-r0.apk
generating package libsdl3-dev-3.4.0-r0
scanning for ld.so.conf.d files...
scanning for shared object dependencies...
  found soname libSDL3.so.0 for usr/lib/libSDL3.so
scanning for commands...
scanning for -doc package...
scanning for pkg-config data...
  found pkg-config sdl3 for usr/lib/pkgconfig/sdl3.pc
scanning for python modules...
scanning for ruby gems...
scanning for shbang deps...
scanning for kernel dependencies...
  runtime:
    libsdl3
    so:libSDL3.so.0
  provides:
    pc:sdl3=3.4.0-r0
  installed-size: 3878125
  data.tar.gz digest: fc1eaa9779f4d1b02d16e3ce9ad4924ff5acbb72deb31c0a029df6dfc1a6fc3d
wrote packages/aarch64/libsdl3-dev-3.4.0-r0.apk
cleaning Workspace by removing 31 file/directories in /home/build
generating apk index from packages in packages/aarch64
processing package packages/aarch64/libsdl3-dev-3.4.0-r0.apk
processing package packages/aarch64/libsdl3-3.4.0-r0.apk
updating index at packages/aarch64/APKINDEX.tar.gz with new packages: [libsdl3-3.4.0-r0 libsdl3-dev-3.4.0-r0]
build completed successfully
running malcontent scan...
found 2 APK files to scan
scanning packages/aarch64/libsdl3-3.4.0-r0.apk -> packages/libsdl3-3.4.0-r0/mal-scan.json
running command mal [--format=json --exit-extraction=false --min-risk=critical --min-file-risk=critical --quantity-increases-risk=true --output=packages/libsdl3-3.4.0-r0/mal-scan.json scan packages/aarch64/libsdl3-3.4.0-r0.apk]
command "mal" completed successfully
scanning packages/aarch64/libsdl3-dev-3.4.0-r0.apk -> packages/libsdl3-dev-3.4.0-r0/mal-scan.json
running command mal [--format=json --exit-extraction=false --min-risk=critical --min-file-risk=critical --quantity-increases-risk=true --output=packages/libsdl3-dev-3.4.0-r0/mal-scan.json scan packages/aarch64/libsdl3-dev-3.4.0-r0.apk]
command "mal" completed successfully
malcontent scan completed successfully for 2 APKs in 7s
creating packages tarball...
running command tar [-C packages -cf packages.tar .]
command "tar" completed successfully
packages.tar sha256sum: 0f165859449b943f0104f52443da69a123acdbb3763291281e03e67c3956cf88
sha256sum "0f165859449b943f0104f52443da69a123acdbb3763291281e03e67c3956cf88" written to /dev/termination-log
Built 2 packages, hash: 0f165859449b943f0104f52443da69a123acdbb3763291281e03e67c3956cf88, size: 2600960 bytes
uploading final packages tarball...
running command curl [-s --upload-file packages.tar -H Content-Type: application/octet-stream https://storage.googleapis.com/prod-bundle-staging/wolfi/aarch64/1767437683010851358-libsdl3-3.4.0-r0.tar.gz?Expires=1767480883&GoogleAccessId=ebuild-zasv64d5x1oc4m3epw39yod%40prod-enforce-fabc.iam.gserviceaccount.com&Signature=YR6kzFG8Qu0FT6OZCDqHjkXj%2B1mFtQIdYbnOjvMDo9HWk1qLYepC0RVII8j8Caq3WBCplm4HVwc4u972rDsJkr1c9rOEzwvp20Cz%2Bx5gVZWGDmc6dyi2LsRC1EZSmYlO%2FLoCf1ouoWAM3Lp47g6tm58QZ5WC0yF1vE7PuBdO6rWEzFpVvDf4FbrW4c5S3erXX4b4TwXelNlwUiZoVY8ZIAdS8ovXs%2FAKtTnXoey9SRBpQcqEf%2BNSnLSuP8XXNxpNmcdmb33jhQ6nrI0MpjNnHZ0eBtaNxeC%2F%2B8DJ03TjbvgQ1Aqhci8lGdbQKDmXE%2B7I1u80fWp14iLnCuA3aTuOtA%3D%3D]
command "curl" completed successfully
upload completed successfully
parsed env
using enhanced syft sbom melange runner
configuring puller identity "720909c9f5279097d847ad02a2f24ba8f59de36a/a49c7fedc33adf69"...
running command chainctl [auth login --audience apk.cgr.dev --identity 720909c9f5279097d847ad02a2f24ba8f59de36a/a49c7fedc33adf69]
Successfully exchanged token.
Valid! Id: 720909c9f5279097d847ad02a2f24ba8f59de36a/a49c7fedc33adf69
Updates are available for chainctl (current version: 0.2.185; latest: 0.2.187). To install, please run:
    $ chainctl update
command "chainctl" completed successfully
puller identity configured successfully
puller identity configured successfully
running tests...
running command /usr/bin/dind [dockerd] in background
command "/usr/bin/dind" started successfully
running command bash [-c 
  # Retry up to 60 seconds to wait for docker to start.
  worked=false
  for i in $(seq 60); do
    if docker info >/dev/null 2>&1; then
	  worked=true
	  break
    fi
    echo "docker healthcheck failed, docker is not ready, retrying... ($i/60 seconds so far)..."
    sleep 1
  done

  if [ "$worked" = "false" ]; then
    echo "Failed to start docker after 60 seconds"
    exit 1
  fi
]
command "bash" completed successfully
melange devel with runner docker is testing:
image configuration:
  contents:
    build repositories: []
    runtime repositories: []
    repositories: []
    keyring:      []
    packages:     [ldd-check libsdl3 libsdl3-dev pkgconf]
  accounts:
    runas:  
    users:
      - uid=1000(build) gid=1000
    groups:
      - gid=1000(build) members=[build]
installing wolfi-baselayout (20230201-r24)
installing ca-certificates-bundle (20251003-r0)
installing libgcc (15.2.0-r6)
installing glibc-locale-posix (2.42-r4)
installing glibc (2.42-r4)
installing ld-linux (2.42-r4)
installing zlib (1.3.1-r51)
installing libcrypto3 (3.6.0-r6)
installing libssl3 (3.6.0-r6)
installing apk-tools (2.14.10-r9)
installing libxcrypt (4.5.2-r0)
installing libcrypt1 (2.42-r4)
installing busybox (1.37.0-r50)
installing ncurses-terminfo-base (6.6_p20251230-r0)
installing ncurses (6.6_p20251230-r0)
installing bash (5.3-r3)
installing posix-libc-utils (2.42-r4)
installing ldd-check (0.0.35-r1)
installing libsdl3 (3.4.0-r0)
installing libsdl3-dev (3.4.0-r0)
installing pkgconf (2.5.1-r1)
installing wolfi-keys (1-r12)
installing wolfi-base (1-r7)
layer digest: sha256:bfa5338b7cca5c2ca86c2cc8943e2b4fb1be11554df9a82661dc4b565cd5c43d
layer diffID: sha256:b51dd4cf46805b076172f049f7beb843f1a4899d982cfeaf3307182d3e59cdad
saving OCI image locally: apko.local/cache:8a2dff07bdfef59ef2683781b69f165932455ccb5f802d634a8106e12cd86376
tagging local image apko.local/cache:8a2dff07bdfef59ef2683781b69f165932455ccb5f802d634a8106e12cd86376 as index.docker.io/library/melange:latest
populating workspace /tmp/melange-workspace-2796309481 from libsdl3
running the main test pipeline
running step "test/tw/ldd-check"
running step "check for missing library dependencies using ldd"
[ldd-check] Testing binaries in package libsdl3
PASS[ldd-check]: /usr/lib/libSDL3.so.0
PASS[ldd-check]: /usr/lib/libSDL3.so.0.4.0
INFO[ldd-check]: tested 2 files with ldd. 2 passes. 0 fails.
pod 46be19434722d464a816a3aa7d0c0b33705cac43ac78918dff0343a3f025a1d6 terminated
running test pipeline for subpackage libsdl3-dev
melange devel with runner docker is testing:
image configuration:
  contents:
    build repositories: []
    runtime repositories: []
    repositories: []
    keyring:      []
    packages:     [ldd-check libsdl3-dev pkgconf]
  accounts:
    runas:  
    users:
      - uid=1000(build) gid=1000
    groups:
      - gid=1000(build) members=[build]
installing wolfi-baselayout (20230201-r24)
installing ca-certificates-bundle (20251003-r0)
installing libgcc (15.2.0-r6)
installing glibc-locale-posix (2.42-r4)
installing glibc (2.42-r4)
installing ld-linux (2.42-r4)
installing zlib (1.3.1-r51)
installing libcrypto3 (3.6.0-r6)
installing libssl3 (3.6.0-r6)
installing apk-tools (2.14.10-r9)
installing libxcrypt (4.5.2-r0)
installing libcrypt1 (2.42-r4)
installing busybox (1.37.0-r50)
installing ncurses-terminfo-base (6.6_p20251230-r0)
installing ncurses (6.6_p20251230-r0)
installing bash (5.3-r3)
installing posix-libc-utils (2.42-r4)
installing ldd-check (0.0.35-r1)
installing libsdl3 (3.4.0-r0)
installing libsdl3-dev (3.4.0-r0)
installing pkgconf (2.5.1-r1)
installing wolfi-keys (1-r12)
installing wolfi-base (1-r7)
layer digest: sha256:8822ea1d21a9ba9c64f5d77c2e061ff9a3e7ac00f61c08ec401e4fc7220ad2a6
layer diffID: sha256:764a2832d909c3814b6ee9c07fa96a5b2e770dd64bb5f7769df36e26ad0da8a8
saving OCI image locally: apko.local/cache:13d927f0d419f822ed308a036744b14fa94fff3f978262257ef1a639491c0602
tagging local image apko.local/cache:13d927f0d419f822ed308a036744b14fa94fff3f978262257ef1a639491c0602 as index.docker.io/library/melange:latest
running step "test/pkgconf"
running step "pkgconf build dependency check"
3.4.0
-Wl,-rpath,/usr/lib -Wl,--enable-new-dtags -lSDL3

running step "test/tw/ldd-check"
running step "check for missing library dependencies using ldd"
[ldd-check] Testing binaries in package libsdl3-dev
PASS[ldd-check]: /usr/lib/libSDL3.so
INFO[ldd-check]: tested 1 files with ldd. 1 passes. 0 fails.
pod e709beb02f58a7f8830880f2a095ed765f93ee3b3fbe01785f42a6290081620c terminated
tests completed successfully
all tests passed