About

How to read this site

This site shows what clearcutt-verify found and proved about an image estate in one run. It was generated from that run's report, without contacting a registry, and says nothing the report doesn't.

The difference between proven and claimed runs through every page. Proven means checked: a signature verified against a signer the policy trusts, or a base established by comparing layer digests. Claimed means someone wrote it down: a label, an annotation, or evidence nobody could check. Unknown means the run couldn't find out, and it is never shown as zero, absent, or a pass.

Evidence

Every piece of supply-chain evidence for every image has one of these statuses.

Found, and checked against a trusted signer in the policy.	Found, and checked against a trusted signer in the policy.
Found, but not checked: no trusted signer applies, or it can't be checked. It exists; it isn't proven.	Found, but not checked: no trusted signer applies, or it can't be checked. It exists; it isn't proven.
Found, and the check failed: a wrong signer, a bad signature, or a digest mismatch.	Found, and the check failed: a wrong signer, a bad signature, or a digest mismatch.
Looked for, and there is none.	Looked for, and there is none.
Couldn't be looked for (a registry error or an unsupported store). Not absent, and not a pass.	Couldn't be looked for (a registry error or an unsupported store). Not absent, and not a pass.
Doesn't apply to this image.	Doesn't apply to this image.

Tests

Test evidence is an attestation, or a smoke test the image's recipe declares. The second is present evidence of a particular kind, so it is labelled for what it is.

The image's verified recipe declares a smoke test, which clearcutt-factory runs on every platform before it pushes, and it pushes nothing that fails. Nothing attests that the test ran, so it is a claim, not proof.

Verdicts

Whether an image meets the policy. An image that is not verified lists one reason per requirement it misses.

Meets every requirement in the policy.	Meets every requirement in the policy.
Violates at least one requirement in the policy.	Violates at least one requirement in the policy.
At least one requirement couldn't be decided. Not a pass, and not a failure.	At least one requirement couldn't be decided. Not a pass, and not a failure.

How a base is known

Only layer digests are proof. Everything else is something the image's author wrote.

The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.	The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.
An exact claim the image's author wrote (a label or annotation naming the base). Not checked against the layers.	An exact claim the image's author wrote (a label or annotation naming the base). Not checked against the layers.
A partial claim by the image's author: it names the base repository but not the version.	A partial claim by the image's author: it names the base repository but not the version.
The base repository appears in the image's build history. A hint, not evidence.	The base repository appears in the image's build history. A hint, not evidence.

Base currency

Measured against the newest version of the same base observed in the run, not against upstream.

On the newest version of its base observed in this run.	On the newest version of its base observed in this run.
A newer version of its base was observed in this run.	A newer version of its base was observed in this run.
Whether a newer version of its base exists couldn't be determined.	Whether a newer version of its base exists couldn't be determined.

Stack versions

Whether an app's lock pins the version of its clearcutt-factory stack that the stack's tag names now.

Pinned to the version the stack's tag names now.	Pinned to the version the stack's tag names now.
Pinned to a version other than the one the stack's tag names now.	Pinned to a version other than the one the stack's tag names now.
The stack's tag couldn't be read, so whether this is its newest version is unknown.	The stack's tag couldn't be read, so whether this is its newest version is unknown.

Rebuilds

Whether rebuilding the image from its recipe, or repeating its rebase, gives the same digest: checked by this run's rebuild, or by a clearcutt-factory reproduction attestation verified against a trusted signer.

Rebuilt, and the rebuild has the same digest.	Rebuilt, and the rebuild has the same digest.
Rebuilt, and the rebuild has a different digest.	Rebuilt, and the rebuild has a different digest.
A recipe exists, but this run didn't rebuild the image, or the rebuild couldn't finish.	A recipe exists, but this run didn't rebuild the image, or the rebuild couldn't finish.
Nothing to rebuild from, so reproducibility is not known.	Nothing to rebuild from, so reproducibility is not known.

Vulnerabilities and packages

Findings describe the day their report was made, which each image page shows. An image with no vulnerability data is unknown, not clean, and estate totals cover only the images that had data.

"Which images ship this package" is answered only for images whose package set is in the report. The packages pages name the images that weren't covered, because a package's absence says nothing about them.

The package search compares versions the way each package's ecosystem orders them, and adds the images built on one that ships a match: they have its layers, so they inherit it. Each such answer says how the base link is known, and whether the image is on the very version of its base whose packages the report read.

Checking it yourself

Each image page lists commands that check what it says without trusting this site: cosign for every signature and attestation the report says verified, against the signer the policy trusts; gh for GitHub's provenance; clearcutt-factory to rebuild a factory image; and clearcutt-verify to reach the verdict again. They name images by digest, never by tag. The values in them come from the report, so each is quoted for the shell, and a value that can't be shown exactly as it would run keeps its command off the page.

Policy

Required, verified

Signature, SBOM, Vulnerability report, SLSA provenance, Recipe

Vulnerabilities

fail at critical or above, counting only findings with a fix

Scan age

any age: a scan describes the day it was made, however long ago

Base age

fail when more than 7 days behind

Rebuilds

this run rebuilt images to check them

Trusted signers

Identity matching
^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$
Issuer
https://token.actions.githubusercontent.com
Run in repository
https://github.com/northcutted/clearcutt-showcase-platform
Run on ref
refs/heads/main
Run in
the repository the image names as its source
Identity matching
^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$
Issuer
https://token.actions.githubusercontent.com
Run in repository
https://github.com/northcutted/clearcutt-showcase-checkout
Run on ref
refs/heads/main
Run in
the repository the image names as its source
Identity matching
^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$
Issuer
https://token.actions.githubusercontent.com
Run in repository
https://github.com/northcutted/clearcutt-showcase-catalog
Run on ref
refs/heads/main
Run in
the repository the image names as its source
Identity matching
^https://github\.com/northcutted/clearcutt-factory/\.github/workflows/(images|fleet)\.yml@refs/tags/v\d+\.\d+\.\d+$
Issuer
https://token.actions.githubusercontent.com
Run in repository
https://github.com/northcutted/clearcutt-showcase-storefront
Run on ref
refs/heads/main
Run in
the repository the image names as its source

Stack signers

Identity
https://github.com/northcutted/clearcutt-showcase-platform/.github/workflows/stacks.yml@refs/heads/main
Issuer
https://token.actions.githubusercontent.com

This report

Estate: clearcutt-showcase
Written by: clearcutt-verify v0.16.0
Finished: 2026-10-19 07:41 UTC
Read from: ghcr.io (northcutted/clearcutt-showcase/apps/catalog, northcutted/clearcutt-showcase/apps/checkout, northcutted/clearcutt-showcase/apps/storefront, northcutted/clearcutt-showcase/platform/build-go, northcutted/clearcutt-showcase/platform/build-node, northcutted/clearcutt-showcase/platform/build-python, northcutted/clearcutt-showcase/platform/run-go, northcutted/clearcutt-showcase/platform/run-node, northcutted/clearcutt-showcase/platform/run-python)
Format: clearcutt.dev/v1 (this portal reads clearcutt.dev/v1)
History: 17 runs
Raw data: estate-report.json, estate-history.json
Rendered by: clearcutt-portal v0.1.0