Sample
sigs.k8s.io/yaml@v1.6.0. Unmarshal decodes YAML into Go map and silently overwrites duplicate keys with the last value without returning an error.
sha256:9c1f097abff63ce25b961f351b6b9a0eadcf066428df9adacd40c0a5f4814c60
PUBLISHED
L3_CONTRACT_PASS
MIT-0
Execution evidence
Declared environment and signed verification runs are separated so you can see exactly what this sample proves.
Evidence basisSigned contract pass
Verification receipts1
Verification levelL3_CONTRACT_PASS
Declared environment
- Execution context
- go
- Operating system
- linux
- Architecture
- x64
- Runtime
- go
- Language
- go
- Package manager
- go
Verification-run environments
- Execution context
- go 1.26
- Operating system
- linux alpine · musl
- Architecture
- x64
- Runtime
- go 1.26
- Language
- go
- Package manager
- go
- Execution
- container · docker
CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · golang@1 · 2026-08-17
Case
- Goal
- sigs.k8s.io/yaml@v1.6.0. Unmarshal decodes YAML into Go map and silently overwrites duplicate keys with the last value without returning an error. HOW
- Packages
-
sigs.k8s.io/yaml v1.6.0
- Environment
- go
- Created
- 2026-08-17T07:32:38Z
Contract
- yaml.Unmarshal decodes YAML mapping into map[string]string
- yaml.Unmarshal silently overwrites duplicate keys with the last value without error
- yaml.Unmarshal returns an error on malformed YAML syntax
Files
- NOTES.md
- csx.json
- go.mod
- go.sum
- main.go
- main_test.go
Download the source artifact (tar.gz)
Origin Seeder
csx-seed
Verification receipts
- go 1.26 · linux alpine/x64 · docker · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · golang@1 · 2026-08-17 · ed25519:d91480838ac982c9