bench-scenarios/fixtures/intake/fixtures.json
{
"schema": "holger.bench-fixtures/v1",
"about": "Real public packages for the intake-chain benches (holger-bench-scenarios `intake`). Files marked `committed` live beside this manifest; an entry with `members` is a wheel committed as its unpacked members (text) and made at load time (`intake::wheel_from_members`, deterministic, held to the wheel's own RECORD), since OpenSSF Scorecard counts a committed .whl as a binary artifact; `upstream_sha256` is the registry file it was unpacked from. The others are fetched once on the online side by `cargo xtask bench --fetch-fixtures` (or HOLGER_BENCH_FETCH=1) into the fixture cache, and checked against `sha256` when it is set. The OSV dumps change every day, so they carry no pin; the receipt records the advisory count it measured. Licences: requests Apache-2.0, numpy BSD-3-Clause, lodash MIT, typescript Apache-2.0, serde and tokio MIT OR Apache-2.0, the Chainguard image Apache-2.0 and its packages' own licences.",
"packages": [
{ "key": "wheel_s", "file": "requests-2.32.3-py3-none-any.whl", "ecosystem": "pip", "name": "requests", "version": "2.32.3", "committed": true,
"members": "requests-2.32.3-py3-none-any",
"upstream_sha256": "70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6" },
{ "key": "wheel_l", "file": "numpy-2.1.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", "ecosystem": "pip", "name": "numpy", "version": "2.1.3",
"url": "https://files.pythonhosted.org/packages/9e/3e/3757f304c704f2f0294a6b8340fcf2be244038be07da4cccf390fa678a9f/numpy-2.1.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl",
"sha256": "2312b2aa89e1f43ecea6da6ea9a810d06aae08321609d8dc0d0eda6d946a541b" },
{ "key": "npm_s", "file": "lodash-4.17.21.tgz", "ecosystem": "npm", "name": "lodash", "version": "4.17.21", "committed": true,
"sha256": "6a087ac9e5702a0c9d60fbcd48696012646ec8df1491dea472b150e79fcaf804" },
{ "key": "npm_l", "file": "typescript-5.6.3.tgz", "ecosystem": "npm", "name": "typescript", "version": "5.6.3",
"url": "https://registry.npmjs.org/typescript/-/typescript-5.6.3.tgz",
"sha256": "ef67f8d8ad895858024b7339d3e34bf112cae3c5db1f538c3079038b17ae30fa" },
{ "key": "crate_s", "file": "serde-1.0.215.crate", "ecosystem": "cargo", "name": "serde", "version": "1.0.215", "committed": true,
"sha256": "6513c1ad0b11a9376da888e3e0baa0077f1aed55c17f50e7b2397136129fb88f" },
{ "key": "crate_l", "file": "tokio-1.41.1.crate", "ecosystem": "cargo", "name": "tokio", "version": "1.41.1",
"url": "https://static.crates.io/crates/tokio/tokio-1.41.1.crate",
"sha256": "22cfb5bee7a6a52939ca9224d6ac897bb669134078daa8735560897f69de4d33" },
{ "key": "oci_layer", "file": "chainguard-python-layer-eb8590f7.tar.gz", "ecosystem": "oci", "name": "cgr.dev/chainguard/python", "version": "latest@sha256:f6b8842ea63af0021bc79d164c3023b5ea975031c80b6e6f7ade41640084d053",
"oci": { "registry": "cgr.dev", "repository": "chainguard/python", "digest": "sha256:eb8590f7839b18657487c5067158acff6083438fa29307e43d4d6e5c38d36024" },
"sha256": "eb8590f7839b18657487c5067158acff6083438fa29307e43d4d6e5c38d36024" }
],
"advisories": [
{ "key": "osv_pypi", "file": "osv-PyPI-all.zip", "url": "https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip" },
{ "key": "osv_npm", "file": "osv-npm-all.zip", "url": "https://osv-vulnerabilities.storage.googleapis.com/npm/all.zip" },
{ "key": "osv_crates", "file": "osv-crates.io-all.zip", "url": "https://osv-vulnerabilities.storage.googleapis.com/crates.io/all.zip" }
],
"provenance": {
"dir": "chainguard-python",
"image": "cgr.dev/chainguard/python@sha256:f6b8842ea63af0021bc79d164c3023b5ea975031c80b6e6f7ade41640084d053",
"signature": { "payload": "sig-0.payload", "annotations": "sig-0.annotations.json", "rekor": "rekor-3419335208.json" },
"attestation": { "envelope": "att-0.payload", "annotations": "att-0.annotations.json", "rekor": "rekor-3416929314.json", "predicate": "https://slsa.dev/provenance/v1" },
"rekor_public_key": "rekor-pubkey.pem"
}
}