From 4f2adbf5274f077aacde0f45c0de11ccfa035a22 Mon Sep 17 00:00:00 2001
From: Jon Johnson <jon.johnson@chainguard.dev>
Date: Fri, 13 Dec 2024 12:27:15 -0800
Subject: [PATCH] Include /opt by default (#1435)

Fixes #1375

Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev>
---
 internal/cli/publish_test.go                  |   8 ++--
 ...14f87f64e736d577e618fc77707bb710a8e59842b1 |   1 -
 ...852303b84996b78b7d941b4c9b08a41e0a77d1b18} |   2 +-
 ...4331454f74315d2edbcf68e2af172f8efa5c95fe19 |   1 +
 ...a808be94fff70723d939d7ce6d8053a823f4720d57 |   1 -
 ...c918022ba897a381c264722a6b1d5c986471e9751e | Bin 0 -> 3267 bytes
 ...d8d4aff54d14817a2675575b4f557499655097f3d} | Bin 3239 -> 3256 bytes
 ...8f7cc823f22a2e45b73c939023888109a66a97951} |   2 +-
 ...82332b61325ae8e6f8ddc49159e7bafc30453bfc17 |   1 +
 ...ac873a7f2bbe3d5e3b841c729b6a58706750f01ce0 | Bin 3249 -> 0 bytes
 internal/cli/testdata/golden/index.json       |   2 +-
 .../golden/sboms/sbom-aarch64.spdx.json       |  24 +++++-----
 .../golden/sboms/sbom-index.spdx.json         |  42 +++++++++---------
 .../golden/sboms/sbom-x86_64.spdx.json        |  24 +++++-----
 pkg/apk/apk/implementation.go                 |   1 +
 15 files changed, 55 insertions(+), 54 deletions(-)
 delete mode 100644 internal/cli/testdata/golden/blobs/sha256/18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1
 rename internal/cli/testdata/golden/blobs/sha256/{c4fba92e353f8a3be76c9feaa4763c3f9177697364fe54943eda3f51ec641d55 => 35af2fe3834e23d725a234d852303b84996b78b7d941b4c9b08a41e0a77d1b18} (78%)
 create mode 100644 internal/cli/testdata/golden/blobs/sha256/43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19
 delete mode 100644 internal/cli/testdata/golden/blobs/sha256/5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57
 create mode 100644 internal/cli/testdata/golden/blobs/sha256/82c91678ac0f40848c5cdac918022ba897a381c264722a6b1d5c986471e9751e
 rename internal/cli/testdata/golden/blobs/sha256/{26344c4399ce8d47eed8a16da31044b45634ab26a8e43493574a7c944ca35328 => 8854f6c83258e956f0811a1d8d4aff54d14817a2675575b4f557499655097f3d} (56%)
 rename internal/cli/testdata/golden/blobs/sha256/{41b285b4a6870e47e59ef34f87d3637a202783f535d70d0152c53d80f57c90a2 => 9b913f37c3adc743715bd578f7cc823f22a2e45b73c939023888109a66a97951} (78%)
 create mode 100644 internal/cli/testdata/golden/blobs/sha256/dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17
 delete mode 100644 internal/cli/testdata/golden/blobs/sha256/e29f907eae193b71f82232ac873a7f2bbe3d5e3b841c729b6a58706750f01ce0

diff --git a/internal/cli/publish_test.go b/internal/cli/publish_test.go
index 047a85b8b..157fb593b 100644
--- a/internal/cli/publish_test.go
+++ b/internal/cli/publish_test.go
@@ -91,7 +91,7 @@ func TestPublish(t *testing.T) {
 
 	// This test will fail if we ever make a change in apko that changes the image.
 	// Sometimes, this is intentional, and we need to change this and bump the version.
-	want := "sha256:f341d69eddfffdd181935fe3cffe185fdf20778835b797089a818e0b1b540f93"
+	want := "sha256:df77d3071fed05b55a2c76ce0af54b4e8174404ee29962162b627aaa42b43b91"
 	require.Equal(t, want, digest.String())
 
 	sdst := fmt.Sprintf("%s:%s.sbom", dst, strings.ReplaceAll(want, ":", "-"))
@@ -109,7 +109,7 @@ func TestPublish(t *testing.T) {
 
 	// This test will fail if we ever make a change in apko that changes the SBOM.
 	// Sometimes, this is intentional, and we need to change this and bump the version.
-	swant := "sha256:9d55cc224dadc94faf9f2fb974a55e10d523625df652954030f5f7f3210b427a"
+	swant := "sha256:18b8dc7cd228ab657a248b94c256ec4b3e12a69901161d027ee4b6bbee0e87b6"
 	require.Equal(t, swant, got)
 
 	im, err := idx.IndexManifest()
@@ -118,8 +118,8 @@ func TestPublish(t *testing.T) {
 	// We also want to check the children SBOMs because the index SBOM does not have
 	// references to the children SBOMs, just the children!
 	wantBoms := []string{
-		"sha256:c2edd8bec2034de667ac19701eed3032512190cf0d46300acef5afccee01dbd1",
-		"sha256:94213634580d1d5feb97cdcc030f804d28ed6f8e77cde225b0aae53d5b927a33",
+		"sha256:b30707314d196b3f65b1e9b05f34b795588f0031343bf3e3e75f256aff3fc7e6",
+		"sha256:1449715ad955e02f8a8f8f5b9adff17d89c2443e199af2555f8336df18720fe7",
 	}
 
 	for i, m := range im.Manifests {
diff --git a/internal/cli/testdata/golden/blobs/sha256/18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1 b/internal/cli/testdata/golden/blobs/sha256/18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1
deleted file mode 100644
index f3e1ebb70..000000000
--- a/internal/cli/testdata/golden/blobs/sha256/18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1
+++ /dev/null
@@ -1 +0,0 @@
-{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","size":593,"digest":"sha256:c4fba92e353f8a3be76c9feaa4763c3f9177697364fe54943eda3f51ec641d55"},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","size":3249,"digest":"sha256:e29f907eae193b71f82232ac873a7f2bbe3d5e3b841c729b6a58706750f01ce0"}],"annotations":{"org.opencontainers.image.created":"1970-01-01T00:00:00Z"}}
\ No newline at end of file
diff --git a/internal/cli/testdata/golden/blobs/sha256/c4fba92e353f8a3be76c9feaa4763c3f9177697364fe54943eda3f51ec641d55 b/internal/cli/testdata/golden/blobs/sha256/35af2fe3834e23d725a234d852303b84996b78b7d941b4c9b08a41e0a77d1b18
similarity index 78%
rename from internal/cli/testdata/golden/blobs/sha256/c4fba92e353f8a3be76c9feaa4763c3f9177697364fe54943eda3f51ec641d55
rename to internal/cli/testdata/golden/blobs/sha256/35af2fe3834e23d725a234d852303b84996b78b7d941b4c9b08a41e0a77d1b18
index 0e8869230..174616618 100644
--- a/internal/cli/testdata/golden/blobs/sha256/c4fba92e353f8a3be76c9feaa4763c3f9177697364fe54943eda3f51ec641d55
+++ b/internal/cli/testdata/golden/blobs/sha256/35af2fe3834e23d725a234d852303b84996b78b7d941b4c9b08a41e0a77d1b18
@@ -1 +1 @@
-{"architecture":"arm64","author":"github.com/chainguard-dev/apko","created":"1970-01-01T00:00:00Z","history":[{"author":"apko","created":"1970-01-01T00:00:00Z","created_by":"apko","comment":"This is an apko single-layer image"}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:70043edb168572d0c65b9545471f090ecbf2eefccc466e2ba3fd01df5cbe00d3"]},"config":{"Entrypoint":["/bin/sh","-l"],"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt"],"Labels":{"org.opencontainers.image.created":"1970-01-01T00:00:00Z"}}}
\ No newline at end of file
+{"architecture":"arm64","author":"github.com/chainguard-dev/apko","created":"1970-01-01T00:00:00Z","history":[{"author":"apko","created":"1970-01-01T00:00:00Z","created_by":"apko","comment":"This is an apko single-layer image"}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:568821083896751c424c849bd0222c7026e123b72906839f4123d4be014bfead"]},"config":{"Entrypoint":["/bin/sh","-l"],"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt"],"Labels":{"org.opencontainers.image.created":"1970-01-01T00:00:00Z"}}}
\ No newline at end of file
diff --git a/internal/cli/testdata/golden/blobs/sha256/43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19 b/internal/cli/testdata/golden/blobs/sha256/43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19
new file mode 100644
index 000000000..172334364
--- /dev/null
+++ b/internal/cli/testdata/golden/blobs/sha256/43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19
@@ -0,0 +1 @@
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","size":593,"digest":"sha256:9b913f37c3adc743715bd578f7cc823f22a2e45b73c939023888109a66a97951"},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","size":3256,"digest":"sha256:8854f6c83258e956f0811a1d8d4aff54d14817a2675575b4f557499655097f3d"}],"annotations":{"org.opencontainers.image.created":"1970-01-01T00:00:00Z"}}
\ No newline at end of file
diff --git a/internal/cli/testdata/golden/blobs/sha256/5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57 b/internal/cli/testdata/golden/blobs/sha256/5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57
deleted file mode 100644
index 0cf991c40..000000000
--- a/internal/cli/testdata/golden/blobs/sha256/5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57
+++ /dev/null
@@ -1 +0,0 @@
-{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","size":593,"digest":"sha256:41b285b4a6870e47e59ef34f87d3637a202783f535d70d0152c53d80f57c90a2"},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","size":3239,"digest":"sha256:26344c4399ce8d47eed8a16da31044b45634ab26a8e43493574a7c944ca35328"}],"annotations":{"org.opencontainers.image.created":"1970-01-01T00:00:00Z"}}
\ No newline at end of file
diff --git a/internal/cli/testdata/golden/blobs/sha256/82c91678ac0f40848c5cdac918022ba897a381c264722a6b1d5c986471e9751e b/internal/cli/testdata/golden/blobs/sha256/82c91678ac0f40848c5cdac918022ba897a381c264722a6b1d5c986471e9751e
new file mode 100644
index 0000000000000000000000000000000000000000..8a8fdf0fac65cad6f1c9bfec0447c7b363de6e0c
GIT binary patch
literal 3267
zcmV;!3_SB6iwFP!32ul0|LlBQbK*F+c3=BfP`>)Uq6s?LvR#$hn*d1&;gE1h$n35u
zS(d?IY{xbsWUBxBE)z~oGD#-`?CH1t++a(xB(FznX?aP)5)WVY4FCY3iZcHN0Brxh
za!n~9Uoy(Niv3{{#Vq^+z&hn~SoD7N`-{L54|(o;k?)Gl<eefBh>BkDzPx|QKZKaT
zFB!a9$-b~#{+ELst~37KNci_AuDhAGYa|j;Rdt*9H~0st`fKtJ7cX^?p}Pwt{D;i5
z{PAY$Zt-#cAyk!LnSc0?t2-1D{wI4L0H5F=EBKe@|Ch4=Pa^a;l6H=d^AA)Cer5i_
zL0s2eK*W6Wb}#sp{|{6D{}BGah<Tm`qm7i^<HP(zK$P_R?;ziQ3;y#g<b%!hT_O>P
zO30Gq?cce(^rQa|v5LNA{;^K}41RO|Swg%@q;*P)-w8|oABkDCnZ8SW-2Ov?Xlnlt
zY5x=c^JC#MuP=_mh#dtJbEDWl!aMdK60#ltAq2wI{vX2r=MtQh&nopyvvYD;DQ2qW
zUXqrRYL!Z{GAz_j`lI{7$T`!e;G}R>J}nd)#X?^zB>BaDwOHtv3zM?W&L4skU(oZq
zck?(1P#`^K&(DTtbMVvz#o1M_R<H5%p+(gWXU*wNz1_XPsAw0pHkwd0Zbs$XpqRZ-
ztM|i7zklI3m~_?aYt-+Rt$5&H+zn?XR(%pr^}DKPJ$0`}eR6GIHJxJfYBVOH{-Cye
zP%D-g38&XR?>@Ap2ww<2KXtT|{PYY)Pqay<jWdL;;bYLaE=9G9UYy+xyh7Ek_w$qc
z@o7GKEKeJk<dl`}YJCa#KCM3D(_wsnUu}1_$*EZ^MeWBfE?$FRjBhTiTfJSkhqsrv
zc7T|ARqBo4h2L|t*-q!YDrKqjRJ#p*^|9Zhjb=N0O0;~h-g|82xpS_A(zs4%(S>(~
z{P^y?bw6l~F1n->_KMY$^PZwex5J<$Xx1A~Z`pl!R&a|gH7MPmi(aP_^xA><Kup~<
zqgb!Uz2<dKy8)oVm12ae*171a(&hcbdEsnYZ{IyR4?66$0|yLhHlmem?ULO-W{35g
zu`(opW$$Lu^s;c(x~ya;`0~+iy5|;?+(E#urrDxj!xMh1huphhCw+f<%iU6;@NiwP
z3~BkIexpRAEN+>>xLPfZ!V)dIAgr}QOM;g3Sh~AwJ{7c1JROL7d)&=dvLJ+`s~WHO
z_=)Cps*!(F3D_hA#gpQ63eZjaJZRK-?QAM#!)}<LJ~f-Ta__@zxf?!pE6S+l-O=vl
zb=*+8R_$^Mnr@{^T7!%1t<s3Q@r`$(4=c_kt4NUmaj3b$eTM+i)l_tw9af(}u`n$c
z3RlO+QZARv<;wNa3nlpSACBexABw<_oY)T?v2#D*UH>1Et@uAiAhrJovHwT;SVXbK
zVwMjWAF;lO(r<y^=v!c^|5HD7t&Q|u;$8iRXiNX0Le*6N5262|2wXPvCvmFvzme9z
z(0~7E82R2Rb+<_LfxMyr7^vI&uYxrGcaZqsUo!W-Sa@+H8-K~0UZ8CJA;01s$lt!o
zBQXmdufJ7dD|(O=Ts>s`A+Icr{O$W!S$J_c3w+0mlXkg39y8C94LNT*UOpORa<2US
ztIRm}C(nIL?m|A8cZ-cJmB>lLSS9ke@2TzjwCzgfe?Q8F!WAsq(-yGz=6^_D=szVm
z)&E22f2DLhS4=J<sa~j+kLBydtt>UK%k6gW&+X)H`MOnU)c>rMj%9cRj({wkH)`cS
zJJ*-T@*s|b$jIl#BO3><IO6^|FQ@wXY5m+c68#TY6ixT#{Qu1Q9{}6)KcwmWe~|g#
zb#@l!-`)BTpejw*{|~bM?>gqca{mWO*Z&T({<q*iZ|%_xd}93<;8gz)ssDM)%sXBb
zGuIV6_XOVY{~=LUc?<o=0HyK&gT()vMi7cvcvjA2kywNRyT;tF&xJrL7|R_(mqxA9
zmfFVRb73sJIJ5DL|5`<3L+Th($&dm=;)diHe|(c-14u0cVWdeF1L*)rBLhf9;|f*=
z=eJt30BcT@dkv;I{rt@^%-;{p&arfAJg`uz847>~0!Cs`p40NKWBy%w-g+x5ADRAm
zEC2eH*T^lUaTEpC<2+I(vDH&5A<~_31-1KXiDs4VsTe$w)6l%XXkYeb{50wmjwPvS
ztl}S^6z}@^rBq+`G?8=oTKcx|v7QKDBl=4C@${}=2DdeTbf@W|TYQYqhC%kWA6NLX
zbZUs0zmU{AZt#jYX0Fl_bW**odF5$b1tjS8P|c@`-9I3iE1~@yhY`7Os&L%w=qK4(
zc}#-*S$U{UU@5pdmi{BZVmIu+>+}8W15OO0`qJ<F(dMs_eE(5GQu}`h`@g||#6u^D
zqoYI~JH<QmKiarn&i^=#{~sp)pCUzy-xnM9KMtLKUxd5g2L6uy2QTeEQkB&HAH@Fq
zLA-gp7koJW11QBHjsF}X{u6}$-VcB#@=!h${{uix<G%-q|Hk8B^L8&tcKA_Bf1dwD
z|8dIyA^3mT^~c_h>_1df{tv`|o-;n!-@iY7f`168nx6kZ$oc;j|9e~o{y6_oN!R}l
zv;Mc{f9yni@&rG@KZPm(2jhR=dw@R9KOkz#{~`JR*X{pM()s^j^Z&*I>Sor?@NxY|
z0H*x^U+|xQxp&}|mGjLCegf~re+fd%zs+2@PzWfHrt#lH#DD*iG8wtmEZtU0vhjR%
zE$m#WQS8*p^|t&q$@kb;B)KdY<=z+|&xNDFdhCiYa(r)DV-6kR=S&_77CXLI@oZl<
zGD+*pRAD8>5kNQxQ4Z>D1Purc1n=ap8^!!El8wwC^9M5-x$XO|ky#u)%KSe|JP7yy
zFCNHb<VM(Mp7S(s)5sJD%<=jY7Fu636_3mFO1>>>cO5RgNL)HmywQDp1hu5x_oS4Z
zoP@f3E|+w+SOm$-&zqAipHGraQFS&JQNZ}T#PT>qB9tRP?9VSOpGSGV>dW%rR32$S
z(WuT<NReO~5dbj2F-9uj&{Pl?94Q*)KeksA$-=!U)?!()*nB>I^(JT1LISewxEpo+
zwUpq?v2p6SB9{{}&#gBAttFmRQ(ugi9}gF;%Pd4)^gZrQtY_lujY6wczHV0<^>sl$
z5PTF(#_N7<_AP<T+`b<=@nD=Z*g7x3)zd%J&}Hsq&In=<QfLz0L;_oi&P--eq;YBj
zq5+Ck+on1aro5`<`?|t6TSkidPTNqUR8t8z5nzZB%|z5TnShpsv84kYYD`f%6^IB0
zV4bQK;KIbrRJbk#w?5t{1)}%lVImzXLWcmGkSdC413>`N6r?fEE!_qhQiujMAap^2
zr8B5t4FjO40CRyM;Y`!HhBUx*&Eh)e1nFEgZGjbC<$$X;V~pCW#dSt3s4HAxTTzp9
zUm8_6-f405ZT|axH89tQ2p4Mq#@PIs5x<nj%B;OCye{+bYzh|kN?xhWsz5T{qk_lW
z+0%R=$Kgb*G6yU={XwlVnan$iv?#W)N*_^{g;tdWcUd^^i(IR;*FClTsptC4y7c+n
z9{#P?`JvNyyu{SX#<mIVcq7lBdh1%bAIw6hKZx7nF;2?=&qk(rj78`%_gdI*sBkE3
z5ekosB8x@e4`)d=%|fwSI4l2IE7S{T<?B_QKRz*km*;*4qrQ>sWS%_t@D)$yznAR&
zSF-2wc(L>HZ)$GOg1Nm2CZYSv7+pTJ9GzVeI=1sH*rIQV)#Ub8p_Nfe48LVjQ>Q=!
z#HJ=;#8w3am=cp%05OFDXyau^zHg~WDBO9=(ZC7Tf?nxKGU=4v`JU2>^=Wn4Y-A~&
zVx!(JRO+p*Qo?Gjn|ycfSig*v9_9V~QQl8s+y8%S!|djBAHjS6Kg4)z{a2+p{r``H
z{Qt*?{r{H(WIt{{`fc2PjcAPO9CA&?I>EYXS<JF^6LXCdovK1(0t!Mt?DoGx)$iu*
zbEXIdQPVUvrf{xv!jXkcB9N{^&C)o-rci8cIkEn{XZ^mnuVBm68P!Z1X~0x9s_KAS
z7SjZx3REbC*rG^bj48wxs)}rEavRwS6oL_je!Nfbd;81;+{QwqIu#5EUDI_H*aT=m
z!x%#an1n+ikj;RinviouVdB;^AfV7xteGaW6`|>jSvn+GwM}g5I$@NUP}5WjiDj!M
zR4_z}pb(irv#?-{TZmYevhhwk^!ES8CjH>#ugavp{jcxaugLuOy7U$WoSO<}gz7dS
zoHDN30AZpd6DtVV2y+C@y}9%&5v88|@8QX(NRcAN$MC-Z009600{|qI5u5;Y002ag
Bvp@g<

literal 0
HcmV?d00001

diff --git a/internal/cli/testdata/golden/blobs/sha256/26344c4399ce8d47eed8a16da31044b45634ab26a8e43493574a7c944ca35328 b/internal/cli/testdata/golden/blobs/sha256/8854f6c83258e956f0811a1d8d4aff54d14817a2675575b4f557499655097f3d
similarity index 56%
rename from internal/cli/testdata/golden/blobs/sha256/26344c4399ce8d47eed8a16da31044b45634ab26a8e43493574a7c944ca35328
rename to internal/cli/testdata/golden/blobs/sha256/8854f6c83258e956f0811a1d8d4aff54d14817a2675575b4f557499655097f3d
index f12e7d1da4be7c6dec39b6fcbd0394dbaea39eff..0eb84d3bb4089715ac32c4c90a7a302c23b63c69 100644
GIT binary patch
delta 1419
zcmV;61$6qS8Mqm+KnH)nAH?goJHfl>e*mQzr1L-fnEwevf9D546MZP}n*RepP3M32
zGXEQog7w>-AlczZ>GF)<=I;yFlwzFnzYqTJxBaoVCI1iAl>a^PpXZDZcK7d3AK)JX
zs;1}v_j3M!$^Q;lf#1(RRMPdo{jC43_#ZjZjv~Pi@K0gN|K5N2-}N4#_wx^kn)1I-
z{(rgsA4)p@?``~FTS8rbv^Bin{t<vF|Nja8^Urq=ys&n@UcgV_jrm`KR{sr~;1fVV
zf$90by`2C1TgqhQR<m?nDappu)upg=rADz+E7#ld=j6G^Mk0C2f?@8J4)P=%1=h4H
z!pQNxMTt3dfS-RJ@=&nY@x6*?`?8TqYG0%ZD-lNk;T%LcsJ9U`AT$uXkw34A`C%j*
znZITkGa0$<`>v6hA3e(amnH6n``_~nnT*^B`^<A5XLTBx;($3`f6PMbbEe{Pc~;1m
zdFighg%^o)CyLjaj}M@h$bCzs<m4pO`IB7I*kTbRFF${)PPTkLPWJ88*+@hI<1>lH
zafn1I2Y%R}U06Pk@_gBr#lfjO(tx5-ovV-{!89TOV1Q$cRKTIBATBskG|0cNuOyO%
zdsD2`vShLObo}a7&ZM~pWZQAq%J_Ss!RLMB*l|TJCt{vkZ2?+oJSnC=?=RmUE?UXV
zRbBKw?v8)0C*tdkLaSB2Y*!lfl^`DoK8(hrRlC;PmOy51-w&O5FiI+HofhCS_je_9
znLC~_f*6DpnnX8|z?PyjlUWpLoSJ}WfMV6Qsg8sxFH8BhD)7~sk)pm)H`FNARKiUJ
z7-B>-5w%Swpk-lf=|G1XQ&dg`B0>RJr>X_GFfo5K6|M`xt@pP{f#@xLm`KNp&>_Gk
zq>5tNKoEd51!;_POSgfB6rw>52whNM=?p4Z!vH8Mz+7NRIMZ~lAq_BHv$)PVK{{7W
zTVO?3IpC_z7^Ajoah(wh>IxUwR@CI&mqyjKcbZ>)nf-oScFffw!nxVM(l>vm$1n7;
zbZdXlg;z57Pp)9@ujHlKECrJO9u++1K0MAkavYAu^5K9*$KRP%CX;!?kmh1@uk;>c
znOjv!aF>O%w#c<gd(~3QpLnj%taG2w{NWF+&JUfw<0Y<EHa1;o#~XV7#9Nih{oo;V
z`h&PFrg0+we`^oLG!~)9+)H7<V#1-YMJRtfE{ZG`eLs9iifI;#)xt^nYpqZ(oRlw@
zWqzMy_AXED42FFp*~vV9YT*l!%>ORf`=8__>EYAH)*lqyeh6mnA{dA63te=PY0){m
zB6Mu$Nv}oU63emeHKC<XO8mZMQB$Wt1H`5#VZ>Gi1eg+&SO77F0chhzL%wZTNGN~Y
zS<TVF308Vunn^O|l-=2u-HP>LYgw;kp`Bu*-Y!(?tqmz*wN_QWIdrUEMoLfee*7fw
z$FLdyzqVy|mFs<YEB=RgbN|0ev69CBzhwOXyo2l}>_>l0*sl?dQJq7ssaPjiS1pTK
zwr*msaiUXIXiPvs$h*V-7pVHvqJ4kP6rmt$nx@7S&UH>WvXDsx(p9Kg8fVxPimfe1
z)}N28-;VYbY?(TvnrR~qn5srq9dOHHnm|;63Z)QR6e)}`h1fz>k&R7mBU^z&Frv`+
zx9RO@pP7K$SZGwIf&rmxx~>A701apuW2gX=a3}<_8BkOca*ilW!g>Y-6q<jEHPd9a
zA~c;bONRujwuwz$CyWvkYMM$Rv24|Z3Wi7#6e1I778Z<g3lYmw*4}B0(f$v7(sx1r
zQYMY<fB)EiN#-vb(pwa8ZYr1&s@sHc%D8F+go%z!tRP?`%n>wq7Sb;@lt%J@NF<*k
ZMT!*f!~X*S0RR6309V{YI{*W8007(D$W8zN

delta 1401
zcmV-<1%~>#8K)VrKnH(+5c)em0GKF5dDr|80BSn_x0m_9coeMP?gYsWFG`nZyf%Md
zxTX~2l>dG3f4}Wue;f0^fKsTY{O^hXJZF5cyMO=r$oxN`YI^>AFXz9P{O@oT@B`~V
zO1l2DpY@*=|05^bQ6%^Q{wYlP-y8qC-UIS}{sB=_{`blMFSmdGucYJu-p2p6CA9TN
zTf_V99|4&1|DWJL|9tiMg|*Z50)7H-%>NOz`ftz#p8x_1OwWJq<^0#*QYIs}nx*SX
zNj9FYE`^;dHHw{Dx!#sPC(k`L63J5*40Eq^kSF0Nu%=xRMvm_-O3a}H{Pd8Ag2j&S
zRXp35jZ9MeB2|A_i8ulX=OD^Ky^Wv&p@HCy{CQ2x4<p&g{58v%$;fTrca6;a=t<_k
zEO9T~|DI>aWaLKJXP)yotJBC72h8#MV-{MUGZl}^vqHYiOLrYEyhxloQM}fCd;qmX
z?pq=yCnsUfpX8Fp7K<Qx`B`<c<@0f}Z==peA_^FvNi2W1!zW5P@WcM>!t!~P=gYP%
z4$kC}1{96zT!j<~rV#-E0~}+d0uD_Dalw(ILH>PxC6O%LnqsAvC5z3c<2SEzCe1Y<
z+m5?d#@`DKKJOdHjw^CG5%b(?3&=|2Nip?#fBF7!$x3Ff>Z0#)cWgZoUvCszt@35N
z(x|Tl`9Od0VKg4C+O^)c1Tu5`e(1!5QBq;+v;dd6zbm23-0_SN#2}>5B)W+NwiKP2
z%%Vu+)C5EW6sxvPbtFuAS<1Infv?t#6!nd|p+>2u5^f^E5F?t2sBJO<Eem5y2RhW4
zqH-z_5emRMRV~1UiJ7TzT?lTyzfB56Z|TECI#z##4goeHRTR?(f&io`NMoE^x(zg>
z5DjWT=z;=EXHdZ!20&2(<^n^)nWl3MX@KdP#dXdJ(z$Bd0xP=80atCt7`0W4>x@`X
zSGd5oq9*5lG^(z>)BNho?DyNUW3CR7&CULmzWFmfexZ-0TYE0NlDU6!1#^ETFU@8t
zko14|sNga8;c?cH<8UmN4+ktd{?4p2namr8G#8tDrS}-i+^R}~yDXfwMXpuatCm{+
z#B+USo%?*|4}WNNe(3ZaFLAZ9vFSoP-q7<W-l|mY2M?jsAH;1jjT8C*TYD&`u?Rip
zUJCma6ApzfLg8^yWU=V`;X_hPvrw!SPRf5@YlV8@q<pz7^ZOjLcX?`OFzg%2PS){L
z3txz2{&&IN|0E{~51%$R{-EIYLojm}!8mkZ=%R~Ei_X~<p<_EwdM)~vSdMM42`zn6
z;`c3!nmPp<AT~7#Bep6az?7K80*EOLKpQU_@@>OHLgCJ8js{M!((}?xk};?3&bEJS
zR;&+O%X%dX?GzjJcA-*lZAb~LwW{*Xp=0$jQhJi}<0m;khRyi@wJnpYT<^nM@jt|y
z`@dC+l{EhUCFB3+9b`9QKl)?BevN31>Kt-S#X7;dYFW&(brW-q6P>C;V*(07-W~S8
zK-HfX?Q^CG1yR#9HKuT`bHb5@Od@}fu0qYyIK!q;Y;7^J{(NNpcC@cx%hVawOdDyy
zR5hyVfLj*R1fmL5D23RfNMVdA#1^WGY;1BH*$Nbb5rw|LO>am0%mm!VLZdnr3<zD*
zbrskIXh6dlLj{<GLm`mOfTEg^b3|bh)-xcW&{V9MCbJcx>5N%ABv`dgZ0d13VU(Cq
z(^LwHWveDsFhq)=5Sc);uwaZ^h**}g_D)-j_J81$z6<h~GHGo8`^WZ6GJn~S-lBkW
zQ^AZ--6n)n##I|2Omt*o1pymjj-a`-kbbG5G?M>ABKZ_4Qlxkv{vQAU|NjF3!J{V3
H0CE5T+a|nm

diff --git a/internal/cli/testdata/golden/blobs/sha256/41b285b4a6870e47e59ef34f87d3637a202783f535d70d0152c53d80f57c90a2 b/internal/cli/testdata/golden/blobs/sha256/9b913f37c3adc743715bd578f7cc823f22a2e45b73c939023888109a66a97951
similarity index 78%
rename from internal/cli/testdata/golden/blobs/sha256/41b285b4a6870e47e59ef34f87d3637a202783f535d70d0152c53d80f57c90a2
rename to internal/cli/testdata/golden/blobs/sha256/9b913f37c3adc743715bd578f7cc823f22a2e45b73c939023888109a66a97951
index 40616c87d..3362b2a4c 100644
--- a/internal/cli/testdata/golden/blobs/sha256/41b285b4a6870e47e59ef34f87d3637a202783f535d70d0152c53d80f57c90a2
+++ b/internal/cli/testdata/golden/blobs/sha256/9b913f37c3adc743715bd578f7cc823f22a2e45b73c939023888109a66a97951
@@ -1 +1 @@
-{"architecture":"amd64","author":"github.com/chainguard-dev/apko","created":"1970-01-01T00:00:00Z","history":[{"author":"apko","created":"1970-01-01T00:00:00Z","created_by":"apko","comment":"This is an apko single-layer image"}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:63d864eaf7996ff3b8364aec6f9885d4325baf1671204f24337d10295c069e5c"]},"config":{"Entrypoint":["/bin/sh","-l"],"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt"],"Labels":{"org.opencontainers.image.created":"1970-01-01T00:00:00Z"}}}
\ No newline at end of file
+{"architecture":"amd64","author":"github.com/chainguard-dev/apko","created":"1970-01-01T00:00:00Z","history":[{"author":"apko","created":"1970-01-01T00:00:00Z","created_by":"apko","comment":"This is an apko single-layer image"}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:b606e55d50a4a23dd4092a9983b45887dd7c979a38acd5dc9736a09cc899e600"]},"config":{"Entrypoint":["/bin/sh","-l"],"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt"],"Labels":{"org.opencontainers.image.created":"1970-01-01T00:00:00Z"}}}
\ No newline at end of file
diff --git a/internal/cli/testdata/golden/blobs/sha256/dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17 b/internal/cli/testdata/golden/blobs/sha256/dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17
new file mode 100644
index 000000000..8f4df5ec5
--- /dev/null
+++ b/internal/cli/testdata/golden/blobs/sha256/dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17
@@ -0,0 +1 @@
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"mediaType":"application/vnd.oci.image.config.v1+json","size":593,"digest":"sha256:35af2fe3834e23d725a234d852303b84996b78b7d941b4c9b08a41e0a77d1b18"},"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","size":3267,"digest":"sha256:82c91678ac0f40848c5cdac918022ba897a381c264722a6b1d5c986471e9751e"}],"annotations":{"org.opencontainers.image.created":"1970-01-01T00:00:00Z"}}
\ No newline at end of file
diff --git a/internal/cli/testdata/golden/blobs/sha256/e29f907eae193b71f82232ac873a7f2bbe3d5e3b841c729b6a58706750f01ce0 b/internal/cli/testdata/golden/blobs/sha256/e29f907eae193b71f82232ac873a7f2bbe3d5e3b841c729b6a58706750f01ce0
deleted file mode 100644
index d8c7efcf93627624fb3449ae9e1c12c2b734a600..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 3249
zcmV;i3{LYOiwFP!32ul0|LlBgQ{u|E_q@)hpz`W@ib498bdoCT90XKEF3Lr5pQ&A)
zP6q-ZiAfM~*L?R=L2iR?9o@j$^Pl|Q0DaH;^;*5Mx*JP8eAzbu0DvmW{1X7M{rSpw
zN&)$jQPxfD50fZn;THhbDWAh)^sCQb1eSQnbKi@6S8OKl6p27o^n&;0@0a{Thzb0X
z!JCcj3%liiImzKV<KK;he{bTtn`yg7A`w+pw|Reqf1s+rCjW5pPzRa1yFkK!$UMs*
zZ>H`RALk!JRr!_qhyS>_Lm}aRvgZl#3I4Hye`)@IDf|B<LVqJ^=lD4PK&9YU<{uoy
zb=?I-%r}4T1)uW&Ve0=M!v7aB&$D2(k+OSyn12X}lD_{P<o$2Kf1ZVWu$jI~Bmz+h
zS#rGnId_+S^#37N(U;6W*2$m2Z_YnUh*ycUPD$}QVX6NkF^e|ScZrYNe@GBb?f)U|
zf5Lx$EL`UG#ZefsqhMlg6#GYb$Nob?w&Op9K$zP9L)iaZf|K%DrJiYaPA)6OOtsug
z(sEL*QYlu3h5AW<bUzq5XZjSJ6t2prg+ilP=xc=}zu2!93;l9oQr6k|LvZ2?dS3T#
z9tQymq{r;}+0bkbo|>RIyXw{IHGV#{sM_JIIlZa3yZ09r?V{F36N<*osC*j~vlnXh
zepu=EFZ>3Ru6liq`n|Fh5B!U};jF}}PvWV5SM{u??$xMIuI;O)Q*2(1#w64q)Rqrw
z#S$ao^t$KWhqe^q3!&$yj&_otp26seHp#SchOjk!3>w#^s8-R7v%7&;sM_^@esVuP
z%}0;rY2%WdveI3xF9F}D)kl0fjPLKO?XEUCHH)RF{n*9DYY>d_&4qQVx9j%s_VU&a
z5L2&8y%D_ddu}${>6}-kEOnl0x1p~-_ItF^Y-dl2mhaVjkF7j+&UH{4*Xb;}@UD;_
z-<`Ma2aVB1mvq8jv3hdeQxxfT7?cFfdgJLWyYJ2lZn32XrTcTy>vV!%JMbQeshegL
z>-D(TyzXf?05rH#jBwRD7hP4lyni?^oK5TPyC>&Chn;rdfI-bhw34k|vfIb(uzoXE
zh6J$e-7K137Oq;CmFxsxKH5$9++vbD2-wv$Tl8yq!f*AEdl&4a?@w>JTPhSDuIrT{
zEnn1clxUR2Ei)KbtEEv`qD2>kwN_|J&~hG2cX!RFg4T(r15s~}yV*(>gm83K<Mkdt
z(VR{-@^2~un}ncvQk+f!x@n&WjT*0=O{Hwu4fE5dW)oNLeV8qG!>4XV8MVAS+P%Dv
z8%o!zT~0yMtyD>CaFM-L8gVzi@h<dX#kph^DH0$KH8;5L5Fommif*&R>JumyrsYE6
z>iAg7<#M@Pxn6pq1YiEcv0VQ{5%`f4`=KLt?gzZ<|0A*$|HlZV_WvOE|0o}eD7IM4
z@&V%`))!IwF7O+@3oP}2>W8kik-kg3tN##f=|5Dcn(F@{^gk4V%Vz#0PPP6w()t(r
z?;i~#-&>{b7KuKPH}oF^bzA>ckjDQG694;4=DrsTFOFp6FL~1ol#M^+SG)uH+gEuc
zW})Ntw@Pe950ZkbO2!}Z%F@W+zJHa47l*UJcf2_1m;2)}^DNnr^QPnFqd_L;%HO}r
zjB|hTJhtRl$OrRbv9YBRIY}6+ME>?YwOyaKUCH|IN4ZeAf<=2e0`}he56KJtrv#_^
ze+d1rl#b_$$weg93$^mGe7*Q7OU>(YyWRV9JGooFZdDrfKP#nU86JTnAWP?sTKUh;
z_2scVh~pqK@_F&d#(^u2xIfOzseXQ1KlhD9{{t39(|tMrKePV_!1nqNX}bO&Wc_!Y
zorU>#xBmmEO4I%SgY5sij`^=V|3T9Izk}@mE%?t{do%-|*#8AM)&E24f8H|lju*wu
zb;Zs-fp`3WNR(CHLjN&9Y5e~n@&Bd~gd!H6l`~l+7NNkdG570pA&?5j@`TW(QLD72
zwy}6!7z;1XY}D~zYiMjp9YZP^Qea5jkR0QWZ&GXksbwIHG^t`B9RO)$0I6tP!OGzL
zR%;eu&1rJ4!4#*TzZr)4`+?axmQIZa7D_ck0nk9eNDRtzTHbZcze~?sZ)N2p(;si;
zU%&DgxurCYqQH8bN6I9&s-+Sl-5FO<yRVjLR_UIK!4o+R&HIb?WpBn$qfX&ilA6XU
z{_#oiuIn$Q`f{X+oWs}Bw}p@OMEDxfSHh2{cl|QBt@)!nO%L7TV|+FYvbX)X!jGj>
zL&W@rq}FkRSHv-Mm6o8B>TS&{Pva^eL9d5uK2_}g0m)nm?dLd*$c0md<7P)c$<E4S
z66DXyLu~>}!PT+!ANdx$VgFs9@8=wFVi47re&3Hae~sk*j}nsF|3ldS4gMn@Izb#A
zCGyxQ-dX?A#`op=kJI@7VdDQOQl$8Ov0?w?(CPO@xcg(^@7RCv(*7e=N$vkZ?0*pY
zd%pmf2t@f%{09IvjsG1a{uhsf&7XTga>9#J`t$q)N-<9PKLq~|yLR?>5&s30LN(?8
zK>X)9<AeSE`_E_M|A4CL{qKX^|6cLG$6dfr?Efg~{?B3df7bkuooG*<;3xQ}Fy;SX
z{O|h=$jA8yL{0fWB>(@q{eLB0{|~nQZ)~7#X6+0g*M9_H%K!fb|M{1D$FJ<1ZZ_}}
zcqjfx5L*6i;=+YOK!G%k{~aR!_m`B($gO7Swo;Of=Wo}-&XpR)POV&T%U_dxkBvo=
z%YsqvjS2ExI0~%Ct_UN?_m(Z@&=G#l<e^}(<9ij)_GKfJ^uA0LR#F@RgmVz(px#E%
zfY3njPX4-4%nu{k$ow&{n90a(-*=77;_6A}|5@Texc`4qA(N3CVV`-<)4We3QyehI
z>rYr{ea%!nF3%hJwrJgTxbPxz=|u6y@bMAUl5*dZQgU(==JL5*GT34fBo9CDPPTkL
zNe;!-*;qsY<MR^B<M4@4j{LAc|6=((%JbD&mKSI8NCS#Sb*@5+1k;EBfB}v%QUQmi
zg1F#F(IEe^zmiBcZcVWk%ZkP3^YxoIIg=I=kZs4^XydP?1YgdLQ^ys#oQQdDeE?)F
z@uZphV!r%%xnx~tA?l*<ad%=p6JKu>TCMVRyV9ty3-W>Bqi8Z-k85*m31sH>{m_XA
z<D|pZc>%6!|Ik90xsy2~h(So9NpuqlY$-Z3nMIMtsR@V%C{}Ho>PVRKs+I5S2H)%%
zDe60YLyb~RCEP@SAx1P4QQKq!S{BBZ4s@t7Mdef=A{2mis#<^x6Ejocx)9v@_?Q%k
z-jj!kbgT#+0&GI6D5ebr0Z3Dj#yGch8)!%&8q|Q$1qGJQpn^3FfT9A-1%`w(P3IcY
z0Mj*#>zos$bJes3R&<pEuG)+-YO5C48L^<QaDi<_P44|@RNZ){#kX(s&+n^=xxPfU
zQ2RIL=FiOdr94(<?PcM0nTKanu&`J1N^MpJlKCDLJm$`x<`X#%Ct{U3VA1IhYL&@k
z-ch7Qv4vIoh_WoSswB9}!ueR_TBW@nspU^S*JswH&*%2=Z?(=3oxbBGrdBq#O=!m(
zdH&Q}x61us7CQYw+!l{<QvQE7GR0#oLXWxE!hS=ALt%?hcw7`&Ec$*pOPXmGiq*nd
z`OjLRUN|dXuiE^v#{5~H#~F<JMskvM@;t&<JemJqviD!fnY-h~$-BR4xjhT!_9B>s
z?kjV2S!p>tyCQUK=UK2t-x90E?X5y9qm&qa%c7=Efd+_8O~Qz+3J5SICb0lw3Iou_
z%Yl5~Qjt)&^PZ!D6RZWj(vxJ-DZBGCg%#`5>ay9%QaZ&(y<Mo(TU(`s)mnG??%J__
z7%9EV`T47ypTf5P|JH%Y&3Yffd;UMfcx(Sxr8xcnhlBk8!-xI<mlI?^Za?~M+<uK{
zjOrY6O~pFFx@uX>vUL-4jT4=!LSq67LO$&Fze3gT=IwK)2nA8oG&QDhu5-eXg-jxl
zu0qYyIK!q;Y;C!){=8@XzPGPn%hVawOdDyyR5hyVfLj*R1fmL5D23RfNMVdA#1^WG
zY;1BH*$Nbb5ruwyOz(U9%mm!VLZdnr3<zD*brskIXh6dlLj{<GLm`mOfTEg^b3|d{
z)-xcW&{V9MCbJcx>5N%ABv`dgZ0b5;l$cP{R0@e@t0q)1M2esgnLx9!V2oRcSeCN!
zOgr@U|HdZ$;N-8$q`v*H@7u4){P()_76qJ}3TA}rHX)ocuG#=$q9YS42-pa71kJs<
j^eYjip8W6O$)`w>BE`q>zW@LL|NjF39s)hC0CE5T=?TWx

diff --git a/internal/cli/testdata/golden/index.json b/internal/cli/testdata/golden/index.json
index fce687112..cfbc831bf 100755
--- a/internal/cli/testdata/golden/index.json
+++ b/internal/cli/testdata/golden/index.json
@@ -1 +1 @@
-{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"mediaType":"application/vnd.oci.image.manifest.v1+json","size":476,"digest":"sha256:5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57","platform":{"architecture":"amd64","os":"linux"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","size":476,"digest":"sha256:18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1","platform":{"architecture":"arm64","os":"linux"}}],"annotations":{"org.opencontainers.image.created":"1970-01-01T00:00:00Z"}}
\ No newline at end of file
+{"schemaVersion":2,"mediaType":"application/vnd.oci.image.index.v1+json","manifests":[{"mediaType":"application/vnd.oci.image.manifest.v1+json","size":476,"digest":"sha256:43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19","platform":{"architecture":"amd64","os":"linux"}},{"mediaType":"application/vnd.oci.image.manifest.v1+json","size":476,"digest":"sha256:dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17","platform":{"architecture":"arm64","os":"linux"}}],"annotations":{"org.opencontainers.image.created":"1970-01-01T00:00:00Z"}}
\ No newline at end of file
diff --git a/internal/cli/testdata/golden/sboms/sbom-aarch64.spdx.json b/internal/cli/testdata/golden/sboms/sbom-aarch64.spdx.json
index 919359ddc..aa0a90d81 100644
--- a/internal/cli/testdata/golden/sboms/sbom-aarch64.spdx.json
+++ b/internal/cli/testdata/golden/sboms/sbom-aarch64.spdx.json
@@ -1,6 +1,6 @@
 {
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "sbom-sha256:e29f907eae193b71f82232ac873a7f2bbe3d5e3b841c729b6a58706750f01ce0",
+  "name": "sbom-sha256:82c91678ac0f40848c5cdac918022ba897a381c264722a6b1d5c986471e9751e",
   "spdxVersion": "SPDX-2.3",
   "creationInfo": {
     "created": "1970-01-01T00:00:00Z",
@@ -13,13 +13,13 @@
   "dataLicense": "CC0-1.0",
   "documentNamespace": "https://spdx.org/spdxdocs/apko/",
   "documentDescribes": [
-    "SPDXRef-Package-sha256-18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1"
+    "SPDXRef-Package-sha256-dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17"
   ],
   "packages": [
     {
-      "SPDXID": "SPDXRef-Package-sha256-18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1",
-      "name": "sha256:18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1",
-      "versionInfo": "sha256:18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1",
+      "SPDXID": "SPDXRef-Package-sha256-dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17",
+      "name": "sha256:dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17",
+      "versionInfo": "sha256:dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17",
       "filesAnalyzed": false,
       "description": "apko container image",
       "downloadLocation": "NOASSERTION",
@@ -28,20 +28,20 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1"
+          "checksumValue": "dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17"
         }
       ],
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
-          "referenceLocator": "pkg:oci/golden@sha256%3A18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1?arch=arm64\u0026mediaType=application%2Fvnd.oci.image.manifest.v1%2Bjson\u0026os=linux",
+          "referenceLocator": "pkg:oci/golden@sha256%3Adcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17?arch=arm64\u0026mediaType=application%2Fvnd.oci.image.manifest.v1%2Bjson\u0026os=linux",
           "referenceType": "purl"
         }
       ]
     },
     {
-      "SPDXID": "SPDXRef-Package-sha256-e29f907eae193b71f82232ac873a7f2bbe3d5e3b841c729b6a58706750f01ce0",
-      "name": "sha256:e29f907eae193b71f82232ac873a7f2bbe3d5e3b841c729b6a58706750f01ce0",
+      "SPDXID": "SPDXRef-Package-sha256-82c91678ac0f40848c5cdac918022ba897a381c264722a6b1d5c986471e9751e",
+      "name": "sha256:82c91678ac0f40848c5cdac918022ba897a381c264722a6b1d5c986471e9751e",
       "versionInfo": "1.0.0",
       "filesAnalyzed": false,
       "description": "apko operating system layer",
@@ -50,7 +50,7 @@
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
-          "referenceLocator": "pkg:oci/golden@sha256%3Ae29f907eae193b71f82232ac873a7f2bbe3d5e3b841c729b6a58706750f01ce0?arch=arm64\u0026mediaType=application%2Fvnd.oci.image.layer.v1.tar%2Bgzip\u0026os=linux",
+          "referenceLocator": "pkg:oci/golden@sha256%3A82c91678ac0f40848c5cdac918022ba897a381c264722a6b1d5c986471e9751e?arch=arm64\u0026mediaType=application%2Fvnd.oci.image.layer.v1.tar%2Bgzip\u0026os=linux",
           "referenceType": "purl"
         }
       ]
@@ -96,9 +96,9 @@
   ],
   "relationships": [
     {
-      "spdxElementId": "SPDXRef-Package-sha256-18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1",
+      "spdxElementId": "SPDXRef-Package-sha256-dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17",
       "relationshipType": "CONTAINS",
-      "relatedSpdxElement": "SPDXRef-Package-sha256-e29f907eae193b71f82232ac873a7f2bbe3d5e3b841c729b6a58706750f01ce0"
+      "relatedSpdxElement": "SPDXRef-Package-sha256-82c91678ac0f40848c5cdac918022ba897a381c264722a6b1d5c986471e9751e"
     }
   ]
 }
diff --git a/internal/cli/testdata/golden/sboms/sbom-index.spdx.json b/internal/cli/testdata/golden/sboms/sbom-index.spdx.json
index f62385697..fe80beebf 100644
--- a/internal/cli/testdata/golden/sboms/sbom-index.spdx.json
+++ b/internal/cli/testdata/golden/sboms/sbom-index.spdx.json
@@ -1,6 +1,6 @@
 {
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "sbom-sha256:3417c902dcb83e99e0d185955ebba370841866b889fc9d216780a64627c87d48",
+  "name": "sbom-sha256:714bd8ce97dfb0b40f6ff0a8b82c05b1249101614fd77190d610ae11280bdc54",
   "spdxVersion": "SPDX-2.3",
   "creationInfo": {
     "created": "1970-01-01T00:00:00Z",
@@ -13,13 +13,13 @@
   "dataLicense": "CC0-1.0",
   "documentNamespace": "https://spdx.org/spdxdocs/apko/",
   "documentDescribes": [
-    "SPDXRef-Package-sha256-3417c902dcb83e99e0d185955ebba370841866b889fc9d216780a64627c87d48"
+    "SPDXRef-Package-sha256-714bd8ce97dfb0b40f6ff0a8b82c05b1249101614fd77190d610ae11280bdc54"
   ],
   "packages": [
     {
-      "SPDXID": "SPDXRef-Package-sha256-3417c902dcb83e99e0d185955ebba370841866b889fc9d216780a64627c87d48",
-      "name": "sha256:3417c902dcb83e99e0d185955ebba370841866b889fc9d216780a64627c87d48",
-      "versionInfo": "sha256:3417c902dcb83e99e0d185955ebba370841866b889fc9d216780a64627c87d48",
+      "SPDXID": "SPDXRef-Package-sha256-714bd8ce97dfb0b40f6ff0a8b82c05b1249101614fd77190d610ae11280bdc54",
+      "name": "sha256:714bd8ce97dfb0b40f6ff0a8b82c05b1249101614fd77190d610ae11280bdc54",
+      "versionInfo": "sha256:714bd8ce97dfb0b40f6ff0a8b82c05b1249101614fd77190d610ae11280bdc54",
       "filesAnalyzed": false,
       "description": "Multi-arch image index",
       "downloadLocation": "NOASSERTION",
@@ -29,21 +29,21 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "3417c902dcb83e99e0d185955ebba370841866b889fc9d216780a64627c87d48"
+          "checksumValue": "714bd8ce97dfb0b40f6ff0a8b82c05b1249101614fd77190d610ae11280bdc54"
         }
       ],
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
-          "referenceLocator": "pkg:oci/golden@sha256%3A3417c902dcb83e99e0d185955ebba370841866b889fc9d216780a64627c87d48?mediaType=application%2Fvnd.oci.image.index.v1%2Bjson",
+          "referenceLocator": "pkg:oci/golden@sha256%3A714bd8ce97dfb0b40f6ff0a8b82c05b1249101614fd77190d610ae11280bdc54?mediaType=application%2Fvnd.oci.image.index.v1%2Bjson",
           "referenceType": "purl"
         }
       ]
     },
     {
-      "SPDXID": "SPDXRef-Package-sha256-5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57",
-      "name": "sha256:5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57",
-      "versionInfo": "sha256:5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57",
+      "SPDXID": "SPDXRef-Package-sha256-43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19",
+      "name": "sha256:43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19",
+      "versionInfo": "sha256:43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19",
       "filesAnalyzed": false,
       "downloadLocation": "NOASSERTION",
       "supplier": "Organization: Chainguard, Inc.",
@@ -51,21 +51,21 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57"
+          "checksumValue": "43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19"
         }
       ],
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
-          "referenceLocator": "pkg:oci/golden@sha256%3A5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57?arch=amd64\u0026mediaType=application%2Fvnd.oci.image.manifest.v1%2Bjson\u0026os=linux",
+          "referenceLocator": "pkg:oci/golden@sha256%3A43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19?arch=amd64\u0026mediaType=application%2Fvnd.oci.image.manifest.v1%2Bjson\u0026os=linux",
           "referenceType": "purl"
         }
       ]
     },
     {
-      "SPDXID": "SPDXRef-Package-sha256-18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1",
-      "name": "sha256:18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1",
-      "versionInfo": "sha256:18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1",
+      "SPDXID": "SPDXRef-Package-sha256-dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17",
+      "name": "sha256:dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17",
+      "versionInfo": "sha256:dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17",
       "filesAnalyzed": false,
       "downloadLocation": "NOASSERTION",
       "supplier": "Organization: Chainguard, Inc.",
@@ -73,13 +73,13 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1"
+          "checksumValue": "dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17"
         }
       ],
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
-          "referenceLocator": "pkg:oci/golden@sha256%3A18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1?arch=arm64\u0026mediaType=application%2Fvnd.oci.image.manifest.v1%2Bjson\u0026os=linux",
+          "referenceLocator": "pkg:oci/golden@sha256%3Adcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17?arch=arm64\u0026mediaType=application%2Fvnd.oci.image.manifest.v1%2Bjson\u0026os=linux",
           "referenceType": "purl"
         }
       ]
@@ -87,14 +87,14 @@
   ],
   "relationships": [
     {
-      "spdxElementId": "SPDXRef-Package-sha256-3417c902dcb83e99e0d185955ebba370841866b889fc9d216780a64627c87d48",
+      "spdxElementId": "SPDXRef-Package-sha256-714bd8ce97dfb0b40f6ff0a8b82c05b1249101614fd77190d610ae11280bdc54",
       "relationshipType": "VARIANT_OF",
-      "relatedSpdxElement": "SPDXRef-Package-sha256-5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57"
+      "relatedSpdxElement": "SPDXRef-Package-sha256-43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19"
     },
     {
-      "spdxElementId": "SPDXRef-Package-sha256-3417c902dcb83e99e0d185955ebba370841866b889fc9d216780a64627c87d48",
+      "spdxElementId": "SPDXRef-Package-sha256-714bd8ce97dfb0b40f6ff0a8b82c05b1249101614fd77190d610ae11280bdc54",
       "relationshipType": "VARIANT_OF",
-      "relatedSpdxElement": "SPDXRef-Package-sha256-18d41b1f595d19375dc45a14f87f64e736d577e618fc77707bb710a8e59842b1"
+      "relatedSpdxElement": "SPDXRef-Package-sha256-dcc96a7dc51e9f68b3402c82332b61325ae8e6f8ddc49159e7bafc30453bfc17"
     }
   ]
 }
diff --git a/internal/cli/testdata/golden/sboms/sbom-x86_64.spdx.json b/internal/cli/testdata/golden/sboms/sbom-x86_64.spdx.json
index 52e2bc725..bf9292eaa 100644
--- a/internal/cli/testdata/golden/sboms/sbom-x86_64.spdx.json
+++ b/internal/cli/testdata/golden/sboms/sbom-x86_64.spdx.json
@@ -1,6 +1,6 @@
 {
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "sbom-sha256:26344c4399ce8d47eed8a16da31044b45634ab26a8e43493574a7c944ca35328",
+  "name": "sbom-sha256:8854f6c83258e956f0811a1d8d4aff54d14817a2675575b4f557499655097f3d",
   "spdxVersion": "SPDX-2.3",
   "creationInfo": {
     "created": "1970-01-01T00:00:00Z",
@@ -13,13 +13,13 @@
   "dataLicense": "CC0-1.0",
   "documentNamespace": "https://spdx.org/spdxdocs/apko/",
   "documentDescribes": [
-    "SPDXRef-Package-sha256-5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57"
+    "SPDXRef-Package-sha256-43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19"
   ],
   "packages": [
     {
-      "SPDXID": "SPDXRef-Package-sha256-5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57",
-      "name": "sha256:5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57",
-      "versionInfo": "sha256:5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57",
+      "SPDXID": "SPDXRef-Package-sha256-43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19",
+      "name": "sha256:43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19",
+      "versionInfo": "sha256:43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19",
       "filesAnalyzed": false,
       "description": "apko container image",
       "downloadLocation": "NOASSERTION",
@@ -28,20 +28,20 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57"
+          "checksumValue": "43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19"
         }
       ],
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
-          "referenceLocator": "pkg:oci/golden@sha256%3A5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57?arch=amd64\u0026mediaType=application%2Fvnd.oci.image.manifest.v1%2Bjson\u0026os=linux",
+          "referenceLocator": "pkg:oci/golden@sha256%3A43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19?arch=amd64\u0026mediaType=application%2Fvnd.oci.image.manifest.v1%2Bjson\u0026os=linux",
           "referenceType": "purl"
         }
       ]
     },
     {
-      "SPDXID": "SPDXRef-Package-sha256-26344c4399ce8d47eed8a16da31044b45634ab26a8e43493574a7c944ca35328",
-      "name": "sha256:26344c4399ce8d47eed8a16da31044b45634ab26a8e43493574a7c944ca35328",
+      "SPDXID": "SPDXRef-Package-sha256-8854f6c83258e956f0811a1d8d4aff54d14817a2675575b4f557499655097f3d",
+      "name": "sha256:8854f6c83258e956f0811a1d8d4aff54d14817a2675575b4f557499655097f3d",
       "versionInfo": "1.0.0",
       "filesAnalyzed": false,
       "description": "apko operating system layer",
@@ -50,7 +50,7 @@
       "externalRefs": [
         {
           "referenceCategory": "PACKAGE-MANAGER",
-          "referenceLocator": "pkg:oci/golden@sha256%3A26344c4399ce8d47eed8a16da31044b45634ab26a8e43493574a7c944ca35328?arch=amd64\u0026mediaType=application%2Fvnd.oci.image.layer.v1.tar%2Bgzip\u0026os=linux",
+          "referenceLocator": "pkg:oci/golden@sha256%3A8854f6c83258e956f0811a1d8d4aff54d14817a2675575b4f557499655097f3d?arch=amd64\u0026mediaType=application%2Fvnd.oci.image.layer.v1.tar%2Bgzip\u0026os=linux",
           "referenceType": "purl"
         }
       ]
@@ -96,9 +96,9 @@
   ],
   "relationships": [
     {
-      "spdxElementId": "SPDXRef-Package-sha256-5398671bcb1dc210cfb253a808be94fff70723d939d7ce6d8053a823f4720d57",
+      "spdxElementId": "SPDXRef-Package-sha256-43e3f561cb0910cb25ea304331454f74315d2edbcf68e2af172f8efa5c95fe19",
       "relationshipType": "CONTAINS",
-      "relatedSpdxElement": "SPDXRef-Package-sha256-26344c4399ce8d47eed8a16da31044b45634ab26a8e43493574a7c944ca35328"
+      "relatedSpdxElement": "SPDXRef-Package-sha256-8854f6c83258e956f0811a1d8d4aff54d14817a2675575b4f557499655097f3d"
     }
   ]
 }
diff --git a/pkg/apk/apk/implementation.go b/pkg/apk/apk/implementation.go
index 4efd889e8..124ca6cc1 100644
--- a/pkg/apk/apk/implementation.go
+++ b/pkg/apk/apk/implementation.go
@@ -135,6 +135,7 @@ var baseDirectories = []directory{
 	{"/dev", 0o755},
 	{"/etc", 0o755},
 	{"/lib", 0o755},
+	{"/opt", 0o755},
 	{"/proc", 0o555},
 	{"/var", 0o755},
 }