Estate overview
clearcutt-showcase
clearcutt-verify checked 9 images from ghcr.io against the policy below, finishing at 2026-10-19 07:41 UTC. Each image is verified, failed, or unverified, with the reasons it wasn't verified.
Verdicts
9
✓ Verified
Meets every requirement in the policy.
0
✕ Failed
Violates at least one requirement in the policy.
0
? Unverified
At least one requirement couldn't be decided. Not a pass, and not a failure.
9
Base proven
by layer digests; 0 more rest on a claim
6
On a stale base
of 9 images with a known base
0
Base unresolved
no base could be determined
0
Vulnerabilities unknown
images with no vulnerability data
9
Reproduced
of 9 images with a recipe or rebase record
0
On an older stack
of 3 apps on 3 registry stacks
Not verified, and why
Every image meets every requirement in the policy.
Stale bases
Behind is measured against the newest version of the same base observed in this run, not against upstream. The policy fails images more than 7 days behind.
| Image | Base | How it's known | Versions behind | Days behind |
|---|---|---|---|---|
| build-go:1 | cgr.dev/chainguard/wolfi-base:latest | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. | 1 | 5 |
| build-node:24 | cgr.dev/chainguard/wolfi-base:latest | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. | 1 | 5 |
| build-python:3.14 | cgr.dev/chainguard/wolfi-base:latest | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. | 1 | 5 |
| run-go:1 | cgr.dev/chainguard/wolfi-base:latest | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. | 1 | 5 |
| run-node:24 | cgr.dev/chainguard/wolfi-base:latest | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. | 1 | 5 |
| run-python:3.14 | cgr.dev/chainguard/wolfi-base:latest | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. | 1 | 5 |
Images
| Image | Verdict | Base | Sig | SBOM | Vulns | Prov | Recipe | Rebase | Tests | Vulnerabilities | Rebuild |
|---|---|---|---|---|---|---|---|---|---|---|---|
| build-go:1 ghcr.io/northcutted/clearcutt-showcase/platform/build-go | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Stale. A newer version of its base was observed in this run. | Signature: Verified | SBOM: Verified | Vulnerability report: Verified | SLSA provenance: Verified | Recipe: Verified | Rebase record: Not applicable. No rebase record: the image was built, not rebased. | Tests: Declared in recipe. The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && go version && git --version) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested. | 0 findings | Rebuild: Reproduced. Reproduced from the recipe verified on this image by clearcutt-factory v0.3.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39038127661/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it. |
| build-node:24 ghcr.io/northcutted/clearcutt-showcase/platform/build-node | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Stale. A newer version of its base was observed in this run. | Signature: Verified | SBOM: Verified | Vulnerability report: Verified | SLSA provenance: Verified | Recipe: Verified | Rebase record: Not applicable. No rebase record: the image was built, not rebased. | Tests: Declared in recipe. The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && node --version && npm --version) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested. | 0 C · 6 H | Rebuild: Reproduced. Reproduced from the recipe verified on this image by clearcutt-factory v0.3.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39038131198/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it. |
| build-python:3.14 ghcr.io/northcutted/clearcutt-showcase/platform/build-python | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Stale. A newer version of its base was observed in this run. | Signature: Verified | SBOM: Verified | Vulnerability report: Verified | SLSA provenance: Verified | Recipe: Verified | Rebase record: Not applicable. No rebase record: the image was built, not rebased. | Tests: Declared in recipe. The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && python3 -m pip --version && cc --version && pkg-config --modversion libxml-2.0) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested. | 0 C · 0 H | Rebuild: Reproduced. Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it. |
| catalog:latest ghcr.io/northcutted/clearcutt-showcase/apps/catalog | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Current. On the newest version of its base observed in this run. | Signature: Verified | SBOM: Verified | Vulnerability report: Verified | SLSA provenance: Verified | Recipe: Verified | Rebase record: Not applicable. No rebase record: the image was built, not rebased. | Tests: Declared in recipe. The verified recipe declares a smoke test (GET :8080/healthz) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested. | 0 C · 0 H | Rebuild: Reproduced. Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-catalog/actions/runs/39031596076/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it. |
| checkout:latest ghcr.io/northcutted/clearcutt-showcase/apps/checkout | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Current. On the newest version of its base observed in this run. | Signature: Verified | SBOM: Verified | Vulnerability report: Verified | SLSA provenance: Verified | Recipe: Verified | Rebase record: Not applicable. No rebase record: the image was built, not rebased. | Tests: Declared in recipe. The verified recipe declares a smoke test (GET :8080/healthz) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested. | 0 C · 0 H | Rebuild: Reproduced. Reproduced from the recipe verified on this image by clearcutt-factory v0.3.0 on https://github.com/northcutted/clearcutt-showcase-checkout/actions/runs/39135799332/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it. |
| run-go:1 ghcr.io/northcutted/clearcutt-showcase/platform/run-go | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Stale. A newer version of its base was observed in this run. | Signature: Verified | SBOM: Verified | Vulnerability report: Verified | SLSA provenance: Verified | Recipe: Verified | Rebase record: Not applicable. No rebase record: the image was built, not rebased. | Tests: Declared in recipe. The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && test -s /etc/ssl/certs/ca-certificates.crt && test -e /usr/share/zoneinfo/UTC) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested. | 0 findings | Rebuild: Reproduced. Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it. |
| run-node:24 ghcr.io/northcutted/clearcutt-showcase/platform/run-node | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Stale. A newer version of its base was observed in this run. | Signature: Verified | SBOM: Verified | Vulnerability report: Verified | SLSA provenance: Verified | Recipe: Verified | Rebase record: Not applicable. No rebase record: the image was built, not rebased. | Tests: Declared in recipe. The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && node -e "console.log(process.version, process.versions.openssl)") that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested. | 0 findings | Rebuild: Reproduced. Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it. |
| run-python:3.14 ghcr.io/northcutted/clearcutt-showcase/platform/run-python | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Stale. A newer version of its base was observed in this run. | Signature: Verified | SBOM: Verified | Vulnerability report: Verified | SLSA provenance: Verified | Recipe: Verified | Rebase record: Not applicable. No rebase record: the image was built, not rebased. | Tests: Declared in recipe. The verified recipe declares a smoke test (/bin/sh -c test "$(id -u)" = 65532 && python3 -c "import ssl, sys; print(sys.version, ssl.OPENSSL_VERSION)" && ls /usr/lib/libxml2.so.*) that clearcutt-factory runs on every platform before it pushes; the result isn't separately attested. | 0 C · 0 H | Rebuild: Reproduced. Reproduced from the recipe verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-platform/actions/runs/39030550077/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it. |
| storefront:latest ghcr.io/northcutted/clearcutt-showcase/apps/storefront | Verified. Meets every requirement in the policy. | Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.Current. On the newest version of its base observed in this run. | Signature: Verified | SBOM: Verified | Vulnerability report: Verified | SLSA provenance: Verified | Recipe: Not applicable. Rebased: the rebase record names the image that was built from a recipe. | Rebase record: Verified | Tests: Missing. No test attestation. The recipe of the image it was rebased from declares a smoke test (GET :8080/healthz), but the rebase record doesn't say whether the rebase ran it: clearcutt-factory runs the app's smoke test when it rebases from the app manifest (rebase -f, as its fleet workflow does), not when it rebases --image or with --no-test. | 0 findings | Rebuild: Reproduced. Reproduced from the rebase record verified on this image by clearcutt-factory v0.2.0 on https://github.com/northcutted/clearcutt-showcase-storefront/actions/runs/39031096208/attempts/1, as its verified reproduction attestation says; this run didn't rebuild it. |
✓ verified · ○ present, unverified · ! missing · ✕ failed · ? unknown · – not applicable
Evidence across the estate
| Evidence | Verified | Present | Failed | Missing | Unknown | n/a |
|---|---|---|---|---|---|---|
| Signature | 9 | 0 | 0 | 0 | 0 | 0 |
| SBOM | 9 | 0 | 0 | 0 | 0 | 0 |
| Vulnerability report | 9 | 0 | 0 | 0 | 0 | 0 |
| SLSA provenance | 9 | 0 | 0 | 0 | 0 | 0 |
| Recipe | 8 | 0 | 0 | 0 | 0 | 1 |
| Rebase record | 1 | 0 | 0 | 0 | 0 | 8 |
| Tests | 0 | 8 | 0 | 1 | 0 | 0 |
Vulnerabilities
Totals over the 9 images with vulnerability data. Every image has vulnerability data.Each image's findings describe the day its report was made.
| critical | high | medium | low | negligible | unknown | |
|---|---|---|---|---|---|---|
| Findings | 0 | 6 | 16 | 1 | 0 | 3 |
| With a fix | 0 | 5 | 13 | 1 | 0 | 3 |
Policy
- Required, verified
- Signature, SBOM, Vulnerability report, SLSA provenance, Recipe
- Vulnerabilities
- fail at critical or above, counting only findings with a fix
- Scan age
- any age: a scan describes the day it was made, however long ago
- Base age
- fail when more than 7 days behind
- Rebuilds
- this run rebuilt images to check them
- Trusted signers
- Identity matching
^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$- Issuer
https://token.actions.githubusercontent.com- Run in repository
https://github.com/northcutted/clearcutt-showcase-platform- Run on ref
refs/heads/main- Run in
the repository the image names as its source
- Identity matching
^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$- Issuer
https://token.actions.githubusercontent.com- Run in repository
https://github.com/northcutted/clearcutt-showcase-checkout- Run on ref
refs/heads/main- Run in
the repository the image names as its source
- Identity matching
^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$- Issuer
https://token.actions.githubusercontent.com- Run in repository
https://github.com/northcutted/clearcutt-showcase-catalog- Run on ref
refs/heads/main- Run in
the repository the image names as its source
- Identity matching
^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$- Issuer
https://token.actions.githubusercontent.com- Run in repository
https://github.com/northcutted/clearcutt-showcase-storefront- Run on ref
refs/heads/main- Run in
the repository the image names as its source
- Stack signers
- Identity
https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main- Issuer
https://token.actions.githubusercontent.com