Dimitri John Ledkov

> If we do this one other thing I am reminded of - boringssl and aws-lc add some onerous build steps. With boring we are able to use a pre...

Some of the above points maybe very moot - in the context of ztunnel and how well coded it is. You appear to be very FIPS-friendly, intentionally picking a tiny...

Also note https://github.com/istio/ztunnel/pull/820 which was merged However note that rustls currently does not have a FIPS feature for the rustl-webpki depedency - see https://github.com/rustls/webpki/issues/307

when building ztunnel with openssl in fips mode; can we not allow tls v1.2 as well?

IMHO the version for pc that we put in APK metadata should be the package metadata, not contents of pc Version. Whilst it feels like the soname, it really isn't.

Oh it can work on git repos too.... i wonder if i can just run that tool across all of wolfi and generate a report.

As seen in https://apk.dag.dev/https/apk.cgr.dev/wolfi-presubmit/c13a1a179dd6f32fd959d567f2607fbd83346b42/x86_64/wasi-sdk-24-r0.apk@sha1:a7cffbdb50053093176a5056cc62a6ea7a758f74/.PKGINFO ``` depend = [so:ld-linux-x86-64.so.2](https://apk.dag.dev/https/apk.cgr.dev/wolfi-presubmit/c13a1a179dd6f32fd959d567f2607fbd83346b42/x86_64/APKINDEX.tar.gz/APKINDEX?provide=so%3Ald-linux-x86-64.so.2&full=true) depend = [so:libc.so.6](https://apk.dag.dev/https/apk.cgr.dev/wolfi-presubmit/c13a1a179dd6f32fd959d567f2607fbd83346b42/x86_64/APKINDEX.tar.gz/APKINDEX?provide=so%3Alibc.so.6&full=true) depend = [so:libgcc_s.so.1](https://apk.dag.dev/https/apk.cgr.dev/wolfi-presubmit/c13a1a179dd6f32fd959d567f2607fbd83346b42/x86_64/APKINDEX.tar.gz/APKINDEX?provide=so%3Alibgcc_s.so.1&full=true) depend = [so:libm.so.6](https://apk.dag.dev/https/apk.cgr.dev/wolfi-presubmit/c13a1a179dd6f32fd959d567f2607fbd83346b42/x86_64/APKINDEX.tar.gz/APKINDEX?provide=so%3Alibm.so.6&full=true) provides = [cmd:clang-18=24-r0](https://apk.dag.dev/https/apk.cgr.dev/wolfi-presubmit/c13a1a179dd6f32fd959d567f2607fbd83346b42/x86_64/APKINDEX.tar.gz/APKINDEX?depend=cmd%3Aclang-18&full=true) provides = [cmd:clang-apply-replacements=24-r0](https://apk.dag.dev/https/apk.cgr.dev/wolfi-presubmit/c13a1a179dd6f32fd959d567f2607fbd83346b42/x86_64/APKINDEX.tar.gz/APKINDEX?depend=cmd%3Aclang-apply-replacements&full=true) provides = [cmd:clang-format=24-r0](https://apk.dag.dev/https/apk.cgr.dev/wolfi-presubmit/c13a1a179dd6f32fd959d567f2607fbd83346b42/x86_64/APKINDEX.tar.gz/APKINDEX?depend=cmd%3Aclang-format&full=true) provides = [cmd:clang-tidy=24-r0](https://apk.dag.dev/https/apk.cgr.dev/wolfi-presubmit/c13a1a179dd6f32fd959d567f2607fbd83346b42/x86_64/APKINDEX.tar.gz/APKINDEX?depend=cmd%3Aclang-tidy&full=true) provides...

Given: - https://github.com/spec-first/connexion/pull/1585 I don't understand how upstream managed to release this.

``` # apk info -W /opt/airflow/venv/lib/python3.12/site-packages/werkzeug-2.3.8.dist-info/METADATA /opt/airflow/venv/lib/python3.12/site-packages/werkzeug-2.3.8.dist-info/METADATA is owned by airflow-2.9.3-r2 ``` Currently we ship airflow 2.9.3 with werkzeug 2.3.8 - is it thus broken / dead-on-arrival? As the above...

This is two months old, so likely no longer relevant.