Dimitri John Ledkov

crypto/rand: implement Jitter Entropy based random seed source

11

Implement Jitter Entropy based random seed source using statically linked jitterentropy-library. This is desirable for those that don't control the OS provided entropy, and cannot assert if OS provides SP800-90B...

### Feature request Could you please add build tags to be able to compile entry point without SPIRE support? Or split spire support into a secondary binary? ### Use case...

tcp keep alive

3

- **cluster: set KeepAlive setting to server.tcpkeepalive** Keepalive was initially introduced in #9230 with setting of 30,000 seconds (8h20min). Which was then corrected to 30s. As per RFC 1122 4.2.3.6...

velero needlessly requires sh in kubectl image

1

**Describe the problem/challenge you have** Currently velero helm chart requires "sh" "which" in kubectl image, which are copied to a shared volume, which is then copied to velero image and...

subpackages if: does not seem to contain substitutions

2

```yaml package: name: wolfi-base version: 1 epoch: 7 description: "Wolfi base metapackage" copyright: - license: MIT dependencies: runtime: - apk-tools - busybox - wolfi-keys environment: contents: packages: - busybox pipeline:...

Private libs end up in public provides

6

```yaml gcc-12-test-sca.yaml package: name: gcc-12-test-sca version: 12.4.0 epoch: 0 description: "the GNU compiler collection - version 12" copyright: - license: GPL-3.0-or-later environment: contents: packages: - busybox - gcc-12 pipeline: -...

Python test pipelines should test every python version

3

See https://github.com/wolfi-dev/os/pull/20318/files#r1643611760 We should add import tests where possible.

Due to a golang toolchain regression, one previously was able to observe failure to decrypt secrets - but only when accessed concurrently. Does this benchmark tool use multi-threading to concurrently...

Lint: please add "detected-spdx-license-missmatch" linter

1

**Description** Please add a new lint check. Use a license detector (for example https://github.com/go-enry/go-license-detector/tree/master) to detect the SPDX license of given package. Compare it to the declared SPDX license. And...

Whilst https://pkg.go.dev/net/http/pprof is a useful diagnostics tool, it exposes a potentially unaaccounted for endpoint. It is unsuitable to have this enabled in production deployments. Compile out this functionality. Ideally there...