Package · github
ca-certificates.yaml
2 images ship it, in 1 version. Oldest version first. Search its versions.
Not covered
2 images have no package set in the report. Whether they ship this is unknown: amazonlinux:2023, debian:trixie-slim.
f47c125470a19db0f450c2e4928a0db14f933d91
pkg:github/chainguard-dev/stereo@f47c125470a19db0f450c2e4928a0db14f933d91#ca-certificates.yaml
| Image | Repository | Package list read from |
|---|---|---|
| static:latest | cgr.dev/chainguard/static | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| wolfi-base:latest | cgr.dev/chainguard/wolfi-base | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| Built on one that ships it | How |
|---|---|
| hello-app:latest | Its base ships it Built on static:latest, which ships it. The base link is proven by layer digests. Its own package list doesn't have it: a later layer may have removed it, or the list missed it. |
| platform-tools:latest | Its base ships it Built on wolfi-base:latest, which ships it. The base link is proven by layer digests. Its own package list doesn't have it: a later layer may have removed it, or the list missed it. |
Each image's package list was read from the evidence named, for the platform images listed (its packages are their union). Verified means a trusted signer vouched for all of it; anything else means some of it wasn't verified, so the list may not be complete. Not recorded means the report doesn't say where it came from.