zip

4 tools · 1 release line

zip, zipcloak, zipnote, zipsplit. Every tool here carries the same sandbox boundary.

boks zip

boks zipcloak

boks zipnote

boks zipsplit

Source ↗ Registry ↗

Release lines we maintain · the project decides these

findings shown are the whole project at that line

Tag Resolves to Lifecycle Updated Findings What the tag promises

latest 3.0 stable 2026-08-19

tracks the newest supported release

stable — floats, carries security updates
unstable — tracks pre-releases, may break
eol — frozen, upstream is done

Tools in this project · pick one to inspect

all share one boundary

Tool Capabilities Seccomp Findings Image Description

zip rw default clean zip Package and compress (archive) files zipcloak rw default clean zip Encrypt entries in a zipfile zipnote rw default clean zip Write the comments in zipfile to stdout, edit comments and rename files in zipfile zipsplit rw default clean zip Split a zipfile into smaller zipfiles

showing zip zipcloak zipnote zipsplit from zip@latest → 3.0 stable

Findings

clean

identical on amd64, arm64 — one table describes both

No known findings in this image at the last scan.

1 further advisory matched this image and was assessed not to apply to it — see the VEX document for the reasoning and the evidence

CVE Affects Assessed

CVE-2026-42250 bzip2 not affected · vex

These are the findings of zip, which ships every tool in this project. boks reports and gates; it never edits an image to clear a finding.

Composition

default nothing — stands alone

runtime none — self-contained

composes not used as a runtime

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. boks resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default nothing — stands alone

runtime none — self-contained

composes not used as a runtime

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. boks resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default nothing — stands alone

runtime none — self-contained

composes not used as a runtime

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. boks resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default nothing — stands alone

runtime none — self-contained

composes not used as a runtime

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. boks resolves that for you — -e git,python:flake8 composes explicitly.

Image

image ghcr.io/boks-sh/zip:3.0

digest

platforms

size <1 MB unpacked · 1 layer

base scratch

signed cosign · verified

last scan 2026-08-19

Sandbox boundary

zip

capabilities

Filled is granted by default; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

dotfiles mapped in

read-only unless noted

none

env passed through

0 of 1

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, boks scopes it there rather than granting it everywhere.

Sandbox boundary

zipcloak

capabilities

Filled is granted by default; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

dotfiles mapped in

read-only unless noted

none

env passed through

0 of 1

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, boks scopes it there rather than granting it everywhere.

Sandbox boundary

zipnote

capabilities

Filled is granted by default; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

dotfiles mapped in

read-only unless noted

none

env passed through

0 of 1

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, boks scopes it there rather than granting it everywhere.

Sandbox boundary

zipsplit

capabilities

Filled is granted by default; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

dotfiles mapped in

read-only unless noted

none

env passed through

0 of 1

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, boks scopes it there rather than granting it everywhere.

Provenance

sbom amd64 ↗ arm64 ↗

attestation amd64 ↗ arm64 ↗

scan report amd64 ↗ arm64 ↗ grype · 2026-08-19

vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

0 findings across this project at latest. Counted once per advisory across every image the project builds.