ClearCutt Portal demo
Image estate

Image

wolfi-base:latest

cgr.dev/chainguard/wolfi-base

At least one requirement couldn't be decided. Not a pass, and not a failure.

Couldn't be checked · not a pass, and not a failure

  • vulnerabilities are unknown (no scan)

Identity

Digest
sha256:1c451d46a0d5c4e9f2b38e0e8d3e299564a1aa95c21973efcc1980a9d1d2e73e
Tags
latest
Created
2026-10-09 23:27 UTC
Built by
apko (image metadata (history, labels, layer layout))
Source
https://github.com/chainguard-images/images/tree/main/images/wolfi-base Read from a label the image's author wrote.

Base

Root. other observed images were proven to be built on this image

Built on this image: platform-tools:latest

Evidence

EvidenceStatusSigned byFound asWhenDetail
Signature Found, and checked against a trusted signer in the policy.https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main
issuer https://token.actions.githubusercontent.com
run in https://github.com/chainguard-images/images
cosign signature—
cgr.dev/chainguard/wolfi-base:sha256-1c451d46a0d5c4e9f2b38e0e8d3e299564a1aa95c21973efcc1980a9d1d2e73e.sig
SBOM Found, and checked against a trusted signer in the policy.https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main
issuer https://token.actions.githubusercontent.com
run in https://github.com/chainguard-images/images
cosign attestation—
  • Found, and checked against a trusted signer in the policy.
  • Found, and checked against a trusted signer in the policy.
cgr.dev/chainguard/wolfi-base:sha256-4c1aea74ceda999336d0b681792c2b787d8d63f0f4e5ace586489c2d15fde6ce.att
Vulnerability report Looked for, and there is none.———
  • Looked for, and there is none.
  • Looked for, and there is none.
SLSA provenance Found, and checked against a trusted signer in the policy.https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main
issuer https://token.actions.githubusercontent.com
run in https://github.com/chainguard-images/images
cosign attestation—
cgr.dev/chainguard/wolfi-base:sha256-1c451d46a0d5c4e9f2b38e0e8d3e299564a1aa95c21973efcc1980a9d1d2e73e.att
Recipe Looked for, and there is none.———No clearcutt-factory recipe.
Rebase record Doesn't apply to this image.———No rebase record: the image was built, not rebased.
Tests Looked for, and there is none.———No test attestation.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, and the verdict. They name the image by its digest, cgr.dev/chainguard/wolfi-base@sha256:1c451d46a0d5c4e9f2b38e0e8d3e299564a1aa95c21973efcc1980a9d1d2e73e, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Signature. Checks the image's signature against the trusted signer.
cosign verify \
  --certificate-identity-regexp='^https://github\.com/chainguard-images/images/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  cgr.dev/chainguard/wolfi-base@sha256:1c451d46a0d5c4e9f2b38e0e8d3e299564a1aa95c21973efcc1980a9d1d2e73e
SBOM (linux/amd64). Checks the SBOM attestation was signed by the trusted signer, and prints it.
cosign verify-attestation \
  --type=https://spdx.dev/Document \
  --certificate-identity-regexp='^https://github\.com/chainguard-images/images/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  cgr.dev/chainguard/wolfi-base@sha256:4c1aea74ceda999336d0b681792c2b787d8d63f0f4e5ace586489c2d15fde6ce
SBOM (linux/arm64). Checks the SBOM attestation was signed by the trusted signer, and prints it.
cosign verify-attestation \
  --type=https://spdx.dev/Document \
  --certificate-identity-regexp='^https://github\.com/chainguard-images/images/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  cgr.dev/chainguard/wolfi-base@sha256:74e1bcf7505648076546f2fe4735d243163e366d8f2ccd46b224adfadd48b5e3
SLSA provenance. Checks the SLSA provenance was signed by the trusted signer, and prints it: what built the image, from which source.
cosign verify-attestation \
  --type=https://slsa.dev/provenance/v1 \
  --certificate-identity-regexp='^https://github\.com/chainguard-images/images/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  cgr.dev/chainguard/wolfi-base@sha256:1c451d46a0d5c4e9f2b38e0e8d3e299564a1aa95c21973efcc1980a9d1d2e73e
Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.
cd "$(mktemp -d)"
printf '%s\n' cgr.dev/chainguard/wolfi-base@sha256:1c451d46a0d5c4e9f2b38e0e8d3e299564a1aa95c21973efcc1980a9d1d2e73e > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","provenance"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-factory"},{"identityRegexp":"^https://github\\.com/chainguard-images/images/","issuer":"https://token.actions.githubusercontent.com"}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":30}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64,linux/arm64 \
  --out=estate

Needs cosign, clearcutt-verify, as of clearcutt-verify dev, which wrote this report.

Vulnerabilities

No vulnerability data: unknown, not clean. This image has no vulnerability data, so how many vulnerabilities it has is unknown.

Tests and rebuilds

Tests
Looked for, and there is none. No test attestation.
Rebuild
Nothing to rebuild from, so reproducibility is not known. Nothing to rebuild from, so reproducibility is not known.

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
RunDigestVerdictBaseCriticalHigh
2026-10-10 16:51 UTCsha256:1c451d46a0d5 Unverifiednone recorded??

? means unknown: the run had no vulnerability data for this image. 2 earlier runs recorded no per-image rows and aren't shown.

Platforms

PlatformDigestLayersCompressed size
linux/amd64sha256:4c1aea74ceda999336d0b681792c2b787d8d63f0f4e5ace586489c2d15fde6ce117.8 MB
linux/arm64sha256:74e1bcf7505648076546f2fe4735d243163e366d8f2ccd46b224adfadd48b5e3116.7 MB

Packages

Read from its SBOM, which is Found, and checked against a trusted signer in the policy.; the union of the linux/amd64, linux/arm64 images' lists.

65 package versions
PackageVersionType
alpine/apk-toolsv2.14.10generic
alpine/ca-certificates20260909generic
apk-tools2.14.10-r17apk
apk-tools.yamle595e7afa164fb11cf29867f705f869d3c787ba9github
brotliv1.2.0github
brotli.yaml9db3aeed30b6359289528ef564a4909f78faeac9github
busybox1.38.0-r3apk
busybox_mirror1_38_0github
busybox.yaml59d45eb49286129d8d21b2469befa3b55be4719bgithub
ca-certificates-bundle20260909-r2apk
ca-certificates.yamlf47c125470a19db0f450c2e4928a0db14f933d91github
gcc.yaml794cf72f88e1b408eca5da0dbf5c5ed25543606dgithub
git/glibc34106fee698c83eb0af71d4d0381e66b399be746generic
glibc-2.442.44-r8apk
glibc-2.44-locale-posix2.44-r8apk
glibc-2.44.yaml3f73ace7dd5a203b7d080fd633d056d763e6760cgithub
gnutools/gccreleases/gcc-16.2.0generic
ld-linux-2.442.44-r8apk
libbrotlicommon11.2.0-r5apk
libbrotlidec11.2.0-r5apk
libbrotlienc11.2.0-r5apk
libcrypt1-2.442.44-r8apk
libgcc16.2.0-r1apk
libxcrypt4.5.2-r6apk
libxcryptv4.5.2github
libxcrypt.yaml94bc25975ca5bfdca755b5b507276667124bdf1fgithub
opensslopenssl-4.0.3github
openssl-4.0-libcrypto4.0.3-r6apk
openssl-4.0-libssl4.0.3-r6apk
openssl-4.0.yaml5489124e360c92c42599091afb060af6fb317bb1github
openssl-provider-legacy-allowed4.0.3-r1apk
openssl-provider-legacy-allowed.yaml5489124e360c92c42599091afb060af6fb317bb1github
sha256:0e0d95cd11d9bc8775ae15b999b97b5a0d635976fda218a952d94954606fa72820230201oci
sha256:132878d5f84c6e44cb815c8b61923df95fc639f4e9b6260396e292cbd4f8ff8820230201oci
sha256:303b8a16e2aa7550f8c95c6070db5921185cca92b0660d922ce71d181b0574e220230201oci
sha256:3ae05beb367c90d5265b27e44d4111d31a8129848b2bd9a6a90e3e640622f78120230201oci
sha256:4c1aea74ceda999336d0b681792c2b787d8d63f0f4e5ace586489c2d15fde6cesha256:4c1aea74ceda999336d0b681792c2b787d8d63f0f4e5ace586489c2d15fde6ceoci
sha256:4cbca11d11569143986f15360e9281a9c57bac270d537fe740b4da9c076ff2ab20230201oci
sha256:4ed27edae4476849f001ace8251fa40ee9da4882b8e7cd8dc084e70d7748ddad20230201oci
sha256:52da8dcee8e9a919fd0a772919d1f5aa5cb0b9194d036dccce04b9d82f86155520230201oci
sha256:5d31da5b55952d023f34bf449eccb28f898540e397bbf662c7447879fa420f8020230201oci
sha256:68df199f3fb28e5e5a4863abae369a9e926bd53698b0c752cb5b6b549e914c0920230201oci
sha256:68ffc26cc254a859d29f42ed5d3af0a93015b3f2b26f574be3106ed23d24423f20230201oci
sha256:6991dd3ea3c78373c81339ffcf88d992853f66339e55a268d009fe7536cf347320230201oci
sha256:74e1bcf7505648076546f2fe4735d243163e366d8f2ccd46b224adfadd48b5e3sha256:74e1bcf7505648076546f2fe4735d243163e366d8f2ccd46b224adfadd48b5e3oci
sha256:7638d538c8562bfda545ec45dc14d5c56a3618019b49226e888ec79c04f3ce8820230201oci
sha256:7749c648ff327dc829dbc92cade62552d611013055b3f05fc682f35253b0cdaa20230201oci
sha256:7e77629aa5197cf9996006b4f599e47bda7637044e7b31f7872f0f510372e88420230201oci
sha256:803385a6dffffcdb9be65d885d11657df8b2884888e37499a80dca3bc42913aa20230201oci
sha256:82eb1b27bce6473b2247ed3febc6fc875fd69906d79e71f538fba65b67ea073420230201oci
sha256:841091ee3f392aa0a52846eeda1ade872340d6bbeb1110b2273bb19fd90ca18a20230201oci
sha256:8e2d451c2147f50199781498098a8b10018b7c6d300c172bb873cb09ec25769b20230201oci
sha256:b10d4a946640307a04381e8ff5b3dc262f7332586acb67ba29838d9b1d239cbc20230201oci
sha256:efe4e60cf28ec5c978e81d7517529a2976e1de91986e9eb4990109517052c68e20230201oci
sha256:f38ff76eaa4d7b925f89582727e9c309cd7f089444c77a00118c88851f2bd89720230201oci
sha256:f53829540a90766dc673f2a4d258003b3d6d0644d4a71bb303e2ab9a006e0fb920230201oci
wolfi-base1-r7apk
wolfi-base.yamlc80c31b811557bc8724fcb901bdcc09615fcf4fcgithub
wolfi-baselayout20230201-r30apk
wolfi-baselayout.yamla4472f6292a5e48d6d611bf24c6e119b1a483e66github
wolfi-keys1-r13apk
wolfi-keys.yaml348d95d9454340e0425264c2123303ed74a03276github
zlib1.3.2.1_rc20260917-r0apk
zlibd81c2d7eb705c62294ba03299255672078e89115github
zlib.yaml91da644ae486d5109aa0f477bd55f9cd28895159github