Image

debian:trixie-slim

docker.io/library/debian

Violates at least one requirement in the policy.

Failed

signature is missing
sbom is missing
provenance is missing

Couldn't be checked · not a pass, and not a failure

none of its evidence is verified, so a trusted signer vouched for nothing about it
vulnerabilities are unknown (no scan)

Identity

Digest: sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f
Tags: trixie-slim
Created: 2026-10-05 00:00 UTC
Built by: debuerreotype (image metadata (history, labels, layer layout))
Source: not recorded

Base

Root. other observed images were proven to be built on this image

Built on this image: debian-tools:latest

Evidence

Evidence	Status	Signed by	Found as	When	Detail
Signature	Looked for, and there is none.	—	—	—
SBOM	Looked for, and there is none.	—	—	—	Looked for, and there is none.
Vulnerability report	Looked for, and there is none.	—	—	—	Looked for, and there is none.
SLSA provenance	Looked for, and there is none.	—	—	—
Recipe	Looked for, and there is none.	—	—	—	No clearcutt-factory recipe.
Rebase record	Doesn't apply to this image.	—	—	—	No rebase record: the image was built, not rebased.
Tests	Looked for, and there is none.	—	—	—	No test attestation.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, and the verdict. They name the image by its digest, docker.io/library/debian@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.

cd "$(mktemp -d)"
printf '%s\n' docker.io/library/debian@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","provenance"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-factory"},{"identityRegexp":"^https://github\\.com/chainguard-images/images/","issuer":"https://token.actions.githubusercontent.com"}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":30}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64 \
  --out=estate

Needs clearcutt-verify, as of clearcutt-verify dev, which wrote this report.

Vulnerabilities

No vulnerability data: unknown, not clean. This image has no vulnerability data, so how many vulnerabilities it has is unknown.

Tests and rebuilds

Tests: Looked for, and there is none. No test attestation.
Rebuild: Nothing to rebuild from, so reproducibility is not known. Nothing to rebuild from, so reproducibility is not known.

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
Run	Digest	Verdict	Base	Critical	High
2026-10-10 16:51 UTC	`sha256:a29215f6a35e`	Failed	none recorded	?	?

? means unknown: the run had no vulnerability data for this image. 2 earlier runs recorded no per-image rows and aren't shown.

Platforms

Platform	Digest	Layers	Compressed size
linux/amd64	`sha256:918311b7b6c4c6f68b232ba516584925f6c78ad82b6fd534b98979df6438e483`	1	28 MB

Packages

The report has no package set for this image. The report has no package set for this image, so what it ships is unknown.