debian-12.0/, alpine-3.18.0/: /etc/os-release and the package database (dpkg status, apk installed) of the
official debian:12.0 and alpine:3.18.0 images (Docker Hub), copied 2026-10-28.
images.json: the source packages Frame reads from each image, equal to `dpkg-query -W -f
'${source:Package} ${source:Version}'` and to `apk list --installed`'s origins.
osv_records.json.gz, osv_expected.json: OSV's API (/v1/query) for every one of those packages at its
version, and the records it returned (OSV data, CC-BY 4.0).
lang-image/: the files Frame reads from an image built by lang-image.Dockerfile (docker export, 2026-10-28):
dpkg status and info/*.list, Python dist-info/egg-info, node_modules package.json, the commons-text 1.9 jar.
lang-image.json: what the image's own tools report: dpkg-query (source packages), importlib.metadata for
/usr/local's Python, `npm ls --all --json` in the build stage, and the jar's pom.properties.
rocky-9.4/, alma-8.9/: /etc/os-release and an rpm database made by rpm itself in rockylinux/rockylinux:9.4 (sqlite)
and almalinux:8.9 (Berkeley DB): `rpmdb --exportdb` | `rpmdb --importdb` into a new database, every package but
bash, curl-minimal, libcurl-minimal, expat, glibc, libxml2, openssl-libs, sqlite-libs and zlib removed with
`rpm -e --justdb`, then `rpm --rebuilddb`. rpm_images.json: `rpm -qa` of those databases.
rpm_osv_expected.json, rpm_osv_records.json.gz: OSV's API (/v1/query, every page) for each package as Frame names it
(Rocky: source package; AlmaLinux: binary package), and the records it returned (OSV data, CC-BY 4.0), 2026-10-28.
ubi-9.4/: the same, from registry.access.redhat.com/ubi9/ubi:9.4 (sqlite), keeping bash, curl-minimal,
libcurl-minimal, expat, glibc, libxml2, openssl-libs, sqlite-libs and zlib. Its rpm_osv_expected.json entries are
the union of OSV's /v1/query answers over every RHEL 9 stream (Red Hat:enterprise_linux:9::baseos, ::appstream,
::crb and the rest), 2026-10-28.
