Provenance is missing
2 images, failed
- amazonlinux:2023 Failed
- debian:trixie-slim Failed
Estate overview
northcutted-images
clearcutt-verify checked 8 images from cgr.dev, docker.io, ghcr.io against the policy below, finishing at 2026-10-10 16:51 UTC. Each image is verified, failed, or unverified, with the reasons it wasn't verified.
Where the estate stands
Policy does not pass: of 8 images, 2 fail it and 2 are unverified.
Also outstanding:
Verdicts
4VerifiedMeets every requirement in the policy.2FailedViolates at least one requirement in the policy.2UnverifiedAt least one requirement couldn't be decided. Not a pass, and not a failure.
217Critical and high findings88 with a fix, in 4 scanned images (a floor)0On a stale baseof 4 images with a known base4Base provenby layer digests; 0 more rest on a claim0Base unresolvedno base could be determined4Vulnerabilities unknownimages with no vulnerability data45 minutesOldest scanhello-app:latest; none over 7 days4Reproducedof 4 images with a recipe or rebase record0Not reproducedrebuilt to a different digest
Each number opens the list of what it counts.
Not verified, and why
One card per reason, with every image it holds back: fix a reason and every image on its card moves. Requirements an image failed come first, then those that couldn't be checked, each with the reasons that hold back the most images first. An image can be on more than one card.
Failed · 3 reasons
The check ran, and the image fell short: evidence that is missing or failed verification, findings over the limit, a base proven too far behind, a rebuild that gave another digest.
Sbom is missing
2 images, failed
- amazonlinux:2023 Failed
- debian:trixie-slim Failed
Signature is missing
2 images, failed
- amazonlinux:2023 Failed
- debian:trixie-slim Failed
Couldn't be checked · 2 reasons
The requirement couldn't be decided: evidence that couldn't be read or checked, or that no trusted signer vouched for; vulnerabilities no scan covers, or a rescan that couldn't run; drift from a base the image only claims. Not a pass, and not a failure.
Vulnerabilities are unknown (no scan)
4 images: 2 failed, 2 unverified
- amazonlinux:2023 Failed
- debian:trixie-slim Failed
- static:latest Unverified
- wolfi-base:latest Unverified
None of its evidence is verified, so a trusted signer vouched for nothing about it
2 images, failed
- amazonlinux:2023 Failed
- debian:trixie-slim Failed
Findings to fix first
Critical and high findings with a fixed version first, then those with no fix known, each with the images that have it. 4 images have no vulnerability data, so this is a floor. Every finding, by advisory.
| Finding | Severity | Fixed in | Package | Images |
|---|---|---|---|---|
| GO-2026-6603 | high | 0.60.0, 1.26.9, 1.27.2 | golang.org/x/net v0.56.0, golang.org/x/net v0.57.0, golang.org/x/net v0.58.0, golang.org/x/net v0.59.0, stdlib go1.26.4, stdlib go1.26.6, stdlib go1.26.8, stdlib go1.27.1 | 3 |
| GO-2026-6605 | high | 1.26.9, 1.27.2 | stdlib go1.26.4, stdlib go1.26.6, stdlib go1.26.8, stdlib go1.27.1 | 3 |
| GO-2026-6607 | high | 1.26.9, 1.27.2 | stdlib go1.26.4, stdlib go1.26.6, stdlib go1.26.8, stdlib go1.27.1 | 3 |
| GO-2026-6608 | high | 1.26.9, 1.27.2 | stdlib go1.26.4, stdlib go1.26.6, stdlib go1.26.8, stdlib go1.27.1 | 3 |
| GO-2026-6609 | high | 1.26.9, 1.27.2 | stdlib go1.26.4, stdlib go1.26.6, stdlib go1.26.8, stdlib go1.27.1 | 3 |
| GO-2026-6610 | high | 0.60.0, 1.26.9, 1.27.2 | golang.org/x/net v0.56.0, golang.org/x/net v0.57.0, golang.org/x/net v0.58.0, golang.org/x/net v0.59.0, stdlib go1.26.4, stdlib go1.26.6, stdlib go1.26.8, stdlib go1.27.1 | 3 |
| GO-2026-6611 | high | 0.60.0, 1.26.9, 1.27.2 | golang.org/x/net v0.56.0, golang.org/x/net v0.57.0, golang.org/x/net v0.58.0, golang.org/x/net v0.59.0, stdlib go1.26.4, stdlib go1.26.6, stdlib go1.26.8, stdlib go1.27.1 | 3 |
| GO-2026-6613 | high | 1.26.9, 1.27.2 | stdlib go1.26.4, stdlib go1.26.6, stdlib go1.26.8, stdlib go1.27.1 | 3 |
| GO-2026-6629 | high | 0.41.0 | golang.org/x/text v0.38.0, golang.org/x/text v0.40.0 | 3 |
| GHSA-2v4p-qf9q-27wj | high | 1.82.2 | google.golang.org/grpc v1.82.0 | 1 |
Stale bases
No image is on an older version of its base than the newest one this run observed.
Images
| Image | Verdict | Base | Signature | SBOM | Vulnerability report | SLSA provenance | Recipe | Rebase record | Tests | Vulnerabilities | Scan age | Rebuild |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| amazonlinux:2023 docker.io/ | Failed. Violates at least one requirement in the policy. | root | Unknown. No vulnerability data: unknown, not clean. | no data | ||||||||
| debian:trixie-slim docker.io/ | Failed. Violates at least one requirement in the policy. | root | Unknown. No vulnerability data: unknown, not clean. | no data | ||||||||
| static:latest cgr.dev/ | Unverified. At least one requirement couldn't be decided. Not a pass, and not a failure. | root | Unknown. No vulnerability data: unknown, not clean. | no data | ||||||||
| wolfi-base:latest cgr.dev/ | Unverified. At least one requirement couldn't be decided. Not a pass, and not a failure. | root | Unknown. No vulnerability data: unknown, not clean. | no data | ||||||||
| amazonlinux-tools:latest ghcr.io/ | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Current. On the newest version of its base observed in this run. | 0 C · 12 H | 26 minutes | ||||||||
| debian-tools:latest ghcr.io/ | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Current. On the newest version of its base observed in this run. | 25 C · 116 H | 26 minutes | ||||||||
| hello-app:latest ghcr.io/ | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Current. On the newest version of its base observed in this run. | 0 findings | 45 minutes | ||||||||
| platform-tools:latest ghcr.io/ | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Current. On the newest version of its base observed in this run. | 0 C · 64 H | 25 minutes |
Select a column's heading to sort by it; select it again to reverse. Unknown values stay at the bottom.
✓ verified · ○ present, unverified · ! missing · ✕ failed · ? unknown · – not applicable
Evidence across the estate
| Evidence | Verified | Present | Failed | Missing | Unknown | n/a |
|---|---|---|---|---|---|---|
| Signature | 6 | 0 | 0 | 2 | 0 | 0 |
| SBOM | 6 | 0 | 0 | 2 | 0 | 0 |
| Vulnerability report | 4 | 0 | 0 | 4 | 0 | 0 |
| SLSA provenance | 6 | 0 | 0 | 2 | 0 | 0 |
| Recipe | 4 | 0 | 0 | 4 | 0 | 0 |
| Rebase record | 0 | 0 | 0 | 0 | 0 | 8 |
| Tests | 0 | 4 | 0 | 4 | 0 | 0 |
Vulnerabilities
Totals over the 4 images with vulnerability data. 4 images have none, so their vulnerabilities are unknown and these totals are a floor for the estate, not its total. Each image's findings describe the day its report was made.
| critical | high | medium | low | negligible | unknown | |
|---|---|---|---|---|---|---|
| Findings | 25 | 192 | 66 | 13 | 97 | 31 |
| With a fix | 0 | 88 | 4 | 0 | 0 | 25 |
Policy
- Required, verified
- Signature, SBOM, SLSA provenance
- Vulnerabilities
- fail at critical or above, counting only findings with a fix
- Rescan
- no: the findings are the publishers' scans, each as of the day it ran
- Scan age
- any age: a scan describes the day it was made, however long ago
- Base age
- fail when more than 30 days behind a base proven by layer digests; unverified when that far behind a base the image only claims
- Rebuilds
- this run rebuilt images to check them
- Trusted signers
- role image: an image's signature and attestations
- Identity matching
^https://github\.com/northcutted/clearcutt-factory/- Issuer
https://token.actions.githubusercontent.com- Run in repository
https://github.com/northcutted/clearcutt-factory
- Identity matching
^https://github\.com/chainguard-images/images/- Issuer
https://token.actions.githubusercontent.com