> When apk is pulling packages, it extracts them into / before checking that the hash matches what the signed manifest says it should be. Pros: downloading and

> When apk is pulling packages, it extracts them into / before checking that the hash matches what the signed manifest says it should be. Pros: downloading and installing packages is faster. Cons: vulnerabilities like this. Reading the commit message in https://github.com/alpinelinux/apk-tools/commit/6484ed9849f03971eb48ee1fdc21a2f128247eb1 https://github.com/alpinelinux/apk-tools/commit/6484ed9849f0... I'm not convinced they fixed it.