nge SBOMs with build metadata
scanning package directory with Syft to enhance SBOM
generating SBOM from unpacked directory
finished Syft SBOM generation
successfully merged Syft scan results with melange SBOM
scanning package directory with Syft to enhance SBOM
generating SBOM from unpacked directory
finished Syft SBOM generation
successfully merged Syft scan results with melange SBOM
enhanced all SBOMs with Syft scan results
generating package rqlite-9.3.7-r0
scanning for ld.so.conf.d files...
2026/01/03 03:03:45 INFO completed enhanced Syft SBOM generation with merged metadata
scanning for shared object dependencies...
scanning for commands...
  found command usr/bin/rqlite
  found command usr/bin/rqlited
scanning for -doc package...
scanning for pkg-config data...
scanning for python modules...
scanning for ruby gems...
scanning for shbang deps...
scanning for kernel dependencies...
  provides:
    cmd:rqlite=9.3.7-r0
    cmd:rqlited=9.3.7-r0
  installed-size: 48744849
  data.tar.gz digest: b9dad8c7dc27f5a90ac214d451840787bfec0ead5efc3bcf9320c06bf0bef475
wrote packages/x86_64/rqlite-9.3.7-r0.apk
generating package rqlite-oci-entrypoint-9.3.7-r0
scanning for ld.so.conf.d files...
scanning for shared object dependencies...
scanning for commands...
  found command usr/bin/docker-entrypoint.sh
scanning for -doc package...
scanning for pkg-config data...
scanning for python modules...
scanning for ruby gems...
scanning for shbang deps...
scanning for kernel dependencies...
  runtime:
    busybox
  provides:
    cmd:docker-entrypoint.sh=9.3.7-r0
  installed-size: 39215
  data.tar.gz digest: adf160aa632a22c30d79efadead111a30c8826e3cb5c77c899c2f07112021911
wrote packages/x86_64/rqlite-oci-entrypoint-9.3.7-r0.apk
cleaning Workspace by removing 36 file/directories in /home/build
generating apk index from packages in packages/x86_64
processing package packages/x86_64/rqlite-oci-entrypoint-9.3.7-r0.apk
processing package packages/x86_64/rqlite-9.3.7-r0.apk
updating index at packages/x86_64/APKINDEX.tar.gz with new packages: [rqlite-9.3.7-r0 rqlite-oci-entrypoint-9.3.7-r0]
qemu: sending shutdown signal
build completed successfully
running malcontent scan...
found 2 APK files to scan
scanning packages/x86_64/rqlite-9.3.7-r0.apk -> packages/rqlite-9.3.7-r0/mal-scan.json
running command mal [--format=json --exit-extraction=false --min-risk=critical --min-file-risk=critical --quantity-increases-risk=true --output=packages/rqlite-9.3.7-r0/mal-scan.json scan packages/x86_64/rqlite-9.3.7-r0.apk]
command "mal" completed successfully
scanning packages/x86_64/rqlite-oci-entrypoint-9.3.7-r0.apk -> packages/rqlite-oci-entrypoint-9.3.7-r0/mal-scan.json
running command mal [--format=json --exit-extraction=false --min-risk=critical --min-file-risk=critical --quantity-increases-risk=true --output=packages/rqlite-oci-entrypoint-9.3.7-r0/mal-scan.json scan packages/x86_64/rqlite-oci-entrypoint-9.3.7-r0.apk]
command "mal" completed successfully
malcontent scan completed successfully for 2 APKs in 10s
creating packages tarball...
running command tar [-C packages -cf packages.tar .]
command "tar" completed successfully
packages.tar sha256sum: 784bb84127e157ce5122115c3ca7827ad70f47caebfd0cc257ae20e94abe1855
sha256sum "784bb84127e157ce5122115c3ca7827ad70f47caebfd0cc257ae20e94abe1855" written to /dev/termination-log
Built 2 packages, hash: 784bb84127e157ce5122115c3ca7827ad70f47caebfd0cc257ae20e94abe1855, size: 18704384 bytes
uploading final packages tarball...
running command curl [-s --upload-file packages.tar -H Content-Type: application/octet-stream https://storage.googleapis.com/prod-bundle-staging/eco-2-28/x86_64/1767409292644005274-rqlite-9.3.7-r0.tar.gz?Expires=1767452492&GoogleAccessId=ebuild-456o8jve9m82pzkyd0rxyya%40prod-enforce-fabc.iam.gserviceaccount.com&Signature=JTQHV1IN64h10ANcVZYeeuJK4fnKV0x7L5J3eTbvRXNFA00gwu%2BjtuOX49k7zzRWiMSEdRa58cvlQGeM%2FLP%2Bp6DpKByJROV6n6rA0rwUJ7uXB6mvclOIVFjZQH5YYAgXJYFAWT1gRSyUVyGE%2BpDFfMW9aOAlIqwq7iE6binD0oMMV2QlN1goB4AMXEEtVkCPJhGXNkgzKaUYe%2Fkp8TXM1PGhF%2FozJ7xCHyAvl9q8l35Oqdx9CwFnnV7wkiKWI58mJBQZNW7bZfX868ROQkOOMmQAObKf5tbk5%2BUggOK5Qe4MipZSLLygbCDtWBgRY8MBUEkQCkn5iQxipjknZ22cyg%3D%3D]
command "curl" completed successfully
upload completed successfully
parsed env
using enhanced syft sbom melange runner
configuring puller identity "e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910"...
running command chainctl [auth login --audience apk.cgr.dev --identity e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910]
Successfully exchanged token.
Valid! Id: e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910
Updates are available for chainctl (current version: 0.2.185; latest: 0.2.187). To install, please run:
    $ chainctl update
command "chainctl" completed successfully
puller identity configured successfully
puller identity configured successfully
running tests...
running command /usr/bin/dind [dockerd] in background
command "/usr/bin/dind" started successfully
running command bash [-c 
  # Retry up to 60 seconds to wait for docker to start.
  worked=false
  for i in $(seq 60); do
    if docker info >/dev/null 2>&1; then
	  worked=true
	  break
    fi
    echo "docker healthcheck failed, docker is not ready, retrying... ($i/60 seconds so far)..."
    sleep 1
  done

  if [ "$worked" = "false" ]; then
    echo "Failed to start docker after 60 seconds"
    exit 1
  fi
]
command "bash" completed successfully
melange devel with runner qemu is testing:
image configuration:
  contents:
    build repositories: []
    runtime repositories: []
    repositories: []
    keyring:      []
    packages:     [curl rqlite]
  accounts:
    runas:  
    users:
      - uid=1000(build) gid=1000
    groups:
      - gid=1000(build) members=[build]
installing wolfi-baselayout (20230201-r24)
installing ca-certificates-bundle (20251003-r0)
installing glibc-locale-posix (2.42-r4)
installing glibc (2.42-r4)
installing ld-linux (2.42-r4)
installing libgcc (15.2.0-r6)
installing oldlibstdcxx-2.28 (8.5.0-r1)
installing libstdc++ (15.2.0-r6)
installing ct-manylinux-2.28-gcc-14 (1.28.0-r87)
installing ct-manylinux-2.28 (1.28.0-r87)
installing libunistring (1.4.1-r1)
installing libidn2 (2.3.8-r3)
installing libpsl (0.21.5-r6)
installing zlib (1.3.1-r51)
installing nghttp3 (1.14.0-r0)
installing libbrotlicommon1 (1.2.0-r1)
installing libbrotlidec1 (1.2.0-r1)
installing libnghttp2-14 (1.68.0-r0)
installing ncurses-terminfo-base (6.6_p20251230-r0)
installing ncurses (6.6_p20251230-r0)
installing readline (8.3-r1)
installing sqlite-libs (3.51.1-r0)
installing libxcrypt (4.5.2-r0)
installing libcrypt1 (2.42-r4)
installing heimdal-libs (7.8.0-r42)
installing gdbm (1.26-r1)
installing libcrypto3 (3.6.0-r6)
installing cyrus-sasl (2.1.28-r45)
installing libssl3 (3.6.0-r6)
installing libldap-2.6 (2.6.10-r7)
installing libverto (0.3.2-r6)
installing krb5-conf (1.0-r7)
installing libcom_err (1.47.3-r1)
installing keyutils-libs (1.6.3-r37)
installing krb5-libs (1.22.1-r1)
installing libcurl-openssl4 (8.17.0-r0)
installing curl (8.17.0-r0)
installing gmp (6.3.0-r8)
installing mpfr (4.2.2-r2)
installing mpc (1.3.1-r7)
installing posix-cc-wrappers (2-r7)
installing isl (0.27-r4)
installing libzstd1 (1.5.7-r5)
installing libstdc++-14 (14.3.0-r9)
installing libstdc++-14-dev (14.3.0-r9)
installing libquadmath (15.2.0-r6)
installing openssf-compiler-options (20250904-r2)
installing binutils (2.45.1-r2)
installing libxcrypt-dev (4.5.2-r0)
installing nss-db (2.42-r4)
installing nss-hesiod (2.42-r4)
installing linux-headers (6.18.3-r0)
installing glibc-dev (2.42-r4)
installing gcc-14 (14.3.0-r9)
installing libgfortran-14 (14.3.0-r9)
installing gfortran-14 (14.3.0-r9)
installing libgfortran (15.2.0-r6)
installing gcc-14-default (14.3.0-r9)
installing rqlite (9.3.7-r0)
installing wolfi-keys (1-r12)
installing apk-tools (2.14.10-r9)
installing busybox (1.37.0-r50)
installing wolfi-base (1-r7)
populating workspace /tmp/melange-workspace-1598344245 from rqlite
qemu: generating ssh key pairs for ephemeral VM
qemu: generating SSH host key for VM
qemu: generating base initramfs
image configuration:
  contents:
    build repositories: [https://apk.cgr.dev/chainguard]
    runtime repositories: []
    repositories: []
    keyring:      []
    packages:     [microvm-init]
installing wolfi-baselayout (20230201-r24)
installing ca-certificates-bundle (20251003-r0)
installing libgcc (15.2.0-r6)
installing glibc-locale-posix (2.42-r4)
installing glibc (2.42-r4)
installing ld-linux (2.42-r4)
installing gnutar-rmt (1.35-r7)
installing gnutar (1.35-r7)
installing libattr1 (2.5.2-r54)
installing attr (2.5.2-r54)
installing zlib (1.3.1-r51)
installing libzstd1 (1.5.7-r5)
installing xz (5.8.2-r0)
installing libcrypto3 (3.6.0-r6)
installing kmod (34.2-r42)
installing libmnl (1.0.5-r6)
installing libbz2-1 (1.0.8-r21)
installing libelf (0.194-r0)
installing libbpf (1.6.2-r0)
installing libverto (0.3.2-r6)
installing krb5-conf (1.0-r7)
installing libcom_err (1.47.3-r1)
installing keyutils-libs (1.6.3-r37)
installing libssl3 (3.6.0-r6)
installing krb5-libs (1.22.1-r1)
installing libtirpc (1.3.7-r1)
installing libpcre2-8-0 (10.47-r0)
installing libsepol (3.9-r1)
installing libselinux (3.9-r1)
installing libnftnl (1.3.1-r0)
installing xtables (1.8.11-r30)
installing libcap (2.77-r0)
installing iproute2 (6.17.0-r2)
installing libstdc++ (15.2.0-r6)
installing inih (62-r1)
installing liburcu (0.15.5-r0)
installing libblkid (2.41.3-r0)
installing libuuid (2.41.3-r0)
installing xfsprogs-core (6.17.0-r2)
installing xfsprogs (6.17.0-r2)
installing libmount (2.41.3-r0)
installing mount (2.41.3-r0)
installing ncurses-terminfo-base (6.6_p20251230-r0)
installing ncurses (6.6_p20251230-r0)
installing setarch (2.41.3-r0)
installing libfdisk (2.41.3-r0)
installing sqlite-libs (3.51.1-r0)
installing util-linux (2.41.3-r0)
installing libsmartcols (2.41.3-r0)
installing util-linux-misc (2.41.3-r0)
installing libxcrypt (4.5.2-r0)
installing libcrypt1 (2.42-r4)
installing linux-pam (1.7.1-r4)
installing openssh-keygen (10.2_p1-r3)
installing openssh-server-config (10.2_p1-r3)
installing openssh-server (10.2_p1-r3)
installing busybox (1.37.0-r50)
installing microvm-init (0.0.1-r15)
qemu: starting VM
qemu: waiting for SSH

m/grpc-gateway/v2 v2.27.3
go: downloading github.com/hashicorp/golang-lru v1.0.2
go: downloading github.com/coreos/go-systemd/v22 v22.6.0
go: downloading go.uber.org/multierr v1.11.0
go: downloading golang.org/x/net v0.48.0
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b
go: downloading golang.org/x/text v0.32.0
# github.com/mattn/go-sqlite3
In function 'sqlite3Strlen30',
    inlined from 'sqlite3ParseUri' at sqlite3-binding.c:188035:18:
sqlite3-binding.c:35962:28: warning: 'strlen' reading 1 or more bytes from a region of size 0 [-Wstringop-overread]
35962 |   return 0x3fffffff & (int)strlen(z);
      |                            ^~~~~~~~~
In function 'sqlite3ParseUri':
cc1: note: source object is likely at address zero
running pipeline for subpackage rqlite-oci-entrypoint
retrieving workspace from builder: 
retrieved and wrote post-build workspace to: /tmp/melange-workspace-3133301720
running package linters for rqlite
linting apk: rqlite
no lint findings to persist for package rqlite
running package linters for rqlite-oci-entrypoint
linting apk: rqlite-oci-entrypoint
no lint findings to persist for package rqlite-oci-entrypoint
checking license information
  LICENSE: MIT (1.000000) (notice)
  db/humanize/LICENSE: MIT (1.000000) (notice)
  tcp/pool/LICENSE: MIT (1.000000) (notice)
  testdata/chinook/LICENSE: MIT (1.000000) (notice)
  db/wal/LICENSE.md: Apache-2.0 (1.000000) (notice)
checking gathered license information against the configuration
detected license differences:
  db/wal/LICENSE.md: Apache-2.0 not found
detected license differences, please check the configuration
license information check complete
generating enhanced Syft SBOMs merged with melange metadata
invalid license: NOASSERTION
invalid license: NOASSERTION
created base melange SBOMs with build metadata
scanning package directory with Syft to enhance SBOM
generating SBOM from unpacked directory
finished Syft SBOM generation
successfully merged Syft scan results with melange SBOM
scanning package directory with Syft to enhance SBOM
generating SBOM from unpacked directory
finished Syft SBOM generation
successfully merged Syft scan results with melange SBOM
enhanced all SBOMs with Syft scan results
generating package rqlite-9.3.7-r0
2026/01/03 03:03:20 INFO completed enhanced Syft SBOM generation with merged metadata
scanning for ld.so.conf.d files...
scanning for shared object dependencies...
scanning for commands...
  found command usr/bin/rqlite
  found command usr/bin/rqlited
scanning for -doc package...
scanning for pkg-config data...
scanning for python modules...
scanning for ruby gems...
scanning for shbang deps...
scanning for kernel dependencies...
  provides:
    cmd:rqlite=9.3.7-r0
    cmd:rqlited=9.3.7-r0
  installed-size: 45483779
  data.tar.gz digest: 730d999c9c332d4453d330db505e82c751bb3891cd157454d1fdb64794252229
wrote packages/aarch64/rqlite-9.3.7-r0.apk
generating package rqlite-oci-entrypoint-9.3.7-r0
scanning for ld.so.conf.d files...
scanning for shared object dependencies...
scanning for commands...
  found command usr/bin/docker-entrypoint.sh
scanning for -doc package...
scanning for pkg-config data...
scanning for python modules...
scanning for ruby gems...
scanning for shbang deps...
scanning for kernel dependencies...
  runtime:
    busybox
  provides:
    cmd:docker-entrypoint.sh=9.3.7-r0
  installed-size: 39217
  data.tar.gz digest: 1f54cb46982e0a0aa9011ad7beffaa1254c259b968d5cabfae84d997bf24a758
wrote packages/aarch64/rqlite-oci-entrypoint-9.3.7-r0.apk
cleaning Workspace by removing 38 file/directories in /home/build
generating apk index from packages in packages/aarch64
processing package packages/aarch64/rqlite-oci-entrypoint-9.3.7-r0.apk
processing package packages/aarch64/rqlite-9.3.7-r0.apk
updating index at packages/aarch64/APKINDEX.tar.gz with new packages: [rqlite-9.3.7-r0 rqlite-oci-entrypoint-9.3.7-r0]
build completed successfully
running malcontent scan...
found 2 APK files to scan
scanning packages/aarch64/rqlite-9.3.7-r0.apk -> packages/rqlite-9.3.7-r0/mal-scan.json
running command mal [--format=json --exit-extraction=false --min-risk=critical --min-file-risk=critical --quantity-increases-risk=true --output=packages/rqlite-9.3.7-r0/mal-scan.json scan packages/aarch64/rqlite-9.3.7-r0.apk]
command "mal" completed successfully
scanning packages/aarch64/rqlite-oci-entrypoint-9.3.7-r0.apk -> packages/rqlite-oci-entrypoint-9.3.7-r0/mal-scan.json
running command mal [--format=json --exit-extraction=false --min-risk=critical --min-file-risk=critical --quantity-increases-risk=true --output=packages/rqlite-oci-entrypoint-9.3.7-r0/mal-scan.json scan packages/aarch64/rqlite-oci-entrypoint-9.3.7-r0.apk]
command "mal" completed successfully
malcontent scan completed successfully for 2 APKs in 8s
creating packages tarball...
running command tar [-C packages -cf packages.tar .]
command "tar" completed successfully
packages.tar sha256sum: 4d89662920224bcfc166b70cfcec6e10aa34601cb92e96884e3b102dd37b4f54
sha256sum "4d89662920224bcfc166b70cfcec6e10aa34601cb92e96884e3b102dd37b4f54" written to /dev/termination-log
Built 2 packages, hash: 4d89662920224bcfc166b70cfcec6e10aa34601cb92e96884e3b102dd37b4f54, size: 17133056 bytes
uploading final packages tarball...
running command curl [-s --upload-file packages.tar -H Content-Type: application/octet-stream https://storage.googleapis.com/prod-bundle-staging/eco-2-28/aarch64/1767409292643946724-rqlite-9.3.7-r0.tar.gz?Expires=1767452492&GoogleAccessId=ebuild-456o8jve9m82pzkyd0rxyya%40prod-enforce-fabc.iam.gserviceaccount.com&Signature=fJOU%2B8rP30uKfDKMSHP7nE9dG6TEtLfSnduCKEQuGyjwtv7cJGyBlwzfMGRHuQykcCHKkUIlMzHmxnek%2BDS0wGHtKx4wbvqR%2F651v9xhtSNDaWyksVOejDNtClXy4%2FjYkV4sZr5O%2FUwVPh0Ame14zESRmEo1Y%2BtACumiKkm7J2w9N6%2BH9hPd4WTPiOYwzzKrO9Pc4qgiMt7FIxK8Q3CeKrjO776RbqOPzj53xGf5OxfP6H0LQ8lYz5G59C5K29%2Fa3quBrv1djuxwzUaPLrowtnWjboAK2qf%2FDHNrgqwrR7XOgqMHRJvXZRVfVQeUCXirBLKDS9rjbACwhGl8xmWg3A%3D%3D]
command "curl" completed successfully
upload completed successfully
parsed env
using enhanced syft sbom melange runner
configuring puller identity "e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910"...
running command chainctl [auth login --audience apk.cgr.dev --identity e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910]
Successfully exchanged token.
Valid! Id: e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910
Updates are available for chainctl (current version: 0.2.185; latest: 0.2.187). To install, please run:
    $ chainctl update
command "chainctl" completed successfully
puller identity configured successfully
puller identity configured successfully
running tests...
running command /usr/bin/dind [dockerd] in background
command "/usr/bin/dind" started successfully
running command bash [-c 
  # Retry up to 60 seconds to wait for docker to start.
  worked=false
  for i in $(seq 60); do
    if docker info >/dev/null 2>&1; then
	  worked=true
	  break
    fi
    echo "docker healthcheck failed, docker is not ready, retrying... ($i/60 seconds so far)..."
    sleep 1
  done

  if [ "$worked" = "false" ]; then
    echo "Failed to start docker after 60 seconds"
    exit 1
  fi
]
command "bash" completed successfully
melange devel with runner docker is testing:
image configuration:
  contents:
    build repositories: []
    runtime repositories: []
    repositories: []
    keyring:      []
    packages:     [curl rqlite]
  accounts:
    runas:  
    users:
      - uid=1000(build) gid=1000
    groups:
      - gid=1000(build) members=[build]
installing wolfi-baselayout (20230201-r24)
installing ca-certificates-bundle (20251003-r0)
installing glibc-locale-posix (2.42-r4)
installing ld-linux (2.42-r4)
installing glibc (2.42-r4)
installing libgcc (15.2.0-r6)
installing oldlibstdcxx-2.28 (8.5.0-r1)
installing libstdc++ (15.2.0-r6)
installing ct-manylinux-2.28-gcc-14 (1.28.0-r87)
installing ct-manylinux-2.28 (1.28.0-r87)
installing libunistring (1.4.1-r1)
installing libidn2 (2.3.8-r3)
installing libpsl (0.21.5-r6)
installing zlib (1.3.1-r51)
installing nghttp3 (1.14.0-r0)
installing libbrotlicommon1 (1.2.0-r1)
installing libbrotlidec1 (1.2.0-r1)
installing libnghttp2-14 (1.68.0-r0)
installing ncurses-terminfo-base (6.6_p20251230-r0)
installing ncurses (6.6_p20251230-r0)
installing readline (8.3-r1)
installing sqlite-libs (3.51.1-r0)
installing libxcrypt (4.5.2-r0)
installing libcrypt1 (2.42-r4)
installing heimdal-libs (7.8.0-r42)
installing gdbm (1.26-r1)
installing libcrypto3 (3.6.0-r6)
installing cyrus-sasl (2.1.28-r45)
installing libssl3 (3.6.0-r6)
installing libldap-2.6 (2.6.10-r7)
installing libverto (0.3.2-r6)
installing krb5-conf (1.0-r7)
installing libcom_err (1.47.3-r1)
installing keyutils-libs (1.6.3-r37)
installing krb5-libs (1.22.1-r1)
installing libcurl-openssl4 (8.17.0-r0)
installing curl (8.17.0-r0)
installing gmp (6.3.0-r8)
installing mpfr (4.2.2-r2)
installing mpc (1.3.1-r7)
installing posix-cc-wrappers (2-r7)
installing isl (0.27-r4)
installing libzstd1 (1.5.7-r5)
installing libstdc++-14 (14.3.0-r9)
installing libstdc++-14-dev (14.3.0-r9)
installing libquadmath (15.2.0-r6)
installing openssf-compiler-options (20250904-r2)
installing binutils (2.45.1-r2)
installing libxcrypt-dev (4.5.2-r0)
installing nss-db (2.42-r4)
installing nss-hesiod (2.42-r4)
installing linux-headers (6.18.3-r0)
installing glibc-dev (2.42-r4)
installing gcc-14 (14.3.0-r9)
installing libgfortran-14 (14.3.0-r9)
installing gfortran-14 (14.3.0-r9)
installing libgfortran (15.2.0-r6)
installing gcc-14-default (14.3.0-r9)
installing rqlite (9.3.7-r0)
installing wolfi-keys (1-r12)
installing apk-tools (2.14.10-r9)
installing busybox (1.37.0-r50)
installing wolfi-base (1-r7)
layer digest: sha256:18642a002b2c90b8f66281f908b1b7c28a368ebd21b74d40f182337ea440a8b4
layer diffID: sha256:579b955815744794a078ede42582753db438ad0cc8a734a44f27b09ba191d86a
saving OCI image locally: apko.local/cache:9fa6f90be76efe2bbb3a8b7a8e8d37430dcf67ff182ed3131e8abb503ba0e2f6
tagging local image apko.local/cache:9fa6f90be76efe2bbb3a8b7a8e8d37430dcf67ff182ed3131e8abb503ba0e2f6 as index.docker.io/library/melange:latest
populating workspace /tmp/melange-workspace-1778873122 from rqlite
running the main test pipeline