Image

static:latest

cgr.dev/chainguard/static

At least one requirement couldn't be decided. Not a pass, and not a failure.

Couldn't be checked · not a pass, and not a failure

vulnerabilities are unknown (no scan)

Identity

Digest: sha256:fe55470f22d3259488d9d3739168d8f04da67755f0b69382bc26eda4a7d3d327
Tags: latest
Created: 2026-10-01 15:12 UTC
Built by: apko (image metadata (history, labels, layer layout))
Source: https://github.com/chainguard-images/images/tree/main/images/static Read from a label the image's author wrote.

Base

Root. other observed images were proven to be built on this image

Built on this image: hello-app:latest

Evidence

Evidence	Status	Signed by	Found as	When	Detail
Signature	Found, and checked against a trusted signer in the policy.	`https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/chainguard-images/images	cosign signature	—	cgr.dev/chainguard/static:sha256-fe55470f22d3259488d9d3739168d8f04da67755f0b69382bc26eda4a7d3d327.sig
SBOM	Found, and checked against a trusted signer in the policy.	`https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/chainguard-images/images	cosign attestation	—	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. cgr.dev/chainguard/static:sha256-a40219f3b0c2719e4e4220310e80a2230a4b95881644292c130e3a8e8287fc6c.att
Vulnerability report	Looked for, and there is none.	—	—	—	Looked for, and there is none. Looked for, and there is none.
SLSA provenance	Found, and checked against a trusted signer in the policy.	`https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/chainguard-images/images	cosign attestation	—	cgr.dev/chainguard/static:sha256-fe55470f22d3259488d9d3739168d8f04da67755f0b69382bc26eda4a7d3d327.att
Recipe	Looked for, and there is none.	—	—	—	No clearcutt-factory recipe.
Rebase record	Doesn't apply to this image.	—	—	—	No rebase record: the image was built, not rebased.
Tests	Looked for, and there is none.	—	—	—	No test attestation.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, and the verdict. They name the image by its digest, cgr.dev/chainguard/static@sha256:fe55470f22d3259488d9d3739168d8f04da67755f0b69382bc26eda4a7d3d327, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Signature. Checks the image's signature against the trusted signer.

cosign verify \
  --certificate-identity-regexp='^https://github\.com/chainguard-images/images/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  cgr.dev/chainguard/static@sha256:fe55470f22d3259488d9d3739168d8f04da67755f0b69382bc26eda4a7d3d327

SBOM (linux/amd64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://spdx.dev/Document \
  --certificate-identity-regexp='^https://github\.com/chainguard-images/images/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  cgr.dev/chainguard/static@sha256:a40219f3b0c2719e4e4220310e80a2230a4b95881644292c130e3a8e8287fc6c

SBOM (linux/arm64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://spdx.dev/Document \
  --certificate-identity-regexp='^https://github\.com/chainguard-images/images/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  cgr.dev/chainguard/static@sha256:daed076c904e5dc26f5ff87d77aa4cea8b7ca76e906b561915dafe5b086377dc

SLSA provenance. Checks the SLSA provenance was signed by the trusted signer, and prints it: what built the image, from which source.

cosign verify-attestation \
  --type=https://slsa.dev/provenance/v1 \
  --certificate-identity-regexp='^https://github\.com/chainguard-images/images/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  cgr.dev/chainguard/static@sha256:fe55470f22d3259488d9d3739168d8f04da67755f0b69382bc26eda4a7d3d327

Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.

cd "$(mktemp -d)"
printf '%s\n' cgr.dev/chainguard/static@sha256:fe55470f22d3259488d9d3739168d8f04da67755f0b69382bc26eda4a7d3d327 > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","provenance"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-factory"},{"identityRegexp":"^https://github\\.com/chainguard-images/images/","issuer":"https://token.actions.githubusercontent.com"}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":30}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64,linux/arm64 \
  --out=estate

Needs cosign, clearcutt-verify, as of clearcutt-verify dev, which wrote this report.

Vulnerabilities

No vulnerability data: unknown, not clean. This image has no vulnerability data, so how many vulnerabilities it has is unknown.

Tests and rebuilds

Tests: Looked for, and there is none. No test attestation.
Rebuild: Nothing to rebuild from, so reproducibility is not known. Nothing to rebuild from, so reproducibility is not known.

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
Run	Digest	Verdict	Base	Critical	High
2026-10-10 16:51 UTC	`sha256:fe55470f22d3`	Unverified	none recorded	?	?

? means unknown: the run had no vulnerability data for this image. 2 earlier runs recorded no per-image rows and aren't shown.

Platforms

Platform	Digest	Layers	Compressed size
linux/amd64	`sha256:a40219f3b0c2719e4e4220310e80a2230a4b95881644292c130e3a8e8287fc6c`	1	593 KB
linux/arm64	`sha256:daed076c904e5dc26f5ff87d77aa4cea8b7ca76e906b561915dafe5b086377dc`	1	593 KB

Packages

Read from its SBOM, which is Found, and checked against a trusted signer in the policy.; the union of the linux/amd64, linux/arm64 images' lists.

12 package versions

Package	Version	Type
alpine/ca-certificates	20260909	generic
ca-certificates-bundle	20260909-r2	apk
ca-certificates.yaml	f47c125470a19db0f450c2e4928a0db14f933d91	github
sha256:a40219f3b0c2719e4e4220310e80a2230a4b95881644292c130e3a8e8287fc6c	sha256:a40219f3b0c2719e4e4220310e80a2230a4b95881644292c130e3a8e8287fc6c	oci
sha256:bb8fa58ec978821768266f0c728f5deffbceba0afcd8f819e906150f6ff268f1	20230201	oci
sha256:daed076c904e5dc26f5ff87d77aa4cea8b7ca76e906b561915dafe5b086377dc	sha256:daed076c904e5dc26f5ff87d77aa4cea8b7ca76e906b561915dafe5b086377dc	oci
sha256:e6e34819883728aceb6bec47d0a54399d36ff80d7dd79e1a1445bb3eafeb02e1	20230201	oci
tz	2026e	github
tzdata	2026e-r0	apk
tzdata.yaml	c499c6b9b688160b1f545acfff0d99f73d668e1d	github
wolfi-baselayout	20230201-r30	apk
wolfi-baselayout.yaml	a4472f6292a5e48d6d611bf24c6e119b1a483e66	github