Image

platform-tools:latest

ghcr.io/northcutted/images/platform-tools

kubectl, helm, gh, cosign, crane, and yq on Wolfi

Meets every requirement in the policy.

Identity

Digest: sha256:bf7990acf59ee88704a3a0b6fa280cb74ba771b86ccc1ce3a911e4122afc3591
Tags: latest
Created: 2026-10-09 00:00 UTC
Built by: clearcutt-factory (clearcutt-factory recipe)
Source: https://github.com/northcutted/clearcutt-factory at 38f488213c03f7a5673c2d05d0b69e46864c7e6d Read from build provenance that verified.
clearcutt-factory: Image platform-tools; built with e07953d; pins 48 packages, 6 tools, 6 images; files clamped to 2026-10-09

Base

Built on: cgr.dev/chainguard/wolfi-base:latest (wolfi-base:latest)
sha256:1c451d46a0d5c4e9f2b38e0e8d3e299564a1aa95c21973efcc1980a9d1d2e73e
How it's known: The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. by layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.
Currency: On the newest version of its base observed in this run.
Newest observed: cgr.dev/chainguard/wolfi-base:latest sha256:1c451d46a0d5
Measured against the newest version observed in this run, not against upstream.

Evidence

Evidence	Status	Signed by	Found as	When	Detail
Signature	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-factory	cosign signature	2026-10-10 16:26 UTC	ghcr.io/northcutted/images/platform-tools@sha256:8df028e9c4a6a941d72f4268566c2e81b2af5dfa9231ee94eb9c8f283077c280
SBOM	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-factory	cosign attestation	2026-10-10 16:26 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/images/platform-tools@sha256:a8af2c0cadee12f858eb9d8596e02116691bd141f03fd06b5465efd098940c63
Vulnerability report	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-factory	cosign attestation	2026-10-10 16:26 UTC	Found, and checked against a trusted signer in the policy. Found, and checked against a trusted signer in the policy. ghcr.io/northcutted/images/platform-tools@sha256:b688335f2c539007fe45f112b3af08f0f356f478491309b44ad2ed263c41db77
SLSA provenance	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-factory	cosign attestation	2026-10-10 16:50 UTC	ghcr.io/northcutted/images/platform-tools@sha256:9d07e61169a62590642349e757947a0ae14b5f32271175b0ca3fca392a987be5
Recipe	Found, and checked against a trusted signer in the policy.	`https://github.com/northcutted/clearcutt-factory/.github/workflows/images.yml@refs/heads/main` issuer https://token.actions.githubusercontent.com run in https://github.com/northcutted/clearcutt-factory	cosign attestation	2026-10-10 16:26 UTC	ghcr.io/northcutted/images/platform-tools@sha256:b81110e0efaaea365294e76c094b1528ff48b87eca2a20adc41be32c6c9e3bb3
Rebase record	Doesn't apply to this image.	—	—	—	No rebase record: the image was built, not rebased.
Tests	The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof.	—	declared in the recipe	—	The verified recipe declares a smoke test (/usr/local/bin/kubectl version --client) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.

Check it yourself

Commands that check what this page says without trusting this site or the report: each signature and attestation the report says verified, against the signer the policy trusts, a rebuild, and the verdict. They name the image by its digest, ghcr.io/northcutted/images/platform-tools@sha256:bf7990acf59ee88704a3a0b6fa280cb74ba771b86ccc1ce3a911e4122afc3591, never by a tag that could move. Every value comes from the report and is quoted for a POSIX shell (sh, bash, zsh).

Signature. Checks the image's signature against the trusted signer.

cosign verify \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/platform-tools@sha256:bf7990acf59ee88704a3a0b6fa280cb74ba771b86ccc1ce3a911e4122afc3591

SBOM (linux/amd64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/platform-tools@sha256:ac39142c7f963a6ed11c538f5c8252eed440c162dc6652274dcbbcb00376bd0e

SBOM (linux/arm64). Checks the SBOM attestation was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://cyclonedx.org/bom \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/platform-tools@sha256:fc5621a3449740cb4065244aa81a07dc8acc4792744b24ce50b151105821ecbf

Vulnerability report (linux/amd64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/platform-tools@sha256:ac39142c7f963a6ed11c538f5c8252eed440c162dc6652274dcbbcb00376bd0e

Vulnerability report (linux/arm64). Checks the vulnerability report was signed by the trusted signer, and prints it: the findings as of the day it was made.

cosign verify-attestation \
  --type=https://cosign.sigstore.dev/attestation/vuln/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/platform-tools@sha256:fc5621a3449740cb4065244aa81a07dc8acc4792744b24ce50b151105821ecbf

SLSA provenance. Checks the SLSA provenance was signed by the trusted signer, and prints it: what built the image, from which source.

cosign verify-attestation \
  --type=https://slsa.dev/provenance/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/platform-tools@sha256:bf7990acf59ee88704a3a0b6fa280cb74ba771b86ccc1ce3a911e4122afc3591

Recipe. Checks the clearcutt-factory recipe was signed by the trusted signer, and prints it.

cosign verify-attestation \
  --type=https://github.com/northcutted/clearcutt-factory/recipe/v1 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory \
  ghcr.io/northcutted/images/platform-tools@sha256:bf7990acf59ee88704a3a0b6fa280cb74ba771b86ccc1ce3a911e4122afc3591

Rebuild. Rebuilds the image from its signed recipe, without a cache, and checks that the rebuild has this digest. It needs Docker or Podman.

clearcutt-factory verify \
  --image=ghcr.io/northcutted/images/platform-tools@sha256:bf7990acf59ee88704a3a0b6fa280cb74ba771b86ccc1ce3a911e4122afc3591 \
  --certificate-identity-regexp='^https://github\.com/northcutted/clearcutt-factory/' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-github-workflow-repository=northcutted/clearcutt-factory

Verdict. Runs clearcutt-verify over this image alone, in a new directory, held to the policy this report was held to, and writes its own report to estate/estate-report.json. Its verdict should match this page's, though one image on its own can't show how far behind its base's newest version it is.

cd "$(mktemp -d)"
printf '%s\n' ghcr.io/northcutted/images/platform-tools@sha256:bf7990acf59ee88704a3a0b6fa280cb74ba771b86ccc1ce3a911e4122afc3591 > refs.txt
printf '%s\n' '{"apiVersion":"clearcutt.dev/v1","kind":"VerificationPolicy","required":["signature","sbom","provenance"],"trustedSigners":[{"identityRegexp":"^https://github\\.com/northcutted/clearcutt-factory/","issuer":"https://token.actions.githubusercontent.com","sourceRepository":"https://github.com/northcutted/clearcutt-factory"},{"identityRegexp":"^https://github\\.com/chainguard-images/images/","issuer":"https://token.actions.githubusercontent.com"}],"failOn":"critical","onlyFixed":true,"maxDaysBehind":30}' > policy.json
clearcutt-verify estate verify \
  --refs=refs.txt \
  --policy=policy.json \
  --platforms=linux/amd64,linux/arm64 \
  --out=estate

No command for Tests: it isn't verified, so there is no trusted signer to check it against.

Needs cosign, clearcutt-factory, clearcutt-verify, as of clearcutt-verify dev, which wrote this report.

Vulnerabilities

From the publisher's signed report (grype 0.118.0), made 2026-10-10 16:26 UTC. The findings describe that day. The report itself is Found, and checked against a trusted signer in the policy..

	critical	high	medium	low	negligible	unknown
Findings	0	64	4	1	0	21
With a fix	0	64	4	0	0	17

90 findings, fix first

ID	Package	Version	Severity	Fixed in	Platforms
GHSA-2v4p-qf9q-27wj GitHub advisory for GHSA-2v4p-qf9q-27wj	google.golang.org/grpc	v1.82.0	high	1.82.2	linux/amd64, linux/arm64
GHSA-hrxh-6v49-42gf GitHub advisory for GHSA-hrxh-6v49-42gf	google.golang.org/grpc	v1.82.0	high	1.82.1	linux/amd64, linux/arm64
GHSA-vp52-pcj8-j9qc GitHub advisory for GHSA-vp52-pcj8-j9qc	google.golang.org/grpc	v1.82.0	high	1.83.1	linux/amd64, linux/arm64
GO-2026-4970 Go vulnerability database for GO-2026-4970	stdlib	go1.26.4	high	1.25.12, 1.26.5, 1.27.0-rc.2	linux/amd64, linux/arm64
GO-2026-5026 Go vulnerability database for GO-2026-5026	stdlib	go1.26.4	high	1.25.13, 1.26.6, 1.27.0-rc.3	linux/amd64, linux/arm64
GO-2026-5942 Go vulnerability database for GO-2026-5942	stdlib	go1.26.4	high	1.26.6, 1.27.0-rc.3	linux/amd64, linux/arm64
GO-2026-5970 Go vulnerability database for GO-2026-5970	golang.org/x/text	v0.38.0	high	0.39.0	linux/amd64, linux/arm64
GO-2026-5972 Go vulnerability database for GO-2026-5972	stdlib	go1.26.4	high	1.25.13, 1.26.6, 1.27.0-rc.3	linux/amd64, linux/arm64
GO-2026-6088 Go vulnerability database for GO-2026-6088	stdlib	go1.26.4	high	1.25.13, 1.26.6, 1.27.0-rc.3	linux/amd64, linux/arm64
GO-2026-6089 Go vulnerability database for GO-2026-6089	stdlib	go1.26.4	high	1.25.13, 1.26.6, 1.27.0-rc.3	linux/amd64, linux/arm64
GO-2026-6090 Go vulnerability database for GO-2026-6090	stdlib	go1.26.4	high	1.25.13, 1.26.6, 1.27.0-rc.3	linux/amd64, linux/arm64
GO-2026-6179 Go vulnerability database for GO-2026-6179	golang.org/x/mod	v0.37.0	high	0.40.0	linux/amd64, linux/arm64
GO-2026-6180 Go vulnerability database for GO-2026-6180	golang.org/x/mod	v0.37.0	high	0.40.0	linux/amd64, linux/arm64
GO-2026-6303 Go vulnerability database for GO-2026-6303	golang.org/x/crypto	v0.53.0	high	0.55.0	linux/amd64, linux/arm64
GO-2026-6354 Go vulnerability database for GO-2026-6354	golang.org/x/crypto	v0.53.0	high	0.56.0	linux/amd64, linux/arm64
GO-2026-6354 Go vulnerability database for GO-2026-6354	golang.org/x/crypto	v0.55.0	high	0.56.0	linux/amd64, linux/arm64
GO-2026-6355 Go vulnerability database for GO-2026-6355	golang.org/x/crypto	v0.53.0	high	0.56.0	linux/amd64, linux/arm64
GO-2026-6355 Go vulnerability database for GO-2026-6355	golang.org/x/crypto	v0.55.0	high	0.56.0	linux/amd64, linux/arm64
GO-2026-6603 Go vulnerability database for GO-2026-6603	golang.org/x/net	v0.56.0	high	0.60.0	linux/amd64, linux/arm64
GO-2026-6603 Go vulnerability database for GO-2026-6603	golang.org/x/net	v0.57.0	high	0.60.0	linux/amd64, linux/arm64
GO-2026-6603 Go vulnerability database for GO-2026-6603	golang.org/x/net	v0.58.0	high	0.60.0	linux/amd64, linux/arm64
GO-2026-6603 Go vulnerability database for GO-2026-6603	golang.org/x/net	v0.59.0	high	0.60.0	linux/amd64, linux/arm64
GO-2026-6603 Go vulnerability database for GO-2026-6603	stdlib	go1.26.4	high	1.26.9	linux/amd64, linux/arm64
GO-2026-6603 Go vulnerability database for GO-2026-6603	stdlib	go1.26.6	high	1.26.9	linux/amd64, linux/arm64
GO-2026-6603 Go vulnerability database for GO-2026-6603	stdlib	go1.26.8	high	1.26.9	linux/amd64, linux/arm64
GO-2026-6603 Go vulnerability database for GO-2026-6603	stdlib	go1.27.1	high	1.27.2	linux/amd64, linux/arm64
GO-2026-6605 Go vulnerability database for GO-2026-6605	stdlib	go1.26.4	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6605 Go vulnerability database for GO-2026-6605	stdlib	go1.26.6	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6605 Go vulnerability database for GO-2026-6605	stdlib	go1.26.8	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6605 Go vulnerability database for GO-2026-6605	stdlib	go1.27.1	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6607 Go vulnerability database for GO-2026-6607	stdlib	go1.26.4	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6607 Go vulnerability database for GO-2026-6607	stdlib	go1.26.6	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6607 Go vulnerability database for GO-2026-6607	stdlib	go1.26.8	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6607 Go vulnerability database for GO-2026-6607	stdlib	go1.27.1	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6608 Go vulnerability database for GO-2026-6608	stdlib	go1.26.4	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6608 Go vulnerability database for GO-2026-6608	stdlib	go1.26.6	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6608 Go vulnerability database for GO-2026-6608	stdlib	go1.26.8	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6608 Go vulnerability database for GO-2026-6608	stdlib	go1.27.1	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6609 Go vulnerability database for GO-2026-6609	stdlib	go1.26.4	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6609 Go vulnerability database for GO-2026-6609	stdlib	go1.26.6	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6609 Go vulnerability database for GO-2026-6609	stdlib	go1.26.8	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6609 Go vulnerability database for GO-2026-6609	stdlib	go1.27.1	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6610 Go vulnerability database for GO-2026-6610	golang.org/x/net	v0.56.0	high	0.60.0	linux/amd64, linux/arm64
GO-2026-6610 Go vulnerability database for GO-2026-6610	golang.org/x/net	v0.57.0	high	0.60.0	linux/amd64, linux/arm64
GO-2026-6610 Go vulnerability database for GO-2026-6610	golang.org/x/net	v0.58.0	high	0.60.0	linux/amd64, linux/arm64
GO-2026-6610 Go vulnerability database for GO-2026-6610	golang.org/x/net	v0.59.0	high	0.60.0	linux/amd64, linux/arm64
GO-2026-6610 Go vulnerability database for GO-2026-6610	stdlib	go1.26.4	high	1.26.9	linux/amd64, linux/arm64
GO-2026-6610 Go vulnerability database for GO-2026-6610	stdlib	go1.26.6	high	1.26.9	linux/amd64, linux/arm64
GO-2026-6610 Go vulnerability database for GO-2026-6610	stdlib	go1.26.8	high	1.26.9	linux/amd64, linux/arm64
GO-2026-6610 Go vulnerability database for GO-2026-6610	stdlib	go1.27.1	high	1.27.2	linux/amd64, linux/arm64
GO-2026-6611 Go vulnerability database for GO-2026-6611	golang.org/x/net	v0.56.0	high	0.60.0	linux/amd64, linux/arm64
GO-2026-6611 Go vulnerability database for GO-2026-6611	golang.org/x/net	v0.57.0	high	0.60.0	linux/amd64, linux/arm64
GO-2026-6611 Go vulnerability database for GO-2026-6611	golang.org/x/net	v0.58.0	high	0.60.0	linux/amd64, linux/arm64
GO-2026-6611 Go vulnerability database for GO-2026-6611	golang.org/x/net	v0.59.0	high	0.60.0	linux/amd64, linux/arm64
GO-2026-6611 Go vulnerability database for GO-2026-6611	stdlib	go1.26.4	high	1.26.9	linux/amd64, linux/arm64
GO-2026-6611 Go vulnerability database for GO-2026-6611	stdlib	go1.26.6	high	1.26.9	linux/amd64, linux/arm64
GO-2026-6611 Go vulnerability database for GO-2026-6611	stdlib	go1.26.8	high	1.26.9	linux/amd64, linux/arm64
GO-2026-6611 Go vulnerability database for GO-2026-6611	stdlib	go1.27.1	high	1.27.2	linux/amd64, linux/arm64
GO-2026-6613 Go vulnerability database for GO-2026-6613	stdlib	go1.26.4	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6613 Go vulnerability database for GO-2026-6613	stdlib	go1.26.6	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6613 Go vulnerability database for GO-2026-6613	stdlib	go1.26.8	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6613 Go vulnerability database for GO-2026-6613	stdlib	go1.27.1	high	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6629 Go vulnerability database for GO-2026-6629	golang.org/x/text	v0.38.0	high	0.41.0	linux/amd64, linux/arm64
GO-2026-6629 Go vulnerability database for GO-2026-6629	golang.org/x/text	v0.40.0	high	0.41.0	linux/amd64, linux/arm64
GHSA-qc2q-p7wx-3px3 GitHub advisory for GHSA-qc2q-p7wx-3px3	google.golang.org/grpc	v1.82.0	medium	1.83.1	linux/amd64, linux/arm64
GO-2026-5856 Go vulnerability database for GO-2026-5856	stdlib	go1.26.4	medium	1.25.12, 1.26.5, 1.27.0-rc.2	linux/amd64, linux/arm64
GO-2026-6091 Go vulnerability database for GO-2026-6091	stdlib	go1.26.4	medium	1.25.13, 1.26.6, 1.27.0-rc.3	linux/amd64, linux/arm64
GO-2026-6218 Go vulnerability database for GO-2026-6218	stdlib	go1.26.4	medium	1.25.13, 1.26.6, 1.27.0-rc.3	linux/amd64, linux/arm64
GO-2025-3547 Go vulnerability database for GO-2025-3547	k8s.io/kubernetes	v1.37.1	low	no fix known	linux/amd64, linux/arm64
GO-2026-5841 Go vulnerability database for GO-2026-5841	github.com/klauspost/compress	v1.18.6	unknown	1.18.7	linux/amd64, linux/arm64
GO-2026-6599 Go vulnerability database for GO-2026-6599	stdlib	go1.26.4	unknown	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6599 Go vulnerability database for GO-2026-6599	stdlib	go1.26.6	unknown	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6599 Go vulnerability database for GO-2026-6599	stdlib	go1.26.8	unknown	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6599 Go vulnerability database for GO-2026-6599	stdlib	go1.27.1	unknown	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6600 Go vulnerability database for GO-2026-6600	stdlib	go1.26.4	unknown	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6600 Go vulnerability database for GO-2026-6600	stdlib	go1.26.6	unknown	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6600 Go vulnerability database for GO-2026-6600	stdlib	go1.26.8	unknown	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6600 Go vulnerability database for GO-2026-6600	stdlib	go1.27.1	unknown	1.26.9, 1.27.2	linux/amd64, linux/arm64
GO-2026-6617 Go vulnerability database for GO-2026-6617	golang.org/x/net	v0.56.0	unknown	0.60.0	linux/amd64, linux/arm64
GO-2026-6617 Go vulnerability database for GO-2026-6617	golang.org/x/net	v0.57.0	unknown	0.60.0	linux/amd64, linux/arm64
GO-2026-6617 Go vulnerability database for GO-2026-6617	golang.org/x/net	v0.58.0	unknown	0.60.0	linux/amd64, linux/arm64
GO-2026-6617 Go vulnerability database for GO-2026-6617	golang.org/x/net	v0.59.0	unknown	0.60.0	linux/amd64, linux/arm64
GO-2026-6617 Go vulnerability database for GO-2026-6617	stdlib	go1.26.4	unknown	1.26.9	linux/amd64, linux/arm64
GO-2026-6617 Go vulnerability database for GO-2026-6617	stdlib	go1.26.6	unknown	1.26.9	linux/amd64, linux/arm64
GO-2026-6617 Go vulnerability database for GO-2026-6617	stdlib	go1.26.8	unknown	1.26.9	linux/amd64, linux/arm64
GO-2026-6617 Go vulnerability database for GO-2026-6617	stdlib	go1.27.1	unknown	1.27.2	linux/amd64, linux/arm64
GO-2026-5932 Go vulnerability database for GO-2026-5932	golang.org/x/crypto	v0.53.0	unknown	no fix known	linux/amd64, linux/arm64
GO-2026-5932 Go vulnerability database for GO-2026-5932	golang.org/x/crypto	v0.55.0	unknown	no fix known	linux/amd64, linux/arm64
GO-2026-5932 Go vulnerability database for GO-2026-5932	golang.org/x/crypto	v0.57.0	unknown	no fix known	linux/amd64, linux/arm64
GO-2026-6225 Go vulnerability database for GO-2026-6225	github.com/chrismellard/docker-credential-acr-env	v0.0.0-20230304212654-82a0ddb27589	unknown	no fix known	linux/amd64, linux/arm64

12 suppressed by a VEX statement or the scanner (not counted)

ID	Package	Version	Severity	Fixed in	Platforms	Suppressed by
GO-2026-6604 Go vulnerability database for GO-2026-6604	stdlib	go1.26.4	critical	1.26.9, 1.27.2	linux/amd64, linux/arm64	A VEX statement, or a rule of the scanner's own, says this finding doesn't apply, so the report doesn't count it. It is a statement someone made, not a check: the finding stays listed. The publisher's scan suppressed it, with a statement this run didn't see.
GO-2026-6604 Go vulnerability database for GO-2026-6604	stdlib	go1.26.6	critical	1.26.9, 1.27.2	linux/amd64, linux/arm64	A VEX statement, or a rule of the scanner's own, says this finding doesn't apply, so the report doesn't count it. It is a statement someone made, not a check: the finding stays listed. The publisher's scan suppressed it, with a statement this run didn't see.
GO-2026-6604 Go vulnerability database for GO-2026-6604	stdlib	go1.26.8	critical	1.26.9, 1.27.2	linux/amd64, linux/arm64	A VEX statement, or a rule of the scanner's own, says this finding doesn't apply, so the report doesn't count it. It is a statement someone made, not a check: the finding stays listed. The publisher's scan suppressed it, with a statement this run didn't see.
GO-2026-6604 Go vulnerability database for GO-2026-6604	stdlib	go1.27.1	critical	1.26.9, 1.27.2	linux/amd64, linux/arm64	A VEX statement, or a rule of the scanner's own, says this finding doesn't apply, so the report doesn't count it. It is a statement someone made, not a check: the finding stays listed. The publisher's scan suppressed it, with a statement this run didn't see.
GO-2026-6612 Go vulnerability database for GO-2026-6612	golang.org/x/net	v0.56.0	critical	0.60.0	linux/amd64, linux/arm64	A VEX statement, or a rule of the scanner's own, says this finding doesn't apply, so the report doesn't count it. It is a statement someone made, not a check: the finding stays listed. The publisher's scan suppressed it, with a statement this run didn't see.
GO-2026-6612 Go vulnerability database for GO-2026-6612	golang.org/x/net	v0.57.0	critical	0.60.0	linux/amd64, linux/arm64	A VEX statement, or a rule of the scanner's own, says this finding doesn't apply, so the report doesn't count it. It is a statement someone made, not a check: the finding stays listed. The publisher's scan suppressed it, with a statement this run didn't see.
GO-2026-6612 Go vulnerability database for GO-2026-6612	golang.org/x/net	v0.58.0	critical	0.60.0	linux/amd64, linux/arm64	A VEX statement, or a rule of the scanner's own, says this finding doesn't apply, so the report doesn't count it. It is a statement someone made, not a check: the finding stays listed. The publisher's scan suppressed it, with a statement this run didn't see.
GO-2026-6612 Go vulnerability database for GO-2026-6612	golang.org/x/net	v0.59.0	critical	0.60.0	linux/amd64, linux/arm64	A VEX statement, or a rule of the scanner's own, says this finding doesn't apply, so the report doesn't count it. It is a statement someone made, not a check: the finding stays listed. The publisher's scan suppressed it, with a statement this run didn't see.
GO-2026-6612 Go vulnerability database for GO-2026-6612	stdlib	go1.26.4	critical	1.26.9	linux/amd64, linux/arm64	A VEX statement, or a rule of the scanner's own, says this finding doesn't apply, so the report doesn't count it. It is a statement someone made, not a check: the finding stays listed. The publisher's scan suppressed it, with a statement this run didn't see.
GO-2026-6612 Go vulnerability database for GO-2026-6612	stdlib	go1.26.6	critical	1.26.9	linux/amd64, linux/arm64	A VEX statement, or a rule of the scanner's own, says this finding doesn't apply, so the report doesn't count it. It is a statement someone made, not a check: the finding stays listed. The publisher's scan suppressed it, with a statement this run didn't see.
GO-2026-6612 Go vulnerability database for GO-2026-6612	stdlib	go1.26.8	critical	1.26.9	linux/amd64, linux/arm64	A VEX statement, or a rule of the scanner's own, says this finding doesn't apply, so the report doesn't count it. It is a statement someone made, not a check: the finding stays listed. The publisher's scan suppressed it, with a statement this run didn't see.
GO-2026-6612 Go vulnerability database for GO-2026-6612	stdlib	go1.27.1	critical	1.27.2	linux/amd64, linux/arm64	A VEX statement, or a rule of the scanner's own, says this finding doesn't apply, so the report doesn't count it. It is a statement someone made, not a check: the finding stays listed. The publisher's scan suppressed it, with a statement this run didn't see.

Tests and rebuilds

Tests: The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof. The verified recipe declares a smoke test (/usr/local/bin/kubectl version --client) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested.
Rebuild: Rebuilt, and the rebuild has the same digest. rebuilt from the signed recipe, 2026-10-10 16:58 UTC
Rebuild gave sha256:bf7990acf59ee88704a3a0b6fa280cb74ba771b86ccc1ce3a911e4122afc3591, the same digest as the image.

Rebase history

Doesn't apply to this image. No rebase record: the image was built, not rebased.

This image over time

This image in each run that recorded per-image rows, newest first, and how it changed since the run before: rebuilt or rebased (a new digest), or its base moved (the same image, its base more or less current). Compare two runs for every image at once.

This image in each run, newest first
Run	Digest	Verdict	Base	Critical	High
2026-10-10 16:51 UTC	`sha256:bf7990acf59e`	Verified	Proven, current `sha256:1c451d46a0d5`	0	64

? means unknown: the run had no vulnerability data for this image. 2 earlier runs recorded no per-image rows and aren't shown.

Platforms

Platform	Digest	Layers	Compressed size
linux/amd64	`sha256:ac39142c7f963a6ed11c538f5c8252eed440c162dc6652274dcbbcb00376bd0e`	20	150 MB
linux/arm64	`sha256:fc5621a3449740cb4065244aa81a07dc8acc4792744b24ce50b151105821ecbf`	20	137 MB

Packages

Read from its SBOM, which is Found, and checked against a trusted signer in the policy.; the union of the linux/amd64, linux/arm64 images' lists.

554 package versions

Package	Version	Type
apk-tools	2.14.10-r17	apk
bash	5.3-r14	apk
buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go	v1.36.11-20260415201107-50325440f8f2.1	golang
busybox	1.38.0-r3	apk
ca-certificates-bundle	20260909-r2	apk
charm.land/bubbles/v2	v2.2.1	golang
charm.land/bubbletea/v2	v2.0.10	golang
charm.land/huh/v2	v2.0.3	golang
charm.land/lipgloss/v2	v2.0.6	golang
cloud.google.com/go/auth	v0.20.0	golang
cloud.google.com/go/auth/oauth2adapt	v0.2.8	golang
cloud.google.com/go/compute/metadata	v0.9.0	golang
cloud.google.com/go/iam	v1.11.0	golang
cloud.google.com/go/kms	v1.31.0	golang
cloud.google.com/go/longrunning	v1.0.0	golang
connectrpc.com/connect	v1.20.0	golang
cosign	3.1.3	github
crane	sha256:9162effd4c674ad2fa4e7170a894503ffff9114f15a57e75a0a32e111ad32d85	oci
cuelabs.dev/go/oci/ociregistry	v0.0.0-20251212221603-3adeb8663819	golang
cuelang.org/go	v0.16.1	golang
curl	8.22.0-r4	apk
cyrus-sasl-heimdal-libs	2.1.28-r58	apk
dario.cat/mergo	v1.0.1	golang
dario.cat/mergo	v1.0.2	golang
gdbm	1.26-r7	apk
gh	2.102.0	github
git	2.56.0-r0	apk
github.com/a8m/envsubst	v1.4.3	golang
github.com/agext/levenshtein	v1.2.1	golang
github.com/agnivade/levenshtein	v1.2.1	golang
github.com/AlecAivazis/survey/v2	v2.3.7	golang
github.com/alecthomas/chroma/v2	v2.27.0	golang
github.com/alecthomas/participle/v2	v2.1.4	golang
github.com/alibabacloud-go/alibabacloud-gateway-spi	v0.0.4	golang
github.com/alibabacloud-go/cr-20160607	v1.0.1	golang
github.com/alibabacloud-go/cr-20181201	v1.0.10	golang
github.com/alibabacloud-go/darabonba-openapi	v0.2.1	golang
github.com/alibabacloud-go/debug	v1.0.0	golang
github.com/alibabacloud-go/endpoint-util	v1.1.1	golang
github.com/alibabacloud-go/openapi-util	v0.1.0	golang
github.com/alibabacloud-go/tea	v1.2.1	golang
github.com/alibabacloud-go/tea-utils	v1.4.5	golang
github.com/alibabacloud-go/tea-xml	v1.1.3	golang
github.com/aliyun/credentials-go	v1.3.2	golang
github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/provider	v0.14.0	golang
github.com/apparentlymart/go-textseg/v17	v17.0.1	golang
github.com/asaskevich/govalidator	v0.0.0-20230301143203-a9d515a09cc2	golang
github.com/atotto/clipboard	v0.1.4	golang
github.com/aws/aws-sdk-go-v2	v1.42.0	golang
github.com/aws/aws-sdk-go-v2/config	v1.32.25	golang
github.com/aws/aws-sdk-go-v2/credentials	v1.19.24	golang
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	v1.18.29	golang
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.4.29	golang
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.7.29	golang
github.com/aws/aws-sdk-go-v2/internal/v4a	v1.4.30	golang
github.com/aws/aws-sdk-go-v2/service/ecr	v1.55.3	golang
github.com/aws/aws-sdk-go-v2/service/ecrpublic	v1.38.10	golang
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	v1.13.12	golang
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.13.29	golang
github.com/aws/aws-sdk-go-v2/service/kms	v1.53.4	golang
github.com/aws/aws-sdk-go-v2/service/signin	v1.2.0	golang
github.com/aws/aws-sdk-go-v2/service/sso	v1.31.3	golang
github.com/aws/aws-sdk-go-v2/service/ssooidc	v1.36.6	golang
github.com/aws/aws-sdk-go-v2/service/sts	v1.43.3	golang
github.com/aws/smithy-go	v1.27.2	golang
github.com/awslabs/amazon-ecr-credential-helper/ecr-login	v0.12.0	golang
github.com/aymanbagabas/go-osc52/v2	v2.0.1	golang
github.com/aymerick/douceur	v0.2.0	golang
github.com/Azure/azure-sdk-for-go	v68.0.0+incompatible	golang
github.com/Azure/azure-sdk-for-go/sdk/azcore	v1.22.0	golang
github.com/Azure/azure-sdk-for-go/sdk/azidentity	v1.14.0	golang
github.com/Azure/azure-sdk-for-go/sdk/internal	v1.12.0	golang
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys	v1.5.0	golang
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal	v1.2.0	golang
github.com/Azure/go-autorest/autorest	v0.11.29	golang
github.com/Azure/go-autorest/autorest/adal	v0.9.23	golang
github.com/Azure/go-autorest/autorest/azure/auth	v0.5.12	golang
github.com/Azure/go-autorest/autorest/azure/cli	v0.4.6	golang
github.com/Azure/go-autorest/autorest/date	v0.3.0	golang
github.com/Azure/go-autorest/logger	v0.2.1	golang
github.com/Azure/go-autorest/tracing	v0.6.0	golang
github.com/AzureAD/microsoft-authentication-library-for-go	v1.7.2	golang
github.com/beorn7/perks	v1.0.1	golang
github.com/blang/semver	v3.5.1+incompatible	golang
github.com/blang/semver/v4	v4.0.0	golang
github.com/briandowns/spinner	v1.23.2	golang
github.com/buildkite/agent/v3	v3.130.0	golang
github.com/buildkite/go-pipeline	v0.17.1	golang
github.com/buildkite/interpolate	v0.1.5	golang
github.com/buildkite/roko	v1.4.0	golang
github.com/BurntSushi/toml	v1.6.0	golang
github.com/catppuccin/go	v0.3.0	golang
github.com/cenkalti/backoff/v4	v4.3.0	golang
github.com/cenkalti/backoff/v5	v5.0.3	golang
github.com/cespare/xxhash/v2	v2.3.0	golang
github.com/chai2010/gettext-go	v1.0.2	golang
github.com/charmbracelet/colorprofile	v0.4.3	golang
github.com/charmbracelet/glamour	v0.10.0	golang
github.com/charmbracelet/lipgloss	v1.1.1-0.20250404203927-76690c660834	golang
github.com/charmbracelet/ultraviolet	v0.0.0-20260811164956-006e29f97886	golang
github.com/charmbracelet/x/ansi	v0.11.8	golang
github.com/charmbracelet/x/cellbuf	v0.0.15	golang
github.com/charmbracelet/x/exp/ordered	v0.1.0	golang
github.com/charmbracelet/x/exp/slice	v0.0.0-20250630141444-821143405392	golang
github.com/charmbracelet/x/exp/strings	v0.0.0-20250630141444-821143405392	golang
github.com/charmbracelet/x/term	v0.2.2	golang
github.com/charmbracelet/x/termios	v0.1.1	golang
github.com/charmbracelet/x/windows	v0.2.2	golang
github.com/chrismellard/docker-credential-acr-env	v0.0.0-20230304212654-82a0ddb27589	golang
github.com/clbanning/mxj/v2	v2.7.0	golang
github.com/cli/browser	v1.3.0	golang
github.com/cli/cli/v2	v2.102.0	golang
github.com/cli/go-gh/v2	v2.16.1	golang
github.com/cli/oauth	v1.2.2	golang
github.com/cli/safeexec	v1.0.1	golang
github.com/cli/shurcooL-graphql	v0.0.4	golang
github.com/clipperhouse/displaywidth	v0.11.0	golang
github.com/clipperhouse/uax29/v2	v2.7.0	golang
github.com/cloudflare/circl	v1.6.3	golang
github.com/cockroachdb/apd/v3	v3.2.1	golang
github.com/common-nighthawk/go-figure	v0.0.0-20210622060536-734e95fb86be	golang
github.com/coreos/go-oidc/v3	v3.18.0	golang
github.com/cpuguy83/go-md2man/v2	v2.0.6	golang
github.com/cyberphone/json-canonicalization	v0.0.0-20241213102144-19d51d7fe467	golang
github.com/cyphar/filepath-securejoin	v0.7.0	golang
github.com/davecgh/go-spew	v1.1.2-0.20180830191138-d8f796af33cc	golang
github.com/digitorus/pkcs7	v0.0.0-20230818184609-3a137a874352	golang
github.com/digitorus/timestamp	v0.0.0-20231217203849-220c5c2851b7	golang
github.com/digitorus/timestamp	v0.0.0-20250524132541-c45532741eea	golang
github.com/dimchansky/utfbom	v1.1.1	golang
github.com/distribution/reference	v0.6.0	golang
github.com/dlclark/regexp2/v2	v2.2.1	golang
github.com/docker/cli	v29.5.3+incompatible	golang
github.com/docker/cli	v29.7.2+incompatible	golang
github.com/docker/cli	v29.8.2+incompatible	golang
github.com/docker/docker-credential-helpers	v0.9.3	golang
github.com/docker/docker-credential-helpers	v0.9.5	golang
github.com/dustin/go-humanize	v1.0.1	golang
github.com/dylibso/observe-sdk/go	v0.0.0-20240819160327-2d926c5d788a	golang
github.com/elliotchance/orderedmap	v1.8.0	golang
github.com/emicklei/go-restful/v3	v3.13.0	golang
github.com/emicklei/proto	v1.14.3	golang
github.com/evanphx/json-patch/v5	v5.9.11	golang
github.com/exponent-io/jsonpath	v0.0.0-20210407135951-1de76d718b3f	golang
github.com/extism/go-sdk	v1.7.1	golang
github.com/fatih/camelcase	v1.0.0	golang
github.com/fatih/color	v1.18.0	golang
github.com/fatih/color	v1.19.0	golang
github.com/felixge/httpsnoop	v1.0.4	golang
github.com/fluxcd/cli-utils	v1.2.2	golang
github.com/fsnotify/fsnotify	v1.10.1	golang
github.com/fxamacker/cbor/v2	v2.9.0	golang
github.com/fxamacker/cbor/v2	v2.9.1	golang
github.com/gabriel-vasile/mimetype	v1.4.15	golang
github.com/gdamore/encoding	v1.0.1	golang
github.com/gdamore/tcell/v2	v2.13.10	golang
github.com/go-chi/chi/v5	v5.3.0	golang
github.com/go-errors/errors	v1.4.2	golang
github.com/go-errors/errors	v1.5.1	golang
github.com/go-gorp/gorp/v3	v3.1.0	golang
github.com/go-ini/ini	v1.67.0	golang
github.com/go-jose/go-jose/v4	v4.1.4	golang
github.com/go-logr/logr	v1.4.3	golang
github.com/go-logr/logr	v1.4.4	golang
github.com/go-logr/stdr	v1.2.2	golang
github.com/go-openapi/analysis	v0.25.2	golang
github.com/go-openapi/analysis	v0.25.5	golang
github.com/go-openapi/errors	v0.22.8	golang
github.com/go-openapi/jsonpointer	v0.23.1	golang
github.com/go-openapi/jsonpointer	v1.0.0	golang
github.com/go-openapi/jsonreference	v0.21.6	golang
github.com/go-openapi/jsonreference	v1.0.0	golang
github.com/go-openapi/loads	v0.24.0	golang
github.com/go-openapi/loads	v0.25.0	golang
github.com/go-openapi/runtime	v0.32.4	golang
github.com/go-openapi/runtime	v0.33.0	golang
github.com/go-openapi/runtime/server-middleware	v0.30.0	golang
github.com/go-openapi/spec	v0.22.6	golang
github.com/go-openapi/spec	v0.22.9	golang
github.com/go-openapi/strfmt	v0.26.4	golang
github.com/go-openapi/strfmt	v0.27.0	golang
github.com/go-openapi/swag	v0.26.1	golang
github.com/go-openapi/swag	v0.27.1	golang
github.com/go-openapi/swag/cmdutils	v0.26.1	golang
github.com/go-openapi/swag/cmdutils	v0.27.0	golang
github.com/go-openapi/swag/cmdutils	v0.27.1	golang
github.com/go-openapi/swag/conv	v0.27.0	golang
github.com/go-openapi/swag/conv	v0.27.1	golang
github.com/go-openapi/swag/conv	v0.27.3	golang
github.com/go-openapi/swag/fileutils	v0.26.1	golang
github.com/go-openapi/swag/fileutils	v0.27.1	golang
github.com/go-openapi/swag/fileutils	v0.27.3	golang
github.com/go-openapi/swag/jsonname	v0.26.1	golang
github.com/go-openapi/swag/jsonutils	v0.26.1	golang
github.com/go-openapi/swag/jsonutils	v0.27.1	golang
github.com/go-openapi/swag/jsonutils	v0.27.3	golang
github.com/go-openapi/swag/loading	v0.26.1	golang
github.com/go-openapi/swag/loading	v0.27.1	golang
github.com/go-openapi/swag/loading	v0.27.3	golang
github.com/go-openapi/swag/mangling	v0.26.1	golang
github.com/go-openapi/swag/mangling	v0.27.1	golang
github.com/go-openapi/swag/mangling	v0.27.3	golang
github.com/go-openapi/swag/netutils	v0.26.1	golang
github.com/go-openapi/swag/netutils	v0.27.0	golang
github.com/go-openapi/swag/netutils	v0.27.1	golang
github.com/go-openapi/swag/pools	v0.27.1	golang
github.com/go-openapi/swag/pools	v0.27.3	golang
github.com/go-openapi/swag/stringutils	v0.26.1	golang
github.com/go-openapi/swag/stringutils	v0.27.1	golang
github.com/go-openapi/swag/stringutils	v0.27.3	golang
github.com/go-openapi/swag/typeutils	v0.27.0	golang
github.com/go-openapi/swag/typeutils	v0.27.1	golang
github.com/go-openapi/swag/typeutils	v0.27.3	golang
github.com/go-openapi/swag/yamlutils	v0.26.1	golang
github.com/go-openapi/swag/yamlutils	v0.27.1	golang
github.com/go-openapi/swag/yamlutils	v0.27.3	golang
github.com/go-openapi/validate	v0.26.0	golang
github.com/go-openapi/validate	v0.26.1	golang
github.com/go-viper/mapstructure/v2	v2.5.0	golang
github.com/gobwas/glob	v0.2.3	golang
github.com/goccy/go-json	v0.10.6	golang
github.com/goccy/go-yaml	v1.19.2	golang
github.com/godbus/dbus/v5	v5.2.2	golang
github.com/gofrs/flock	v0.13.0	golang
github.com/golang-jwt/jwt/v4	v4.5.2	golang
github.com/golang-jwt/jwt/v5	v5.3.1	golang
github.com/golang/snappy	v0.0.4	golang
github.com/google/btree	v1.1.3	golang
github.com/google/certificate-transparency-go	v1.3.3	golang
github.com/google/gnostic-models	v0.7.0	golang
github.com/google/go-cmp	v0.6.0	golang
github.com/google/go-cmp	v0.7.0	golang
github.com/google/go-containerregistry	v0.0.0-20261007205159-0d888fc956e8	golang
github.com/google/go-containerregistry	v0.0.0-20261007205159-0d888fc956e8+dirty	golang
github.com/google/go-containerregistry	v0.21.7	golang
github.com/google/go-containerregistry	v0.22.1	golang
github.com/google/go-github/v88	v88.0.0	golang
github.com/google/go-querystring	v1.2.0	golang
github.com/google/s2a-go	v0.1.9	golang
github.com/google/shlex	v0.0.0-20191202100458-e7afc7fbc510	golang
github.com/google/uuid	v1.6.0	golang
github.com/googleapis/enterprise-certificate-proxy	v0.3.16	golang
github.com/googleapis/gax-go/v2	v2.22.0	golang
github.com/gorilla/css	v1.0.1	golang
github.com/gorilla/websocket	v1.5.3	golang
github.com/gorilla/websocket	v1.5.4-0.20250319132907-e064f32e3674	golang
github.com/gosuri/uitable	v0.0.4	golang
github.com/grpc-ecosystem/grpc-gateway/v2	v2.29.0	golang
github.com/hashicorp/errwrap	v1.1.0	golang
github.com/hashicorp/go-cleanhttp	v0.5.2	golang
github.com/hashicorp/go-multierror	v1.1.1	golang
github.com/hashicorp/go-retryablehttp	v0.7.8	golang
github.com/hashicorp/go-rootcerts	v1.0.2	golang
github.com/hashicorp/go-secure-stdlib/parseutil	v0.2.0	golang
github.com/hashicorp/go-secure-stdlib/strutil	v0.1.2	golang
github.com/hashicorp/go-sockaddr	v1.0.7	golang
github.com/hashicorp/go-version	v1.9.0	golang
github.com/hashicorp/hcl	v1.0.1-vault-7	golang
github.com/hashicorp/hcl/v2	v2.25.0	golang
github.com/hashicorp/vault/api	v1.22.0	golang
github.com/henvic/httpretty	v0.2.0	golang
github.com/huandu/xstrings	v1.5.0	golang
github.com/ianlancetaylor/demangle	v0.0.0-20240805132620-81f5be970eca	golang
github.com/in-toto/attestation	v1.2.0	golang
github.com/in-toto/in-toto-golang	v0.11.0	golang
github.com/itchyny/gojq	v0.12.19	golang
github.com/itchyny/timefmt-go	v0.1.8	golang
github.com/jedisct1/go-minisign	v0.0.0-20230811132847-661be99b8267	golang
github.com/jellydator/ttlcache/v3	v3.4.0	golang
github.com/jinzhu/copier	v0.4.0	golang
github.com/jmoiron/sqlx	v1.4.0	golang
github.com/joho/godotenv	v1.5.1	golang
github.com/jonboulle/clockwork	v0.5.0	golang
github.com/json-iterator/go	v1.1.12	golang
github.com/kballard/go-shellquote	v0.0.0-20180428030007-95032a82bc51	golang
github.com/klauspost/compress	v1.18.6	golang
github.com/klauspost/compress	v1.20.1	golang
github.com/kylelemons/godebug	v1.1.0	golang
github.com/lann/builder	v0.0.0-20180802200727-47ae307949d0	golang
github.com/lann/ps	v0.0.0-20150810152359-62de8c46ede0	golang
github.com/lestrrat-go/blackmagic	v1.0.4	golang
github.com/lestrrat-go/dsig	v1.2.1	golang
github.com/lestrrat-go/httpcc	v1.0.1	golang
github.com/lestrrat-go/httprc/v3	v3.0.5	golang
github.com/lestrrat-go/jwx/v3	v3.1.1	golang
github.com/lestrrat-go/option/v2	v2.0.0	golang
github.com/letsencrypt/boulder	v0.20260309.0	golang
github.com/lib/pq	v1.12.3	golang
github.com/liggitt/tabwriter	v0.0.0-20181228230101-89fcab3d43de	golang
github.com/lithammer/dedent	v1.1.0	golang
github.com/lucasb-eyer/go-colorful	v1.4.1	golang
github.com/magiconair/properties	v1.18.12	golang
github.com/MakeNowJust/heredoc	v1.0.0	golang
github.com/Masterminds/goutils	v1.1.1	golang
github.com/Masterminds/semver/v3	v3.4.0	golang
github.com/Masterminds/semver/v3	v3.5.0	golang
github.com/Masterminds/sprig/v3	v3.3.0	golang
github.com/Masterminds/squirrel	v1.5.4	golang
github.com/Masterminds/vcs	v1.13.3	golang
github.com/mattn/go-colorable	v0.1.14	golang
github.com/mattn/go-colorable	v0.1.15	golang
github.com/mattn/go-isatty	v0.0.20	golang
github.com/mattn/go-isatty	v0.0.24	golang
github.com/mattn/go-runewidth	v0.0.27	golang
github.com/mattn/go-runewidth	v0.0.9	golang
github.com/mgutz/ansi	v0.0.0-20200706080929-d51e80ef957d	golang
github.com/microcosm-cc/bluemonday	v1.0.27	golang
github.com/microsoft/dev-tunnels	v0.2.0	golang
github.com/mikefarah/yq/v4	v4.54.1	golang
github.com/mitchellh/copystructure	v1.2.0	golang
github.com/mitchellh/go-homedir	v1.1.0	golang
github.com/mitchellh/go-wordwrap	v1.0.1	golang
github.com/mitchellh/hashstructure/v2	v2.0.2	golang
github.com/mitchellh/mapstructure	v1.5.1-0.20231216201459-8508981c8b6c	golang
github.com/mitchellh/reflectwalk	v1.0.2	golang
github.com/moby/spdystream	v0.5.1	golang
github.com/moby/term	v0.5.2	golang
github.com/modern-go/concurrent	v0.0.0-20180306012644-bacd9c7ef1dd	golang
github.com/modern-go/reflect2	v1.0.3-0.20250322232337-35a7c28c31ee	golang
github.com/monochromegane/go-gitignore	v0.0.0-20200626010858-205db1a8cc00	golang
github.com/mozillazg/docker-credential-acr-helper	v0.4.0	golang
github.com/muesli/cancelreader	v0.2.2	golang
github.com/muesli/reflow	v0.3.0	golang
github.com/muesli/termenv	v0.16.0	golang
github.com/muhammadmuzzammil1998/jsonc	v1.0.0	golang
github.com/munnerz/goautoneg	v0.0.0-20191010083416-a7dc8b61c822	golang
github.com/mxk/go-flowrate	v0.0.0-20140419014527-cca7078d478f	golang
github.com/natefinch/atomic	v1.0.1	golang
github.com/nozzle/throttler	v0.0.0-20180817012639-2ea982251481	golang
github.com/oklog/ulid/v2	v2.1.1	golang
github.com/oleiade/reflections	v1.1.0	golang
github.com/open-policy-agent/opa	v1.17.1	golang
github.com/opencontainers/go-digest	v1.0.0	golang
github.com/opencontainers/image-spec	v1.1.1	golang
github.com/opentracing/opentracing-go	v1.2.0	golang
github.com/pborman/uuid	v1.2.1	golang
github.com/pelletier/go-toml/v2	v2.2.4	golang
github.com/pelletier/go-toml/v2	v2.4.3	golang
github.com/peterbourgon/diskv	v2.0.1+incompatible	golang
github.com/pkg/browser	v0.0.0-20240102092130-5ac0b6a4141c	golang
github.com/pkg/errors	v0.9.1	golang
github.com/pmezard/go-difflib	v1.0.1-0.20181226105442-5d4384ee4fb2	golang
github.com/prometheus/client_golang	v1.24.0	golang
github.com/prometheus/client_model	v0.6.2	golang
github.com/prometheus/common	v0.70.0	golang
github.com/prometheus/procfs	v0.21.1	golang
github.com/protocolbuffers/txtpbfmt	v0.0.0-20260217160748-a481f6a22f94	golang
github.com/ProtonMail/go-crypto	v1.4.1	golang
github.com/rcrowley/go-metrics	v0.0.0-20250401214520-65e299d6c5c9	golang
github.com/rivo/tview	v0.42.0	golang
github.com/rivo/uniseg	v0.4.7	golang
github.com/rodaine/table	v1.3.0	golang
github.com/rogpeppe/go-internal	v1.14.1	golang
github.com/rubenv/sql-migrate	v1.8.1	golang
github.com/russross/blackfriday/v2	v2.1.0	golang
github.com/ryanuber/go-glob	v1.0.0	golang
github.com/sagikazarmark/locafero	v0.11.0	golang
github.com/santhosh-tekuri/jsonschema/v6	v6.0.3	golang
github.com/sassoftware/relic	v7.2.1+incompatible	golang
github.com/secure-systems-lab/go-securesystemslib	v0.11.0	golang
github.com/shibumi/go-pathspec	v1.3.0	golang
github.com/shopspring/decimal	v1.4.0	golang
github.com/shurcooL/githubv4	v0.0.0-20240727222349-48295856cce7	golang
github.com/shurcooL/graphql	v0.0.0-20230722043721-ed46e5a46466	golang
github.com/sigstore/cosign/v3	v3.1.3	golang
github.com/sigstore/protobuf-specs	v0.5.1	golang
github.com/sigstore/protobuf-specs	v0.5.2	golang
github.com/sigstore/rekor	v1.5.3	golang
github.com/sigstore/rekor-tiles/v2	v2.3.0	golang
github.com/sigstore/sigstore	v1.10.8	golang
github.com/sigstore/sigstore-go	v1.2.2	golang
github.com/sigstore/sigstore-go	v1.3.0	golang
github.com/sigstore/sigstore/pkg/signature/kms/aws	v1.10.8	golang
github.com/sigstore/sigstore/pkg/signature/kms/azure	v1.10.8	golang
github.com/sigstore/sigstore/pkg/signature/kms/gcp	v1.10.8	golang
github.com/sigstore/sigstore/pkg/signature/kms/hashivault	v1.10.8	golang
github.com/sigstore/timestamp-authority/v2	v2.1.2	golang
github.com/sigstore/timestamp-authority/v2	v2.1.3	golang
github.com/sirupsen/logrus	v1.9.4	golang
github.com/sourcegraph/conc	v0.3.1-0.20240121214520-5f936abd7ae8	golang
github.com/spf13/afero	v1.15.0	golang
github.com/spf13/cast	v1.10.0	golang
github.com/spf13/cast	v1.7.0	golang
github.com/spf13/cobra	v1.10.2	golang
github.com/spf13/pflag	v1.0.10	golang
github.com/spf13/viper	v1.21.0	golang
github.com/spiffe/go-spiffe/v2	v2.7.0	golang
github.com/stretchr/objx	v0.5.3	golang
github.com/stretchr/testify	v1.12.1	golang
github.com/subosito/gotenv	v1.6.0	golang
github.com/syndtr/goleveldb	v1.0.1-0.20220721030215-126854af5e6d	golang
github.com/tchap/go-patricia/v2	v2.3.3	golang
github.com/tetratelabs/wabin	v0.0.0-20230304001439-f6f874872834	golang
github.com/tetratelabs/wazero	v1.12.0	golang
github.com/theupdateframework/go-tuf	v0.7.0	golang
github.com/theupdateframework/go-tuf/v2	v2.4.2	golang
github.com/thlib/go-timezone-local	v0.0.8	golang
github.com/titanous/rocacheck	v0.0.0-20171023193734-afe73141d399	golang
github.com/tjfoc/gmsm	v1.4.1	golang
github.com/transparency-dev/formats	v0.1.1	golang
github.com/transparency-dev/merkle	v0.0.2	golang
github.com/twitchtv/twirp	v8.1.3+incompatible	golang
github.com/valyala/fastjson	v1.6.10	golang
github.com/vektah/gqlparser/v2	v2.5.33	golang
github.com/vmihailenco/msgpack/v5	v5.4.1	golang
github.com/vmihailenco/tagparser/v2	v2.0.0	golang
github.com/withfig/autocomplete-tools/integrations/cobra	v1.2.1	golang
github.com/x448/float16	v0.8.4	golang
github.com/xeipuuv/gojsonpointer	v0.0.0-20190905194746-02993c407bfb	golang
github.com/xeipuuv/gojsonreference	v0.0.0-20180127040603-bd5ef7bd5415	golang
github.com/xlab/treeprint	v1.2.0	golang
github.com/xo/terminfo	v0.0.0-20220910002029-abceb7e1c41e	golang
github.com/yashtewari/glob-intersection	v0.2.0	golang
github.com/youmark/pkcs8	v0.0.0-20240726163527-a2c0da244d78	golang
github.com/yuin/goldmark	v1.8.6	golang
github.com/yuin/goldmark-emoji	v1.0.6	golang
github.com/yuin/gopher-lua	v1.1.2	golang
github.com/zalando/go-keyring	v0.2.8	golang
github.com/zclconf/go-cty	v1.19.0	golang
gitlab.com/gitlab-org/api/client-go	v1.46.0	golang
glibc-2.44	2.44-r8	apk
glibc-2.44-locale-posix	2.44-r8	apk
go.opentelemetry.io/auto/sdk	v1.2.1	golang
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	v0.68.0	golang
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.68.0	golang
go.opentelemetry.io/otel	v1.44.0	golang
go.opentelemetry.io/otel/metric	v1.44.0	golang
go.opentelemetry.io/otel/trace	v1.44.0	golang
go.opentelemetry.io/proto/otlp	v1.10.0	golang
go.uber.org/multierr	v1.11.0	golang
go.uber.org/zap	v1.28.0	golang
go.yaml.in/yaml/v2	v2.4.4	golang
go.yaml.in/yaml/v3	v3.0.4	golang
go.yaml.in/yaml/v3	v3.0.5	golang
go.yaml.in/yaml/v4	v4.0.0-rc.6	golang
golang.org/x/crypto	v0.53.0	golang
golang.org/x/crypto	v0.55.0	golang
golang.org/x/crypto	v0.57.0	golang
golang.org/x/mod	v0.37.0	golang
golang.org/x/mod	v0.41.0	golang
golang.org/x/net	v0.56.0	golang
golang.org/x/net	v0.57.0	golang
golang.org/x/net	v0.58.0	golang
golang.org/x/net	v0.59.0	golang
golang.org/x/oauth2	v0.36.0	golang
golang.org/x/sync	v0.21.0	golang
golang.org/x/sync	v0.22.0	golang
golang.org/x/sync	v0.23.0	golang
golang.org/x/sys	v0.46.0	golang
golang.org/x/sys	v0.47.0	golang
golang.org/x/sys	v0.48.0	golang
golang.org/x/term	v0.44.0	golang
golang.org/x/term	v0.45.0	golang
golang.org/x/term	v0.46.0	golang
golang.org/x/text	v0.38.0	golang
golang.org/x/text	v0.40.0	golang
golang.org/x/text	v0.41.0	golang
golang.org/x/text	v0.42.0	golang
golang.org/x/time	v0.15.0	golang
google.golang.org/api	v0.284.0	golang
google.golang.org/genproto	v0.0.0-20260406210006-6f92a3bedf2d	golang
google.golang.org/genproto/googleapis/api	v0.0.0-20260526163538-3dc84a4a5aaa	golang
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260526163538-3dc84a4a5aaa	golang
google.golang.org/grpc	v1.82.0	golang
google.golang.org/grpc	v1.83.2	golang
google.golang.org/protobuf	v1.36.12	golang
google.golang.org/protobuf	v1.36.12-0.20260120151049-f2248ac996af	golang
gopkg.in/evanphx/json-patch.v4	v4.13.0	golang
gopkg.in/inf.v0	v0.9.1	golang
gopkg.in/ini.v1	v1.67.3	golang
gopkg.in/yaml.v3	v3.0.1	golang
heimdal-libs	7.8.0-r53	apk
helm	4.3.0	golang
helm.sh/helm/v4	v4.3.0	golang
jq	1.8.2-r3	apk
k8s.io/api	UNKNOWN	golang
k8s.io/api	v0.36.2	golang
k8s.io/api	v0.37.0	golang
k8s.io/apiextensions-apiserver	v0.37.0	golang
k8s.io/apimachinery	UNKNOWN	golang
k8s.io/apimachinery	v0.36.2	golang
k8s.io/apimachinery	v0.37.0	golang
k8s.io/apiserver	v0.37.0	golang
k8s.io/cli-runtime	UNKNOWN	golang
k8s.io/cli-runtime	v0.37.0	golang
k8s.io/client-go	UNKNOWN	golang
k8s.io/client-go	v0.36.2	golang
k8s.io/client-go	v0.37.0	golang
k8s.io/component-base	UNKNOWN	golang
k8s.io/component-base	v0.37.0	golang
k8s.io/component-helpers	UNKNOWN	golang
k8s.io/klog/v2	v2.140.0	golang
k8s.io/kube-openapi	v0.0.0-20260317180543-43fb72c5454a	golang
k8s.io/kube-openapi	v0.0.0-20260721132016-d427ff9ee9ad	golang
k8s.io/kubectl	UNKNOWN	golang
k8s.io/kubectl	v0.37.0	golang
k8s.io/kubernetes	v1.37.1	golang
k8s.io/metrics	UNKNOWN	golang
k8s.io/streaming	UNKNOWN	golang
k8s.io/utils	v0.0.0-20260210185600-b8788abfbbc2	golang
k8s.io/utils	v0.0.0-20260626114624-be93311217bd	golang
keyutils-libs	1.6.3-r41	apk
krb5-conf	1.0-r10	apk
krb5-libs	1.22.2-r5	apk
kubectl	1.37.1	generic
ld-linux-2.44	2.44-r8	apk
libbrotlicommon1	1.2.0-r5	apk
libbrotlidec1	1.2.0-r5	apk
libbrotlienc1	1.2.0-r5	apk
libcom_err	1.47.4-r3	apk
libcrypt1-2.44	2.44-r8	apk
libcrypto3	3.6.5-r2	apk
libcurl-openssl4	8.22.0-r4	apk
libexpat1	2.9.0-r0	apk
libgcc	16.2.0-r1	apk
libidn2	2.3.8-r10	apk
libldap	2.6.10-r5	apk
libnghttp2-14	1.70.0-r5	apk
libpcre2-8-0	10.49-r1	apk
libpsl	0.23.3-r1	apk
libssl3	3.6.5-r2	apk
libunistring	1.4.2-r4	apk
libverto	0.3.2-r9	apk
libxcrypt	4.5.2-r6	apk
ncurses	6.6.20260926-r0	apk
ncurses-terminfo-base	6.6.20260926-r0	apk
nghttp3	1.18.0-r1	apk
ngtcp2	1.25.0-r5	apk
oniguruma	6.9.10-r5	apk
openssl-4.0-libcrypto	4.0.3-r6	apk
openssl-4.0-libssl	4.0.3-r6	apk
openssl-provider-legacy-allowed	4.0.3-r1	apk
oras.land/oras-go/v2	v2.6.2	golang
readline	8.3-r3	apk
sigs.k8s.io/controller-runtime	v0.24.1	golang
sigs.k8s.io/json	v0.0.0-20250730193827-2d320260d730	golang
sigs.k8s.io/kustomize/api	v0.21.1	golang
sigs.k8s.io/kustomize/kustomize/v5	v5.8.1	golang
sigs.k8s.io/kustomize/kyaml	v0.21.1	golang
sigs.k8s.io/randfill	v1.0.0	golang
sigs.k8s.io/release-utils	v0.12.4	golang
sigs.k8s.io/structured-merge-diff/v6	v6.3.2	golang
sigs.k8s.io/structured-merge-diff/v6	v6.4.2	golang
sigs.k8s.io/yaml	v1.6.0	golang
sqlite-libs	3.53.4-r2	apk
stdlib	go1.26.4	golang
stdlib	go1.26.6	golang
stdlib	go1.26.8	golang
stdlib	go1.27.1	golang
stdlib	go1.27.2	golang
wolfi-base	1-r7	apk
wolfi-baselayout	20230201-r30	apk
wolfi-keys	1-r13	apk
zlib	1.3.2.1_rc20260917-r0	apk