Image

hello-app:latest

ghcr.io/northcutted/images/hello-app

A tiny HTTP service built on the go stack

Meets every requirement in the policy.

Identity

Digest: sha256:4350805faaa3691ff14c1e9edd5ff4cfb274c840f906bae0d05cf649ac18a0e5
Tags: latest
Created: 2026-10-09 00:00 UTC
Built by: clearcutt-factory (clearcutt-factory recipe)
Source: https://github.com/northcutted/clearcutt-factory at 38f488213c03f7a5673c2d05d0b69e46864c7e6d Read from build provenance that verified.
clearcutt-factory: App hello-app; built with eab2d08; pins 0 packages, 0 tools, 5 images; files clamped to 2026-10-09
Stack: go defined beside the app, not in a registry; its definition's digest is sha256:cfdf348cb280.

Base

Built on: cgr.dev/chainguard/static:latest (static:latest)
sha256:fe55470f22d3259488d9d3739168d8f04da67755f0b69382bc26eda4a7d3d327
How it's known: The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. by layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.
Currency: On the newest version of its base observed in this run.
Newest observed: cgr.dev/chainguard/static:latest sha256:fe55470f22d3
Measured against the newest version observed in this run, not against upstream.

Evidence

Evidence	Status	Signed by	Found as	When	Detail
Signature	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-factory	cosign signature	2026-10-10 16:06 UTC	ghcr.io/northcutted/images/hello-app@sha256:0e74f75d845836e733a27f03d45cc2c49d289b9c5e78ce120f763e759fcaf6c0
SBOM	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-factory	cosign attestation	2026-10-10 16:06 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/images/hello-app@sha256:99ff45cf12efe040f989f992b2c76f8b806a562778c4b2bf8e396c24c18684a9
Vulnerability report	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-factory	cosign attestation	2026-10-10 16:07 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/images/hello-app@sha256:ff974072b4e2a18d75dd8966ff2e23b34aedb975cc529417dc93e1247a198205
SLSA provenance	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-factory	cosign attestation	2026-10-10 16:49 UTC	ghcr.io/northcutted/images/hello-app@sha256:0cd07dbc57a30aa4d9018e9228040dc98306205404f98a6a16049c28b04826a3
Recipe	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-factory	cosign attestation	2026-10-10 16:06 UTC	ghcr.io/northcutted/images/hello-app@sha256:69a6591a4f167abc4983db941d35c5493beb4bfa4d957e25e810a465a946d1aa
Rebase record	Doesn't apply to this image.	—	—	—	No rebase record: the image was built, not rebased.
Tests	The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof.	—	declared in the recipe	—	The verified recipe declares a smoke test (GET :8080/) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, a rebuild, and the verdict. They name the image by its digest, ghcr.io/northcutted/images/hello-app@sha256:4350805faaa3691ff14c1e9edd5ff4cfb274c840f906bae0d05cf649ac18a0e5, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Signature. Checks the image's signature against the trusted signer.

cosign verify \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/hello-app@sha256:4350805faaa3691ff14c1e9edd5ff4cfb274c840f906bae0d05cf649ac18a0e5

SBOM (linux/amd64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/hello-app@sha256:32e711ebdfc57f7cb55f821822f31bd385d2089747a692988b654869181e8c51

SBOM (linux/arm64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/hello-app@sha256:fd10bf90f25a7468320fec913a837ec8c457f9bc9059657a579fdcd543dc519b

Vulnerability report (linux/amd64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/hello-app@sha256:32e711ebdfc57f7cb55f821822f31bd385d2089747a692988b654869181e8c51

Vulnerability report (linux/arm64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/hello-app@sha256:fd10bf90f25a7468320fec913a837ec8c457f9bc9059657a579fdcd543dc519b

SLSA provenance. Checks the SLSA provenance was signed by the trusted signer, and prints it: what built the image, from which source.

cosign verify-attestation \
  --type=https://slsa.dev/provenance/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/hello-app@sha256:4350805faaa3691ff14c1e9edd5ff4cfb274c840f906bae0d05cf649ac18a0e5

Recipe. Checks the clearcutt-factory recipe was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://github.com/northcutted/clearcutt-factory/recipe/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/hello-app@sha256:4350805faaa3691ff14c1e9edd5ff4cfb274c840f906bae0d05cf649ac18a0e5

Rebuild. Rebuilds the image from its signed recipe, without a cache, and checks that the rebuild has this digest. It needs Docker or Podman.

clearcutt-factory verify \
  --image=ghcr.io/northcutted/images/hello-app@sha256:4350805faaa3691ff14c1e9edd5ff4cfb274c840f906bae0d05cf649ac18a0e5 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory

Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.

cd "$(mktemp -d)"
printf '%s\n' ghcr.io/northcutted/images/hello-app@sha256:4350805faaa3691ff14c1e9edd5ff4cfb274c840f906bae0d05cf649ac18a0e5 > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","provenance"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-factory"},{"identityRegexp":"^https://github\\.com/chainguard-images/images/","issuer":"https://token.actions.githubusercontent.com"}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":30}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64,linux/arm64 \
  --out=estate

No command for Tests: it isn't verified, so there is no trusted signer to check it against.

Needs cosign, clearcutt-factory, clearcutt-verify, as of clearcutt-verify dev, which wrote this report.

Vulnerabilities

From the publisher's signed report (grype 0.118.0), made 2026-10-10 16:06 UTC. The findings describe that day. The report itself is Found, and checked against a trusted signer in the policy..

	critical	high	medium	low	negligible	unknown
Findings	0	0	0	0	0	0
With a fix	0	0	0	0	0	0

No findings.

Tests and rebuilds

Tests: The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof. The verified recipe declares a smoke test (GET :8080/) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.
Rebuild: Rebuilt, and the rebuild has the same digest. rebuilt from the signed recipe, 2026-10-10 16:59 UTC
Rebuild gave sha256:4350805faaa3691ff14c1e9edd5ff4cfb274c840f906bae0d05cf649ac18a0e5, the same digest as the image.

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
Run	Digest	Verdict	Base	Critical	High
2026-10-10 16:51 UTC	`sha256:4350805faaa3`	Verified	Proven, current `sha256:fe55470f22d3`	0	0

? means unknown: the run had no vulnerability data for this image. 2 earlier runs recorded no per-image rows and aren't shown.

Platforms

Platform	Digest	Layers	Compressed size
linux/amd64	`sha256:32e711ebdfc57f7cb55f821822f31bd385d2089747a692988b654869181e8c51`	2	3.0 MB
linux/arm64	`sha256:fd10bf90f25a7468320fec913a837ec8c457f9bc9059657a579fdcd543dc519b`	2	2.8 MB

Packages

Read from its SBOM, which is Found, and checked against a trusted signer in the policy.; the union of the linux/amd64, linux/arm64 images' lists.

5 package versions

Package	Version	Type
ca-certificates-bundle	20260909-r2	apk
github.com/northcutted/clearcutt-factory/examples/hello-app	UNKNOWN	golang
stdlib	go1.27.2	golang
tzdata	2026e-r0	apk
wolfi-baselayout	20230201-r30	apk