melange: Incomplete package integrity verification allows data section substitution

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams

apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base

apko has incorrect permission (0666) in /etc/ld.so.cache and other files

apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root

apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams